Choosing a security approach
Four different instruments that get confused with each other, compared honestly — including the cases where you should not hire us. Most protocols need two of these, not one.
$3k–$30k · 1–5 weeks
$30k–$200k+ · 3–10 weeks
$20k–$100k prize pool · 1–3 weeks
Payout on finding · ongoing
You need a badge more than a review. If an exchange listing or an investor term sheet names a specific firm, hire that firm. We cannot give you their logo and it would be dishonest to pretend the review substitutes for the requirement.
Your system is primarily non-EVM. A Solana-first or Move-first protocol should hire a firm whose core team lives in that ecosystem. We deliver those engagements with partner researchers and we will say so — but if the whole protocol is Rust, the partners should be the principals.
You need ten researchers next Monday. We are small on purpose. If your launch date requires a bench we do not have, an overbooked auditor is worse than a different auditor.
What we would actually do
Security is layered, not chosen. Here is the sequence we recommend most often, and roughly what it costs.
Systematic coverage of the code where loss is possible, with a threat model you keep. Narrow the scope before you narrow the depth.
The highest-leverage artefact from any engagement. It keeps testing every commit long after the report is filed.
Standing coverage with real payout bands. Complements the audit; does not replace it.
Because the code you audited is not the code you are running three months later.
Different instruments. An audit gives you named accountability, a threat model, a walkthrough and someone who will answer the phone in six months. A contest gives you many eyes for a fixed prize pool and is excellent at finding what is findable quickly. If you can only afford one before launch, take the audit — then run a contest or a bounty as ongoing coverage.
Sometimes, and be honest about which reason applies. If you need the brand on your landing page for investors or an exchange listing, that is a real commercial reason and a large firm delivers it. If you need the code read carefully, firm size does not predict that — the individual researchers assigned to you do, and at a large firm you usually cannot choose them.
Whatever is cheap enough to find relative to the payout. Bounty hunters are rational: they look where the expected value is highest. That makes bounties excellent standing coverage and poor systematic coverage, because nobody is paid to read the boring parts of your codebase.
No, and forks deserve particular care. The base is well-tested, so teams assume the whole thing is safe and the diff gets less scrutiny than a greenfield build would. Every assumption the original design relied on may have been broken by your changes, and nobody has checked.
A pre-deployment assessment on the contracts that hold funds, plus an invariant suite in CI, plus a bug bounty at launch. That combination costs less than a full audit and covers more ground than any single instrument. We will tell you if that is the right shape for your budget rather than quoting for something larger.
Not sure which you need?
Budget, launch date, what the code does. We will tell you the shape that fits — including when it is not us.