HOW WE AUDIT

Beyond the checklist: fuzzers and proofs built for your code

Different systems call for different techniques. We’ve built our own fuzzers and verification tooling, and we pick the mix that fits yours.

$36.82B+On-chain TVL secured

120+Projects audited

Public audits Request a quote

Trusted by teams building the next generation of crypto

Formally verified the Aptos stdlibMaintainers of AnchorPublic audit reports

WHY OTTERSEC

Why technique matters

A final report with every finding and suggestions for fixes.
A quote built on expected duration, potential vulnerabilities and complexity.
An MNDA in place before we look at any repository in scope.
A team that stays close after the report ships and supports your community.
The mix of manual review, fuzzing and formal verification your system calls for.

HOW WE AUDIT

The process

01

Initial discussion

We discuss your goals, timeline and security needs to see whether we’re a fit.
02

Info gathering

We send an MNDA and look at the repositories in scope to understand the details of your project.
03

Quote

We deliver a quote based on expected duration, potential vulnerabilities and the overall complexity of your project.
04

Kickoff

The audit begins. We share findings as they emerge and ask questions as needed.
05

Report delivery

At completion you get a report with our findings and suggestions for fixes.

Start the conversation

FAQ

About our methods

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Can we read past audits?

Yes. Every public security review from the OtterSec team is listed at osec.io/audits.

What happens after the report?

We’re not done when your report ships. We stay close with our clients, support their communities and build long-term relationships around stronger security.

WHAT WE AUDIT

Our techniques

Fuzzing is one of our core disciplines. Formal verification and pentesting sit right next to it.

Formal verification

Our own tooling and a novel verification framework for Solana. We also worked with the Aptos core team to formally verify their standard library.

Fuzzing

A core discipline: differential compiler fuzzers for Vyper, transactional fuzzers for Solana validators, rBPF JIT fuzzers and Move VM bytecode fuzzers.

Pentesting

White-box and black-box testing based on each project’s needs, aimed at the large, underexplored Web2 attack surfaces that remain in many Web3 applications.

GET AN AUDIT

Get the techniques your system actually needs

Start with a conversation about your goals and security needs. We’ll scope the right mix.

Start the conversation