Smart Contract Audit

A manual security review of the code that moves value.

Authority Assurance for smart contract code. EVM (Solidity) and Solana (Rust/Anchor) protocol reviews by researchers, focused on invariants, state transitions, value-flow correctness, authorization boundaries, and proxy topology. Findings come with severity, exploit scenarios, and fixes.

Request an AuditSee governance analysis

In-depth · Manual review

The problem

The expensive bugs aren’t syntax errors.

By the time code reaches mainnet it compiles and passes tests. The failures that drain a protocol live in the assumptions, the invariant that quietly breaks, the rounding that accrues, the path no test exercised.

Accounting and invariant assumptions that hold in tests but break under adversarial input.
Authorization boundaries that leak: roles, owners, and guardians with more reach than intended.
Integration surfaces (oracles, AMMs, bridges, hooks) that behave unexpectedly under composition.
Storage-layout and proxy-upgrade mistakes that corrupt state on the next implementation swap.
Solana-specific pitfalls: missing PDA validation, unchecked CPIs, and account-confusion attacks.

Scope

What we review

A full audit covers the contract logic and everything that determines whether it behaves correctly under adversarial conditions.

Protocol invariants
The accounting and economic constraints that must always hold, tested against adversarial input.
State transitions
Every path that mutates state, including the ones normal tests never exercise.
Value-flow correctness
Where funds move, and whether value is conserved across every operation.
Authorization boundaries
Roles, owners, and guardians, who can call what, and whether those checks hold.
Integration surfaces
Oracles, AMMs, bridges, and hooks as sources of unexpected or manipulable behavior.
Storage & proxy topology
Storage-layout safety and the upgrade topology behind every implementation.
PDA validation & CPI safety
Solana account validation, signer checks, and cross-program-invocation safety.
Edge-case execution
Zero amounts, empty sets, boundary values, and unusual token behavior (fee-on-transfer, rebasing).

Methodology

How a review works

A structured engagement with a fixed scope, clear checkpoints, and post-fix verification, the same process behind every Themis audit.

01
Scoping
Architecture review, invariant identification, and threat surface analysis. Quote within 48 hours.
02
Kickoff
Repository access, documentation review, communication setup, and priority alignment.
03
Review
Manual analysis, static-analysis tooling, and fuzz testing across the defined scope.
04
Draft Report
Preliminary findings delivered to your team for internal review and triage.
05
Remediation
Support during the fix phase: clarifications, patch guidance, and re-analysis.
06
Final Report
Post-fix verification. Delivered publicly or privately per disclosure agreement.

Deliverables

Deliverables

Professional audit report
A written report covering the full scope, suitable for internal review and external stakeholders.
Findings with severity
Every issue rated by severity, with the impact and the conditions that trigger it.
Exploit scenarios
Concrete, reproducible scenarios showing how each finding is reached and what it yields.
Remediation & re-verification
Specific fixes, support through the patch phase, and verification that they hold.

Reports can be published with your consent or kept private per the disclosure agreement. Private findings stay confidential.

Why Themis

Why Themis

Researchers, not a scanner
Findings come from manual analysis by security researchers with peer-reviewed academic and Web3 audit experience.
Control-plane depth
We go beyond the code to the authority around it, who can change the contract, and how fast.
EVM and Solana
Solidity and Rust/Anchor coverage, including the account and CPI model unique to Solana.
One philosophy, two domains
The same discipline we apply to AI agents: analyze capability, authority, and adversarial behavior.

FAQ

Questions we get asked

What do you need to start?

A code repository (or verified on-chain addresses), documentation or a spec, and a point of contact. We scope from there and return a quote within 48 hours.

How long does an audit take?

It depends on scope and complexity, most engagements run one to several weeks. We agree a fixed timeline during scoping.

Do you cover Solana as well as EVM?

Yes. We review Solidity on EVM chains and Rust/Anchor on Solana, including PDA validation and CPI safety.

Will the report be public?

Your choice. Reports are delivered privately by default and published only with your written consent.

Do you help with fixes?

Yes, we support your team through remediation and re-verify the fixes before the final report.

Shipping code that moves value?

Share your repository and protocol overview. We’ll scope a security audit and return a quote within 48 hours.

Request an AuditExplore Web3 Security