Smart contract audits
Protocol code reviewed across Solana, EVM, Sui, Aptos, Cosmos, NEAR, Stellar and more, from Layer 1 foundations to the apps built on them.
BEFORE MAINNET
Clear findings before your users find them
We keep the work focused and the communication clear, from the first scoping call to the final report.
$36.82B+On-chain TVL secured
120+Projects audited
Trusted by teams building the next generation of crypto
Public audit reportsAudited Solana core codeSecuring Sui since pre-mainnet
WHY OTTERSEC
A launch-ready audit
- A quote built on expected duration, potential vulnerabilities and complexity.
- Help during an active exploit through Seal 911 and the $1 post-hack audit.
- Findings shared as they emerge, not held back for the final report.
- An MNDA in place before we look at any repository in scope.
WHAT WE AUDIT
What the audit covers
Different systems call for different techniques. We pick the mix that fits yours.
Pentesting
White-box and black-box testing based on each project’s needs, aimed at the large, underexplored Web2 attack surfaces that remain in many Web3 applications.
Fuzzing
A core discipline: differential compiler fuzzers for Vyper, transactional fuzzers for Solana validators, rBPF JIT fuzzers and Move VM bytecode fuzzers.
Public audit reports
Every public security review from the OtterSec team is published at osec.io/audits, with findings broken down by severity.
FAQ
Before you book
How does an audit start?
With an initial discussion of your goals, timeline and security needs to see whether we’re a fit. We then send an MNDA and review the repositories in scope.
How is the price worked out?
We quote from the expected duration, the potential vulnerabilities and the overall complexity of your project.
Do we wait for the final report to see findings?
No. After kickoff we share findings as they emerge and ask questions as needed. The final report collects our findings and suggestions for fixes.
Can we read past audits?
Yes. Every public security review from the OtterSec team is listed at osec.io/audits.
What if we are mid-incident?
As members of Seal 911 we join war rooms and work incidents even when the affected parties aren’t our clients. Teams shouldn’t have to make even more hard decisions during an active exploit, so our $1 post-hack audit lets us help when they need it most.
CLIENTS
Teams that shipped with us
“Working with OtterSec on critical audits has been a great experience. It’s clear OtterSec cares deeply about customer satisfaction and the security of our protocols. Their communication and flexibility was refreshing.”
“Having OtterSec as a security partner has been a fantastic experience for us. They are diligent, fast, creative and very responsive. Basically everything one could ask from a security audit firm.”
“Their website says protecting Blockchain ideas, but their command of JavaScript is impressive. If you've got something that you think would be "too hard for pentesters to understand" - these folks will surprise you. They're not your average pentester.”
LAUNCHING SOON
Book the audit before you book the launch
Tell us your timeline and security needs. We’ll see whether we’re a fit and send a quote.
Get secured now