Securing the decentralized trustless future
At Oak Security, we offer security auditing and cyber security advisory services with a special focus on third-generation blockchains such as the Cosmos SDK and CosmWasm, Polkadot and Substrate, Solana, NEAR, and Flow (Cadence) ecosystems. We also serve Ethereum and EVM-compatible ecosystems through our brand Solidified.
Get a quote
"The team of @SecurityOak are unsung heros in the @CosmWasm ecosystem. Dedication, expertise and humbleness makes it pure joy working with them. The value they add by strengthening the framework behind the scenes makes them a SAFU gem for all of us."
Co-Founder and Managing Director, Confio GmbH
“We've worked with Oak Security on a number of occasions, for both CosmWasm smart contracts and Cosmos SDK blockchain codebases. They've been one of the most reliable and thorough firms we’ve gotten to work with and we frequently recommend Oak Security to our partners.”
Co-Founder and CEO, Hadron Labs, Contributor at Neutron
"Stargaze has worked with Oak Security on several audits. Oak is one of the few teams that understand CosmWasm in and out. They were able to discover issues in our contracts that evaded our most senior engineers. We always feel a lot more confident with our code after an Oak audit. They are also always available and respond to questions in a timely fashion."
Co-founder, Stargaze
Our stats speak volumes
Supported technologies
How we can support you
Our services cover all aspects of your software lifecycle, from early planning, secure design, economic consulting, secure development processes, in-depth protocol reviews, secure use of cryptography and smart contract audits to on-going operational security.
review & design
Securing the digital frontier
"At Filecoin, we engaged Oak Security for a 6-week security audit of our Ethereum Virtual Machine (EVM) implementation. During this engagement, their diligent team showed a deep understanding of the intricate details of the EVM, such as differences in the opcode implementation and gas accounting. Their expertise in the field is evident, and we highly recommend Oak Security for any organization seeking best-in-class cybersecurity solutions."
TPM Lead for FVM (Filecoin), Protocol Labs
“We were deeply impressed by the thoroughness of Oak Security's audit of Snowbridge, our light-client-based bridge between Ethereum and Polkadot. They created a comprehensive threat model and uncovered several critical vulnerabilities during the audit. We are extremely satisfied with Oak Security's professional approach and recommend them wholeheartedly for their exceptional blockchain security expertise.”
Founder, Snowfork
"Oak Security conducted an audit for us at Nym, examining over 500 lines of our mathematically complex CosmWasm mixnet reward contract. Refer to "Reward Sharing for Mixnets" to get an impression of the contract's complexity. Oak Security identified bugs that had been overlooked by a less talented security auditor. With the help of Oak Security, we have successfully remedied these bugs."
CEO, Nym
Rigorous & collaborative audit approach
Our process is designed to be thorough, diverse, and mixed. We employ a variety of techniques and perspectives to give you a 360 degree review of your project to maximize coverage and depth.
Each audit is done by 3+ auditors, who are chosen for their expertise in your industry. Cryptography projects will have a cryptography expert on the team, DeFi projects will have an economist on the team.
Your auditors will work independently to conduct an in-depth assessment of your code and project, utilizing static and manual code reviews, as well as approved testing and modeling methods.
The auditors will reveal their findings in a Consensus meeting, collaborate on open leads and put together the final report which will be shared with you.
"The Oak Security team has been extremely helpful in streamlining the whole audit process for our grants projects and reducing their time to market on Osmosis. We’ve also received positive feedback from our grantees as they’ve told us Oak Security has been a pleasure to work with."
Steward of the Osmosis Grants Program, Reverie
"Oak's unique approach to auditing has helped secure Stride's liquid staking design, custom SDK modules and CosmWasm contracts. Oak emulates potential adversaries by red teaming, pitting auditors against each other in an incentivized competition to uncover vulnerabilities. The team is professional, experienced and a pleasure to work with."
Co-Founder, Stride Labs
Our team spans the whole globe
Calling on a team of 52+ expert auditors including Master’s and PhD holders, economists, cryptography experts, and experienced computer scientists, we are able to tailor our audits to provide you with the support you need.
