Smart contract & dapp security auditsFind Vulnerabilities. Validate Exploits. Govern Security.
Security Wiz provides a unified security framework for smart contracts and protocols — combining automated vulnerability discovery, security orchestration, governance, and expert validation across the entire protocol lifecycle.
Four languages. ~90% of deployed smart contracts.
How an audit runs
Manual depth. Adversarial instinct.
01
Scope & threat model
We map your contracts, dependencies, and privileged roles, freeze a commit hash, and agree on what “safe” means for your protocol before reading a line.
02
Flatten the code
We flatten your contracts and their imports into a clean, linear source so a human reviewer can follow every call path without hopping between files.
03
SAST scan
Our SAST scanner sweeps the codebase for known vulnerability patterns. Its output is a set of leads, not findings, until a researcher confirms each one.
04
Manual review, tool-assisted
Line-by-line review by a senior researcher, backed by static analysis and fuzzing, covering the logic, math, and access control the scanner can’t reason about.
05
Fork & exploit (Fork tier)
We fork the network so your contracts run against real on-chain state, then write working exploits to prove each finding. Everything runs on the fork; nothing touches the live chain.
06
Fix verification & final report
We re-review your patches, confirm closure, and ship a final report you can publish to your community or share with shareholders.
The framework
Make security a cornerstone of your protocol.
Discover
Find vulnerabilities before attackers do.
AI-powered SAST, threat intelligence, exploit-chain analysis, and continuous vulnerability research.
Scanner output and manual review run side by side, and every lead is confirmed by a human before it becomes a finding. On the Fork tier, we prove each one with a working exploit against a fork of the live network.
Orchestrate
Turn findings into action.
Coordinate scans, audits, remediation, re-testing, and CI/CD security workflows.
Every finding arrives with a severity, an exploit scenario, and a concrete fix. We follow each one through remediation and re-review your patches, so nothing is marked closed until it’s verified.
Govern
Define what secure means for your protocol.
Policies, security standards, risk scoring, audit readiness, and continuous security posture.
Each audit starts from a framework built for your protocol type, with a threat model you sign off before testing. Findings are scored with OVSS, our open severity scale, and the audit ends in an A–F grade for the exact commit reviewed.
Validate
Prove your defenses actually work.
Senior security professionals validate findings and test real-world exploitability, with results clear to everyone from board members and the C-suite to app teams.
Every finding ships with a runnable proof-of-concept test, so your team can reproduce it and confirm the fix themselves. The report is written to be shared, from your engineers to your board and community.
One framework — four faces, built to secure every corner of your protocol.
Hover over the pillars to learn more
Drag the obelisk to spin it
What we audit
You wrote it to work. We read it to fail.
Smart contracts & protocols
We model how value moves through your protocol and attack every path it can take.
What that can look like
Worst case
An attacker manipulates a price or exploits a flaw in collateral accounting, borrows far more than they put in, and walks away. The protocol is left with bad debt it can’t cover, and depositors carry the loss.
Worst case
A flaw in swap math, pool accounting, or an unprotected callback lets an attacker drain liquidity pools in a single transaction, often with flash-loaned capital. Liquidity providers are left with empty pools.
Worst case
Forged or replayed cross-chain messages mint or release assets that were never locked on the other side. The bridged tokens become unbacked, and everyone holding them is exposed.
Worst case
A minting, collateral, or oracle flaw breaks the peg. Once confidence goes, holders rush to redeem, and the token may never recover its value.
Worst case
A reward-accounting or share-price bug lets an attacker claim funds they never earned or lock everyone else’s deposits, and a bad strategy integration can put the whole pool at risk.
Worst case
Voting power is borrowed or timed around snapshots to pass a malicious proposal, which then drains the treasury or hands control of the protocol to the attacker.
Worst case
An unprotected upgrade path or a compromised admin key lets an attacker swap in malicious code, taking over a protocol that otherwise looked secure.
Dapps & tools
A dapp is a web application with a wallet in the middle — and plenty of protocol losses never touch a Solidity bug. We attack the full stack the way an adversary would: the classic web attack surface, plus everything crypto layers on top of it.
What that can look like
Worst case
Even a simple dapp can fall to a supply chain attack. A compromised dependency, third-party script, or hosting account swaps in malicious code. Users see a normal site while their wallet prompts approve transfers to the attacker, and no smart contract bug is needed.
Worst case
A signing flow that shows one thing and signs another, or an approval request users can’t read, hands an attacker unlimited access to a user’s assets.
Worst case
A signature-replay or listing flaw lets attackers buy at the wrong price or move NFTs without the owner’s consent, and a mint bug can drain an entire drop.
Worst case
An exposed key, an injectable API, or a hijacked keeper bot triggers transactions the protocol never meant to authorize, or leaks the data an attacker needs for the next step.
Worst case
A broken claim or allowlist check lets one address claim over and over, or lets bots drain the pool meant for real users.
Worst case
A stolen deployer key or a compromised CI pipeline gives an attacker the same power as your team: deploying, upgrading, or withdrawing at will.
What we hunt
The exploit classes that empty protocols.
Web3 has its own kill chain. Every review tests your codebase against the OWASP Smart Contract Top 10, then goes further: because we fork the chain, we can attack your protocol with real on-chain state.
2024
2025
2026 · so far
Sometimes you have to go the extra mile to not become another statistic.
Industry figures, not our numbers. We cite them because they’re why this job exists.
Functions that move funds or change critical state can be called by the wrong party because permission checks are missing, misplaced, or bypassable.
The code does exactly what it says, but what it says is wrong: broken invariants, gaps in the state machine, or economic assumptions an attacker can abuse.
Protocols that trust a manipulable price source, like a spot pool or a stale feed, can be tricked into mispricing collateral, swaps, or liquidations.
Capital borrowed for a single transaction lets an attacker amplify small flaws, such as price skew or share inflation, into protocol-draining attacks.
Parameters, addresses, and calldata accepted without checks let attackers pass values the code never anticipated.
Ignoring return values or trusting how another contract behaves lets failed or malicious calls silently corrupt state.
Rounding direction and precision loss, repeated across many operations, can be farmed to leak value or break a protocol’s accounting.
An external call lets the callee re-enter before state is updated, repeating a withdrawal or exploiting stale state across functions.
Arithmetic that wraps, in unchecked blocks, older compilers, or unsafe casts, produces wildly wrong balances or limits.
Uninitialized implementations, storage layout collisions, and unprotected upgrade paths let attackers take over or corrupt upgradeable contracts.
We run your contracts against the real protocols they integrate with, on forked state, to find assumptions that break when a dependency behaves unexpectedly.
Forged or replayed cross-chain messages can mint or release assets that were never locked on the other side.
Signed messages reused across chains, contracts, or time, and approvals tricked out of users, move funds without ever breaking the contract code.
Transactions visible in the public mempool can be sandwiched or front-run, extracting value from users or breaking the protocol’s assumptions.
Voting power borrowed or timed around snapshots can pass malicious proposals or drain a treasury.
Contact
Get audited before you deploy.
Tell us what you’re shipping. We’ll come back within 24 hours with scoping questions, a timeline, and a fixed quote.
Every audit is performed personally by a senior researcher, so we take a limited number of engagements at a time. Book before your code freeze, not after.
Within 24 hours