Smart contract & dapp security auditsFind Vulnerabilities. Validate Exploits. Govern Security.
Security Wiz provides a unified security framework for smart contracts and protocols — combining automated vulnerability discovery, security orchestration, governance, and expert validation across the entire protocol lifecycle.
Four languages. ~90% of deployed smart contracts.
What we audit
You wrote it to work. We read it to fail.
SC01 · Smart Contract & Protocol Audits
Your code is a vault.Have confidence in its security.
Manual review of your contracts before deployment — logic, math, access control, and the assumptions between them. We model how value moves through your protocol and attack every path it can take.
- Solidity, Rust (Anchor / CosmWasm), Move, and Go
- Business-logic & economic attack analysis
- Reentrancy, access control, oracle & price manipulation
- Upgradeability, admin keys & privileged-role review
- Live testing on a local or forked network
SC02 · Dapp Security Reviews
Your dapp is the bridge between web2 and web3.Ensure your customers have safe passage.
A dapp is a web application with a wallet in the middle — and plenty of protocol losses never touch a Solidity bug. We attack the full stack the way an adversary would: the classic web attack surface, plus everything crypto layers on top of it.
- Web2 classes: authentication, session & access flaws, injection, XSS
- Wallet-interaction flows — signing, approvals, transaction integrity
- APIs & off-chain services: bots, keepers, indexers
- Infrastructure, key management & deployment-pipeline review
The framework
Discover. Orchestrate. Govern. Validate.
Discover
Find vulnerabilities before attackers do.
AI-powered SAST, threat intelligence, exploit-chain analysis, and continuous vulnerability research.
Scanner output and manual review run side by side, and every lead is confirmed by a human before it becomes a finding. On the Fork tier, we prove each one with a working exploit against a fork of the live network.
Orchestrate
Turn findings into action.
Coordinate scans, audits, remediation, re-testing, and CI/CD security workflows.
Every finding arrives with a severity, an exploit scenario, and a concrete fix. We follow each one through remediation and re-review your patches, so nothing is marked closed until it’s verified.
Govern
Define what secure means for your protocol.
Policies, security standards, risk scoring, audit readiness, and continuous security posture.
Each audit starts from a framework built for your protocol type, with a threat model you sign off before testing. Findings are scored with OVSS, our open severity scale, and the audit ends in an A–F grade for the exact commit reviewed.
Validate
Prove your defenses actually work.
Senior security professionals validate findings and test real-world exploitability, with results clear to everyone from board members and the C-suite to app teams.
Every finding ships with a runnable proof-of-concept test, so your team can reproduce it and confirm the fix themselves. The report is written to be shared, from your engineers to your board and community.
One framework, four faces. Hover the obelisk to read it as it turns, or a pillar below to bring that face into focus.
How an audit runs
Manual depth. Adversarial instinct.
01
Scope & threat model
We map your contracts, dependencies, and privileged roles, freeze a commit hash, and agree on what “safe” means for your protocol before reading a line.
02
Flatten the code
We flatten your contracts and their imports into a clean, linear source so a human reviewer can follow every call path without hopping between files.
03
SAST scan
Our SAST scanner sweeps the codebase for known vulnerability patterns. Its output is a set of leads, not findings, until a researcher confirms each one.
04
Manual review, tool-assisted
Line-by-line review by a senior researcher, backed by static analysis and fuzzing, covering the logic, math, and access control the scanner can’t reason about.
05
Fork & exploit (Fork tier)
We fork the network so your contracts run against real on-chain state, then write working exploits to prove each finding. Everything runs on the fork; nothing touches the live chain.
06
Fix verification & final report
We re-review your patches, confirm closure, and ship a final report you can publish to your community or share with shareholders.
What you get
A report you can ship with.
An audit that ends in a PDF nobody can act on is an expense. Ours ends in verified fixes and a document written for everyone who asks “is it safe?” — your engineers, your community, your investors.
Severity-ranked findings
Critical to informational, each with impact, likelihood, and the path an attacker would actually take.
Fix re-review, included
One round of patch verification is part of every audit. It’s not an upsell.
