Anonymous teams, without a call
Pseudonymous is fine. Unreachable is not.
Detection engineering · on-chain and SIEM
We build the detections that fire when something is actually wrong.
Two domains, one discipline. On-chain: invariants for lending protocols and yield vaults, designed so an alert means something and you know what to do when it lands. In the SIEM: we currently run detection engineering for a US client on Splunk, writing and tuning content their analysts keep switched on.
Sigma · Splunk · Elastic · Solidity / EVM
Scoped to one practitioner, with response windows stated in working hours rather than implied as continuous.
Scoped to one practitioner, with response windows stated in working hours rather than implied as continuous.
FiredINV-04 · utilisation ceilingblock 21,447,902
// breached for 3 consecutive blocks
invariant utilisation = totalBorrows / totalSupply
expected <= 0.95
observed 0.9973
window 3 blocks
What it means. Utilisation this close to 100% means withdrawals will start failing and the liquidation path is no longer economic. It is the state that precedes most lending-protocol insolvencies.
What happens. The alert carries the runbook: which parameter to move, and what the rate curve does when you move it.
What happens. The alert carries the runbook: which parameter to move, and what the rate curve does when you move it.
LendingEVMRunbook attached
↑ An example invariant. This is the shape of what we deliver.
Which one are you?
These are different problems with different vocabulary. Pick the one that describes your week.
On-chain · protocol teams
Your contract is deployed and you are watching it manually
Audit finished, code shipped, and the monitoring plan is a Tenderly account nobody has configured. We design the invariants worth watching for lending protocols and yield vaults, implement them, and write the runbook that goes with each alert.
On-chain monitoring SIEM · MSSP and internal SOCYou need detection content faster than you can hire for it
Sigma as the source of truth, compiled to your platform, mapped to ATT&CK, validated against the technique rather than a sample string, and tuned until the false-positive rate is one your analysts will tolerate.
SIEM detection engineeringFive invariants on a lending pool.
Each one is a claim about the protocol that should always hold. The bar shows where the value sits against its limit; the number is always shown, because a bar on its own is not an answer.
Utilisation ceilingBreach
0.9973limit 0.95
Admin calls, 24hWatch
3expected 0–1
Collateralisation floorHealthy
1.42×floor 1.25×
Oracle deviationHealthy
0.8%limit 2.0%
Supply / borrow parityHealthy
0.02%drift limit 0.10%
Illustrative, not live. These are the shapes of invariant we write for lending protocols, with plausible values. Your set would be derived from your own contracts, and the thresholds argued for rather than assumed.
Paste a contract. Watch it get read.
Thirteen of the patterns we check by hand, running in your browser as you type. Nothing is uploaded. The code never leaves this tab. It catches the shapes below; it cannot catch what actually matters most, which is why a person still reads your code.
Press Escape before Tab to move focus out of the editor.
Idle
Open the full scanner: all 13 patterns documented
What this is. Thirteen pattern checks derived from our own review checklist: reentrancy ordering, tx.origin auth, unprotected selfdestruct and initialisers, block-derived randomness, unchecked call returns, spot-price oracles, signature replay, unsafe downcasts, pre-0.8 arithmetic, unbounded payout loops, exact balance checks and timestamp gating.
What this is not. It does not compile your code, follow data across functions, model economics, or understand intent. A clean result here means thirteen patterns did not match, nothing more. Every finding we have ever reported that mattered came from a person reading the code, not from this.
Free, but honestly scoped.
A snapshot is a real review of one contract, not a teaser and not a full audit. Here is exactly where the line sits, so nobody is surprised.
What you get
- One contract, up to 200 lines. Single file, one commit.
- Manual line-by-line review by a named auditor, not a scanner dump.
- Every issue we find at that depth, with severity, impact and a concrete fix.
- An honest list of what we didn’t check: the classes that need a paid audit.
- A reply within 72 hours, written by the person who read the code.
What it isn’t
- Not a full audit: one file can’t tell us how your system behaves as a whole.
- No cross-contract analysis: integration bugs need broader scope.
- No economic modelling of incentives, oracles or liquidation logic.
- No proof-of-concept exploits: those come with the paid tiers.
- Not a certificate: we won’t give you a badge for a landing page.
Published, because nobody else publishes theirs.
Fixed fee agreed before work starts. No hourly drift. Every paid tier includes one free re-review after your fixes land.
| Tier | Scope | Price |
|---|---|---|
Snapshot Real findings on one contract, in 72 hours |
1 contract · ≤200 LoC | Free72 hours |
Single contract Full manual review of one contract, all severities |
≤500 LoC | $400–7003–5 days |
Project audit Whole codebase, PoC exploits for high and above, re-review |
≤1,500 LoC | $1,500–2,5007–10 days |
Protocol audit Multi-contract, architecture, oracle and governance review |
1,500+ LoC | $4,000–6,0002–3 weeks |
Continuous Review on every commit, for teams shipping weekly |
Rolling scope | From $800/moRetainer |
Ranges reflect complexity, not negotiation. You get a fixed number before we start.
Full pricing detail and estimator →
Read how we think before you hire us.
We publish a worked explanation of every vulnerability class we look for: real code, real exploits, real fixes. It’s the closest thing to sitting in on a review.
SWC-107
SWC-105
SWC-101
SWC-104
SWC-115
SWC-112
Reentrancy
The contract sends value before updating its books, so the receiver calls back in and withdraws against a balance that has not moved.
Broken access control
A function that changes ownership or balances is reachable by anyone, because the modifier was never applied.
Integer overflow and underflow
Arithmetic wraps instead of reverting, so zero minus one becomes an enormous number and the guard is always true.
Unchecked call return value
A transfer fails and returns false rather than reverting, so the books are debited for value that never moved.
tx.origin authentication
Authorisation checks who signed the transaction, not who called it, so any contract the owner touches inherits their authority.
Unsafe delegatecall
Foreign code runs against your storage, so a write the logic contract thinks is its own overwrites the proxy implementation.
What we won’t audit, at any price.
Cheap audits attract people who want a logo rather than a review. Our name goes on every report, so we screen before we accept, and we publish the rules rather than applying them quietly.
Contracts with owner-drain functions
We won’t issue a report that implies otherwise.
“We launch tomorrow”
An audit compressed below its honest duration buys false confidence.
Badge shopping
We sell a report with findings in it, not a seal.
Audits, as a starting point.
We still run audits, they are simply no longer the headline. A review is the cheapest way to find out what your invariants should be.
Solidity · Fixed fee
Smart contract audit
Manual review of EVM contracts by a named auditor, with published pricing and a report you can hand to your community. Most usefully, it produces the list of things worth watching once the code is live.
Audit services Free · PublicThe detection library
Worked entries on the exploit classes we monitor for: what broke, the protocol mechanic behind it, and the invariant that would have caught it. This is the proof, and it is free to read.
Read the libraryFree monitoring assessment
Send a contract address. Get five invariants back.
We read the contract, work out what should always hold, and send five invariants worth monitoring plus one thing your current setup would miss. Three working days, and a person does the reading.
- Reply written by the person who read the contract
- No sales sequence, no drip campaign, no retargeting
- We will say if your existing setup is already adequate
- Deployed EVM contracts, lending and yield
Why it is free
The five invariants are the argument. If they are all obvious, you did not need us and now you know. If two of them had not occurred to you, that is worth more than anything this page could claim.
It also tells us whether your protocol is one we understand well enough to be useful on, which is the part most vendors skip before quoting.
Prefer to talk to a person first? Contact us.