Smart contract & dapp security auditsFind Vulnerabilities. Validate Exploits. Govern Security.
Security Wiz provides a unified security framework for smart contracts and protocols — combining automated vulnerability discovery, security orchestration, governance, and expert validation across the entire protocol lifecycle.
Four languages. ~90% of deployed smart contracts.
What we audit
You wrote it to work. We read it to fail.
SC01 · Smart Contract & Protocol Audits
Your code is a vault.Have confidence in its security.
Manual review of your contracts before deployment — logic, math, access control, and the assumptions between them. We model how value moves through your protocol and attack every path it can take.
- Solidity, Rust (Anchor / CosmWasm), Move, and Go
- Business-logic & economic attack analysis
- Reentrancy, access control, oracle & price manipulation
- Upgradeability, admin keys & privileged-role review
- Live testing on a local or forked network
SC02 · Dapp Security Reviews
Your dapp is the bridge between web2 and web3.Ensure your customers have safe passage.
A dapp is a web application with a wallet in the middle — and plenty of protocol losses never touch a Solidity bug. We attack the full stack the way an adversary would: the classic web attack surface, plus everything crypto layers on top of it.
- Web2 classes: authentication, session & access flaws, injection, XSS
- Wallet-interaction flows — signing, approvals, transaction integrity
- APIs & off-chain services: bots, keepers, indexers
- Infrastructure, key management & deployment-pipeline review
The framework
Discover. Orchestrate. Govern. Validate.
Discover
Find vulnerabilities before attackers do.
AI-powered SAST, threat intelligence, exploit-chain analysis, and continuous vulnerability research.
Scanner output and manual review run side by side, and every lead is confirmed by a human before it becomes a finding. On the Fork tier, we prove each one with a working exploit against a fork of the live network.
Orchestrate
Turn findings into action.
Coordinate scans, audits, remediation, re-testing, and CI/CD security workflows.
Every finding arrives with a severity, an exploit scenario, and a concrete fix. We follow each one through remediation and re-review your patches, so nothing is marked closed until it’s verified.
Govern
Define what secure means for your protocol.
Policies, security standards, risk scoring, audit readiness, and continuous security posture.
Each audit starts from a framework built for your protocol type, with a threat model you sign off before testing. Findings are scored with OVSS, our open severity scale, and the audit ends in an A–F grade for the exact commit reviewed.
Validate
Prove your defenses actually work.
Senior security professionals validate findings and test real-world exploitability, with results clear to everyone from board members and the C-suite to app teams.
Every finding ships with a runnable proof-of-concept test, so your team can reproduce it and confirm the fix themselves. The report is written to be shared, from your engineers to your board and community.
One framework — four faces, built to secure every corner of your protocol.
How an audit runs
Manual depth. Adversarial instinct.
01
Scope & threat model
We map your contracts, dependencies, and privileged roles, freeze a commit hash, and agree on what “safe” means for your protocol before reading a line.
02
Flatten the code
We flatten your contracts and their imports into a clean, linear source so a human reviewer can follow every call path without hopping between files.
03
SAST scan
Our SAST scanner sweeps the codebase for known vulnerability patterns. Its output is a set of leads, not findings, until a researcher confirms each one.
04
Manual review, tool-assisted
Line-by-line review by a senior researcher, backed by static analysis and fuzzing, covering the logic, math, and access control the scanner can’t reason about.
05
Fork & exploit (Fork tier)
We fork the network so your contracts run against real on-chain state, then write working exploits to prove each finding. Everything runs on the fork; nothing touches the live chain.
06
Fix verification & final report
We re-review your patches, confirm closure, and ship a final report you can publish to your community or share with shareholders.
What you get
Security that moves with your code.
An audit that ends in a PDF can only give you a point-in-time snapshot of your security posture. Security Wiz is built to shift left and stay involved through every phase of the SDLC, not just the last one.
Security from the first commit
We shift left: threat modeling, design review, and testing start while the code is still being written, not the week before launch.
Scans that keep running
Repeat scans through development, pre-deploy, and every upgrade, so issues surface when they’re cheapest to fix instead of once at the end.
A framework that gets sharper
Your threat model, checklist, and test plan carry forward, and every confirmed finding a scanner missed becomes a new rule or test, so every cycle catches more than the last.
