Multi-expert security audits

Multi-expert security audits

Multi-expert security audits

The gold standard in Web3 auditing

a person relaxing illustration
a person relaxing illustration
a person relaxing illustration

We audit all components of Web3.

Our clients typically come back, multiple times, and rate us 9+ out of 10 on average.

We earned our reputation for rigor with our signature ‘blinded’ auditing process  - every line of code is independently reviewed by multiple auditors in parallel.

Since 2017, we have been trusted by the best for over 600 audits. 

How do we find more issues than others?

When engaged alongside other companies, we typically outperform them. We attribute this to our 'blinded' approach and to the caliber of our auditors.

Here is how our process works:

1

1

1

Each audit is done by multiple auditors, with relevant expertise for your project.

We emphasize redundancy, and you can choose the level of redundancy you want.

2

2

2

Initially, the auditors will work independently as if they will compile the audit report by themselves.

They use a wide range of tools and techniques.

3

3

3

The auditors only reveal their findings in the "consensus meeting".

It is followed by a collaborative phase before they compile your final audit report.

Learn how the process improves the industry and auditors

icon

Our process emphasizes redundancy and incentives.

It also reduces biases and allows us to monitor the quality of each auditor and our team as a whole.

Think of it as having two pilots and one autopilot on a plane. It might seem inefficient, but it has saved lives in the past.

Our auditors like the freedom of it, particularly because we mostly work with very senior people. They enjoy the reduced communication overhead with clients and limited availability needs.

Competition has been very friendly and is welcome - we believe this is because

  1. There are no direct financial consequences, as for example in contests and competitions.

  2. We staff people with different backgrounds - it is expected that a DeFi specialist might find different things than a cryptographer.

Auditing with this methodology has repeatedly led to us finding more issues than the competition - even when working on the same codebase at the same time.

There is the counterpart in the industry: many companies decide to audit their projects by multiple firms and audits. We believe this is a great practice and view redundancy as a key part of security. This is why we encourage our clients to work with multiple security providers.

This process is not only more robust but also reduces biases and allows us to monitor the quality of each auditor and our team as a whole.

We employ a variety of techniques and perspectives to give you a 360 degree review of your project to maximize coverage and depth.

Learn how the process improves the industry and auditors

icon

Our process emphasizes redundancy and incentives.

It also reduces biases and allows us to monitor the quality of each auditor and our team as a whole.

Think of it as having two pilots and one autopilot on a plane. It might seem inefficient, but it has saved lives in the past.

Our auditors like the freedom of it, particularly because we mostly work with very senior people. They enjoy the reduced communication overhead with clients and limited availability needs.

Competition has been very friendly and is welcome - we believe this is because

  1. There are no direct financial consequences, as for example in contests and competitions.

  2. We staff people with different backgrounds - it is expected that a DeFi specialist might find different things than a cryptographer.

Auditing with this methodology has repeatedly led to us finding more issues than the competition - even when working on the same codebase at the same time.

There is the counterpart in the industry: many companies decide to audit their projects by multiple firms and audits. We believe this is a great practice and view redundancy as a key part of security. This is why we encourage our clients to work with multiple security providers.

This process is not only more robust but also reduces biases and allows us to monitor the quality of each auditor and our team as a whole.

We employ a variety of techniques and perspectives to give you a 360 degree review of your project to maximize coverage and depth.

Learn how the process improves the industry and auditors

icon

Our process emphasizes redundancy and incentives.

It also reduces biases and allows us to monitor the quality of each auditor and our team as a whole.

Think of it as having two pilots and one autopilot on a plane. It might seem inefficient, but it has saved lives in the past.

Our auditors like the freedom of it, particularly because we mostly work with very senior people. They enjoy the reduced communication overhead with clients and limited availability needs.

Competition has been very friendly and is welcome - we believe this is because

  1. There are no direct financial consequences, as for example in contests and competitions.

  2. We staff people with different backgrounds - it is expected that a DeFi specialist might find different things than a cryptographer.

Auditing with this methodology has repeatedly led to us finding more issues than the competition - even when working on the same codebase at the same time.

There is the counterpart in the industry: many companies decide to audit their projects by multiple firms and audits. We believe this is a great practice and view redundancy as a key part of security. This is why we encourage our clients to work with multiple security providers.

This process is not only more robust but also reduces biases and allows us to monitor the quality of each auditor and our team as a whole.

We employ a variety of techniques and perspectives to give you a 360 degree review of your project to maximize coverage and depth.