A publishable final report
Clean enough to post next to your launch announcement, honest enough to survive scrutiny.
Direct access to the researcher
The person you talk to is the person who read your code — during the audit and after it.
What we hunt
The exploit classes that empty protocols.
Web3 has its own kill chain. Every review tests your codebase against the OWASP Smart Contract Top 10, then goes further: because we fork the chain, we can attack your protocol with real on-chain state.
Industry figures, not our numbers. We cite them because they’re why this job exists.
Functions that move funds or change critical state can be called by the wrong party because permission checks are missing, misplaced, or bypassable.
The code does exactly what it says, but what it says is wrong: broken invariants, gaps in the state machine, or economic assumptions an attacker can abuse.
Protocols that trust a manipulable price source, like a spot pool or a stale feed, can be tricked into mispricing collateral, swaps, or liquidations.
Capital borrowed for a single transaction lets an attacker amplify small flaws, such as price skew or share inflation, into protocol-draining attacks.
Parameters, addresses, and calldata accepted without checks let attackers pass values the code never anticipated.
Ignoring return values or trusting how another contract behaves lets failed or malicious calls silently corrupt state.
Rounding direction and precision loss, repeated across many operations, can be farmed to leak value or break a protocol’s accounting.
An external call lets the callee re-enter before state is updated, repeating a withdrawal or exploiting stale state across functions.
Arithmetic that wraps, in unchecked blocks, older compilers, or unsafe casts, produces wildly wrong balances or limits.
Uninitialized implementations, storage layout collisions, and unprotected upgrade paths let attackers take over or corrupt upgradeable contracts.
We run your contracts against the real protocols they integrate with, on forked state, to find assumptions that break when a dependency behaves unexpectedly.
Forged or replayed cross-chain messages can mint or release assets that were never locked on the other side.
Signed messages reused across chains, contracts, or time, and approvals tricked out of users, move funds without ever breaking the contract code.
Transactions visible in the public mempool can be sandwiched or front-run, extracting value from users or breaking the protocol’s assumptions.
Voting power borrowed or timed around snapshots can pass malicious proposals or drain a treasury.
Questions
Before you ask.
The short answers. Anything else, the form below reaches a senior researcher directly.
Read the full FAQ →What does a smart contract audit include?
Line-by-line manual review of your contracts by a senior researcher, backed by static analysis and fuzzing. The Fork tier adds testing on a fork of the live network, where we write working exploits against real on-chain state. Every finding ships with a severity, an exploit scenario, and a concrete fix — and one round of fix re-review is included.
How much does a smart contract audit cost?
Pricing is a fixed quote based on the size and complexity of your codebase — not an hourly meter. Send us your repo and we’ll return a quote within 24 hours, before any commitment.
How long does an audit take?
Depends on scope. A single contract can be days; a full protocol is typically measured in weeks. You’ll get a firm timeline with your quote, and we recommend booking before your code freeze so findings can be fixed before deployment.
Which languages and chains do you cover?
Solidity for Ethereum and EVM chains, Rust for Solana (Anchor) and CosmWasm, Move for Aptos and Sui, and Go for Cosmos-SDK chains and infrastructure — the languages behind roughly 90% of deployed smart contracts.
What’s the difference between a smart contract audit and a dapp security review?
The audit covers your on-chain code. The dapp review covers everything around it — frontend, wallet flows, signing, APIs, off-chain services, and infrastructure, including the traditional web vulnerability classes. Most teams need both; we scope them together or separately.
Who actually reads our code?
A senior security researcher with 8+ years of penetration testing against Fortune 500 companies — every audit is performed personally by the founder, with no junior pass-through or outsourced review.
Can we publish the report?
Yes. The final report is written to be publishable — to your community, investors, or shareholders. Whether it goes public is your call.
Contact
Get audited before you deploy.
Tell us what you’re shipping. We’ll come back within 24 hours with scoping questions, a timeline, and a fixed quote.
Every audit is performed personally by a senior researcher, so we take a limited number of engagements at a time. Book before your code freeze, not after.
Within 24 hours