Code That Holds Up When Real Money Is on the Line.

We audit both. Our audit team regularly reviews contracts built by other teams entirely, as a standalone engagement separate from any development work. This is actually the healthier setup from a security standpoint, since an audit team with no attachment to the original code has no incentive to overlook a flaw they might otherwise feel responsible for.

A standard protocol audit takes 2–4 weeks depending on contract complexity, lines of code, and how many distinct economic mechanisms are involved. Formal verification engagements, which mathematically prove specific invariants rather than just searching for known vulnerability patterns, typically run longer — often 4–8 weeks depending on the complexity of the properties being proven.

Yes, in most cases we can retrofit proxy-based upgradeability where the existing contract architecture allows it without excessive risk. Where the existing design makes safe retrofitting impractical, we'll advise honestly on a migration path to a new, upgradeable version rather than forcing an unsafe retrofit onto an architecture that wasn't designed for it.

We provide a full findings report with severity ratings (critical, high, medium, low, informational) and concrete remediation guidance for each issue. Once your team implements the fixes, we re-audit specifically those changes before issuing final sign-off — a fix that isn't re-verified is not meaningfully different from no fix at all.

Yes — our audit capability extends to Rust-based programs on Solana, Sui, and similar ecosystems, as well as Move-based contracts. The underlying vulnerability classes differ by language and execution model, so we match auditors with relevant experience in that specific environment rather than applying a generic EVM-centric checklist everywhere.

Audit scope and pricing depend primarily on lines of code, the number of distinct economic mechanisms in the protocol, and whether formal verification is required in addition to standard review. We provide a fixed-scope quote after an initial codebase review, so there are no surprise costs mid-engagement.