Findings and reports you can act on
Severity-ranked findings with the path an attacker would take, one round of fix re-review included, and a report clean enough to publish.
What we hunt
The exploit classes that empty protocols.
Web3 has its own kill chain. Every review tests your codebase against the OWASP Smart Contract Top 10, then goes further: because we fork the chain, we can attack your protocol with real on-chain state.
Industry figures, not our numbers. We cite them because they’re why this job exists.
Functions that move funds or change critical state can be called by the wrong party because permission checks are missing, misplaced, or bypassable.
The code does exactly what it says, but what it says is wrong: broken invariants, gaps in the state machine, or economic assumptions an attacker can abuse.
Protocols that trust a manipulable price source, like a spot pool or a stale feed, can be tricked into mispricing collateral, swaps, or liquidations.
Capital borrowed for a single transaction lets an attacker amplify small flaws, such as price skew or share inflation, into protocol-draining attacks.
Parameters, addresses, and calldata accepted without checks let attackers pass values the code never anticipated.
Ignoring return values or trusting how another contract behaves lets failed or malicious calls silently corrupt state.
Rounding direction and precision loss, repeated across many operations, can be farmed to leak value or break a protocol’s accounting.
An external call lets the callee re-enter before state is updated, repeating a withdrawal or exploiting stale state across functions.
Arithmetic that wraps, in unchecked blocks, older compilers, or unsafe casts, produces wildly wrong balances or limits.
Uninitialized implementations, storage layout collisions, and unprotected upgrade paths let attackers take over or corrupt upgradeable contracts.
We run your contracts against the real protocols they integrate with, on forked state, to find assumptions that break when a dependency behaves unexpectedly.
Forged or replayed cross-chain messages can mint or release assets that were never locked on the other side.
Signed messages reused across chains, contracts, or time, and approvals tricked out of users, move funds without ever breaking the contract code.
Transactions visible in the public mempool can be sandwiched or front-run, extracting value from users or breaking the protocol’s assumptions.
Voting power borrowed or timed around snapshots can pass malicious proposals or drain a treasury.
Questions
Before you ask.
The short answers. Anything else, the form below reaches a senior researcher directly.
Read the full FAQ →What does a smart contract audit include?
Line-by-line manual review of your contracts by a senior researcher, backed by static analysis and fuzzing. The Fork tier adds testing on a fork of the live network, where we write working exploits against real on-chain state. Every finding ships with a severity, an exploit scenario, and a concrete fix — and one round of fix re-review is included. And it doesn’t have to end there: Security Wiz is built to stay involved across the whole development lifecycle, with scans you can repeat as your code changes.
How much does a smart contract audit cost?
Pricing is a fixed quote based on the size and complexity of your codebase — not an hourly meter. Send us your repo and we’ll return a quote within 24 hours, before any commitment.
How long does an audit take?
Depends on scope. A single contract can be days; a full protocol is typically measured in weeks. You’ll get a firm timeline with your quote, and we recommend booking before your code freeze so findings can be fixed before deployment.
Which languages and chains do you cover?
Solidity for Ethereum and EVM chains, Rust for Solana (Anchor) and CosmWasm, Move for Aptos and Sui, and Go for Cosmos-SDK chains and infrastructure — the languages behind roughly 90% of deployed smart contracts.
What’s the difference between a smart contract audit and a dapp security review?
The audit covers your on-chain code. The dapp review covers everything around it — frontend, wallet flows, signing, APIs, off-chain services, and infrastructure, including the traditional web vulnerability classes. Most teams need both; we scope them together or separately.
Who actually reads our code?
A senior security researcher with 8+ years of penetration testing against Fortune 500 companies — every audit is performed personally by the founder, with no junior pass-through or outsourced review.
Can we publish the report?
Yes. The final report is written to be publishable — to your community, investors, or shareholders. Whether it goes public is your call.
Contact
Get audited before you deploy.
Tell us what you’re shipping. We’ll come back within 24 hours with scoping questions, a timeline, and a fixed quote.
Every audit is performed personally by a senior researcher, so we take a limited number of engagements at a time. Book before your code freeze, not after.
Within 24 hours