Security testing
Hands-on tests. Proof you can reproduce.
All security testingHow we workWhat happens after the first call.See the processBuild
We break software for a living. This is what we build.
All build servicesProof of workOur own apps, built the same way.See themA manual, line-by-line review of your Solidity, backed by static analysis, fuzzing and invariant tests, and checked against your spec and the SCSVS.
Once a contract is live, anyone can call it. We call it first, the way an attacker would.
Out of scope stays out. We ask first.
Owner and role checks, initialisers, pausing and every privileged function.
Deposits, withdrawals, accounting, rounding and fee maths.
Reentrancy, callbacks, unchecked returns and non-standard tokens.
Price manipulation, stale data and flash loan exposure.
Proxies, storage layout, initialisation and who can upgrade.
Does the code do what your docs and tests say?
A frozen commit, the contracts and the dates. We read your docs and tests first.
Slither and Semgrep flag known patterns before we read a line.
Line by line, with a model of who can call what, and what they could take.
The properties that must always hold, fuzzed with Foundry, Echidna and Medusa.
A Foundry test for each confirmed issue. Watch it fail, then pass after the fix.
Severity, impact and a fix for each finding, then we review your fix commits.
How a finding reads
Muneeb has audited these chains, bridges and protocols, and been rewarded for what he found. Your contracts get the same reading.
| Findings mapped to |
|
|---|---|
| Tools we use |
|
Solidity on Ethereum and EVM-compatible chains. Something else? Ask, and we’ll tell you straight if it fits.
No. It lowers risk. We review one frozen commit in a fixed time. Code that changes after it isn’t covered unless we review that too.
A frozen commit hash, docs or a spec, a test suite that runs, your deploy scripts, and a developer who can answer design questions.
We review source at a commit, and check that the deployed bytecode matches it, so the report describes what’s really on chain.
Send the scope and your deadline, and we’ll set up a call.