Management team
Oak Security is the result of two domain experts in Computer Science and Economics getting together after years of collaborating to build a unique team to secure the new decentralized finance systems.
Dr. Stefan Beyer
Managing Director
Ph.D. in Computer Science
Has worked on Distributed Systems since 2004 (Pre-Bitcoin)
Blockchain security audits since 2018
More than 50 projects audited
Philip Stanislaus
Managing Director
MPhil Economics, Cambridge (UK)
Software engineer since 2007
Blockchain architect and developer since 2018
Web3 Experience: Dapper Labs/Flow, Polkadot/Web3 Foundation, Centrifuge
"We’ve worked with the Oak team extensively while launching and upgrading Noble. They have caught some subtle issues and have been a great partner in helping us ship quality secure products. We love working with the team too and have been recommending them to folks looking!
Founder and CEO, Strangelove
"If more projects had auditors like Oak Security, the industry would be in a substantially better place. I can't overstate how much myself, Maciej and the whole team appreciate their incredible input. Once again, amazing work!"
CSO, t3rn
Request a quote
During our audits, we employ several measures to maximize the likelihood of finding critical issues in the codebase and provide as much security as possible. Despite these efforts, there is always a possibility that we miss issues. Security audits should only be considered to be one component of your overall security strategy. A security review is no substitute for other best practices and should be accompanied by a security-focused design process, extensive unit, integration, and end-to-end testing, internal code reviews, bug bounties, secure development and development processes, as well as strictly followed operational security processes.
Whilst we would like to promise you a 100% hit rate, we believe no security company can make this claim.
It depends – we estimate the cost of each audit individually and provide a quote based on a number of factors, including the size of the codebase, its complexity, novelty, and the cost of the specialized team required for the specific project. Contact us here to request a quote, we will get back to you within one business day.
Oak Security uses a unique auditing process, based on blinded, independent reviews using a mix of methodologies. We staff at least 3 auditors on every audit, who work independently during the first phase of the project, initially not sharing their results. Each of the auditors follows their own methodology within our framework. This blinded approach has the advantage that auditors do not bias each other, whilst ensuring a wider breadth of techniques being applied. It also allows us to monitor the contributions of our auditors, which can be used to ensure high and consistent quality across projects.
After this initial phase, the auditors will share their findings in a consensus meeting and produce a report which lists issues encountered together with recommendations. The final version of our report is transparently published to our GitHub repository (https://github.com/oak-security/audit-reports/).
The selection of auditors for each project is performed in a unique manner. We assign at least 3 auditors with a background depending on a project's nature. For instance, a DeFi protocol with an economic model will have an auditor with a strong background in economics, and a ZK-rollup processor will have a cryptographer on the team. While all auditors are required to manually review all the code in the scope of the audit, we allow each auditor to add their own set of techniques. This may include economic modeling, if appropriate, writing tests for edge cases not covered by the included tests, and fuzz testing for parts of the system that are susceptible to different behavior under a large number of parameter combinations. We believe this freedom in methodologies leads to the best results, since auditors compete internally to find critical issues, and will choose the best tools to help them during this process.
The timeline for each audit depends on the complexity of the project and will be provided with our initial quote on a case-by-case basis. Audits may take anything from 0.5 weeks for simple projects to 12 weeks for very complex projects. In most cases, the duration is between 1 and 2 weeks.
In addition to the duration of the audit itself, you should account for time to apply our recommendations. The verification of fixes for the issues is included in our audits. Our auditors remain available for 3 weeks after the initial report has been delivered for this process.
We recommend reaching out as early as possible to avoid delays in case of longer lead times. We do not require a codebase that is ready for the audit when we create a quote.
As long as we receive a work-progress version together with a description of the functionality to be added, we can create an estimate of the effort and budget required. We also offer blanket reservations to clients who do not have a finalized codebase that will be refined closer to the audit start date.
Can't find the answer here?
Drop us a message
