HOW WE AUDIT

Fuzzing, formal verification and manual review, matched to your system

Different systems call for different techniques. We’ve built our own fuzzers and verification tooling, and we pick the mix that fits yours.

$36.82B+On-chain TVL secured

120+Projects audited

Public audits Get in touch

Trusted by teams building the next generation of crypto

Formally verified the Aptos stdlibMaintainers of AnchorPublic audit reports

CLIENTS

Clients on our rigor

“Their website says protecting Blockchain ideas, but their command of JavaScript is impressive. If you've got something that you think would be "too hard for pentesters to understand" - these folks will surprise you. They're not your average pentester.”

Zbigniew TenerowiczMetaMask

“As a blockchain, speed, scalability, and security are critical to our everyday operations. OtterSec's responsiveness, attentiveness, and talent are second-to-none when it comes to securing Solana's core code.”

Dominic TsangSolana Foundation

“Working with OtterSec on critical audits has been a great experience. It’s clear OtterSec cares deeply about customer satisfaction and the security of our protocols. Their communication and flexibility was refreshing.”

John WoodsAlgorand

HOW WE AUDIT

The process

01

Talk it through

A first conversation about what you’re building, when you need it secured and what worries you most.
02

Look at the code

We sign an MNDA and read the in-scope repositories before committing to anything.
03

Agree the scope

You get a quote sized to duration, likely vulnerabilities and overall complexity. No guesswork.
04

Findings as they land

Once we kick off, issues reach your team as we find them, not weeks later.
05

Report and fixes

A final report with every finding and our suggestions for fixing it.

Start the conversation

WHAT WE AUDIT

Our techniques

Fuzzing is one of our core disciplines. Formal verification and pentesting sit right next to it.

Formal verification

Our own tooling and a novel verification framework for Solana. We also worked with the Aptos core team to formally verify their standard library.

Fuzzing

A core discipline: differential compiler fuzzers for Vyper, transactional fuzzers for Solana validators, rBPF JIT fuzzers and Move VM bytecode fuzzers.

Pentesting

White-box and black-box testing based on each project’s needs, aimed at the large, underexplored Web2 attack surfaces that remain in many Web3 applications.

WHY OTTERSEC

Why technique matters

Coverage across Solidity, Vyper, Solana Rust, CosmWasm, Go, Move, JavaScript, Circom and Halo 2.
Findings shared as they emerge, not held back for the final report.
The mix of manual review, fuzzing and formal verification your system calls for.
A final report with every finding and suggestions for fixes.
Researchers who audited Solana’s core code and have secured Sui since pre-mainnet.

FAQ

About our methods

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Can we read past audits?

Yes. Every public security review from the OtterSec team is listed at osec.io/audits.

How does an audit start?

With an initial discussion of your goals, timeline and security needs to see whether we’re a fit. We then send an MNDA and review the repositories in scope.

GET AN AUDIT

Get the techniques your system actually needs

Start with a conversation about your goals and security needs. We’ll scope the right mix.

Start the conversation