Our specializations

EVM (Solidity)

arrow down

EVM (Solidity)

arrow down

EVM (Solidity)

arrow down

Solana

arrow down

Solana

arrow down

Solana

arrow down

Cosmos (CosmWasm)

arrow down

Cosmos (CosmWasm)

arrow down

Cosmos (CosmWasm)

arrow down

Polkadot/Substrate (ink!)

arrow down

Polkadot/Substrate (ink!)

arrow down

Polkadot/Substrate (ink!)

arrow down

Stellar (Soroban)

arrow down

Stellar (Soroban)

arrow down

Stellar (Soroban)

arrow down

Rust

arrow down

Rust

arrow down

Rust

arrow down

Consensus Protocols/Light Clients

arrow down

Consensus Protocols/Light Clients

arrow down

Consensus Protocols/Light Clients

arrow down

Virtual Machines

arrow down

Virtual Machines

arrow down

Virtual Machines

arrow down

Cryptographic Primitives

arrow down

Cryptographic Primitives

arrow down

Cryptographic Primitives

arrow down

DeFi

arrow down

DeFi

arrow down

DeFi

arrow down

Liquid Staking/Restaking

arrow down

Liquid Staking/Restaking

arrow down

Liquid Staking/Restaking

arrow down

Cross-Chain Bridges/Sequencers

arrow down

Cross-Chain Bridges/Sequencers

arrow down

Cross-Chain Bridges/Sequencers

arrow down

Off-chain Infrastructure

arrow down

Off-chain Infrastructure

arrow down

Off-chain Infrastructure

arrow down

Accessible security

Our audits are fully bespoke — led by world-class security engineers with a track record of excellence.

To make top-tier protection accessible, we provide flexible options: Audits of standard tokens at a fixed rate, AI-assisted scans, and long-term retainers for ongoing support.

icon

Audit of standard tokens

Our Standard Token Audit is ideal for Real-World Asset projects or Token Launches. Projects issuing a standard fungible and non-fungible token with typical features (transfer, mint, burn, supply cap, etc.).

We will check for alignment with the official token standard, highlight any deviations, and also review the code for security vulnerabilities.

We employ our signature ‘blinded’ approach—multiple experienced auditors review every line of code

We employ our signature ‘blinded’ approach—multiple experienced auditors review every line of code

We employ our signature ‘blinded’ approach—multiple experienced auditors review every line of code

Detailed findings, recommendations, and a risk assessment are provided in a concise final report

Detailed findings, recommendations, and a risk assessment are provided in a concise final report

Detailed findings, recommendations, and a risk assessment are provided in a concise final report

Publication and Announcement on our media channels

Publication and Announcement on our media channels

Publication and Announcement on our media channels

These typically take less than a week to complete.

icon

AI-assisted MVP scan

Our AI-assisted MVP scan is perfect for early teams that need a rapid security review, such as prior to testnet launches.

It’s also suitable for VCs and ecosystems that want to vet projects during their technical due diligence.

AI-assisted scanning and analysis, paired with a function-level checklist review

AI-assisted scanning and analysis, paired with a function-level checklist review

AI-assisted scanning and analysis, paired with a function-level checklist review

Assumes project logic is correct; focus is on spotting common vulnerabilities, red flags and adherence to best practices, red flags

Assumes project logic is correct; focus is on spotting common vulnerabilities, red flags and adherence to best practices, red flags

Assumes project logic is correct; focus is on spotting common vulnerabilities, red flags and adherence to best practices, red flags

Function-Level Call Graph shared with your dev team for an extra layer of defense

Function-Level Call Graph shared with your dev team for an extra layer of defense

Function-Level Call Graph shared with your dev team for an extra layer of defense

This is significantly more affordable than a full audit and is typically delivered within 3 business days.

icon

Our retainer model

Traditional auditing retainer agreements often fail to accommodate the natural fluctuations in software development cycles and the varying volume of code.

Our credit-based model provides consistent access to our auditing services,  while offering the flexibility to use your credits according to your project needs.

Audible for audits: For a monthly fee, clients earn auditing ‘credits’ (1 credit = 1 week of auditing) that can be used during that month or during a future audit.

This results in a guaranteed start date each month as well as a 20% saving compared to the cost of booking a one-time engagement.

Flexible pricing,
easy scheduling

Choose the level of security that fits your needs. We have two pricing tiers per technology stack.

In a hurry? We're adaptable and can scale our operations swiftly.

Signature Audit

At least 4 senior security researchers

Booked by the strongest teams for maximum redundancy

Seed Audit

At least 2 senior security researchers

Best for young teams with lighter security needs

Frequently
asked
questions

Frequently Asked Questions

Frequently Asked Questions

How much does an audit cost?

icon

It depends – we estimate the cost of each audit individually and provide a quote based on a number of factors, including the size of the codebase, its complexity, novelty, and the cost of the team required for the specific project. We will get back to you within one business day of receiving your request for a quote.

How much does an audit cost?

icon

It depends – we estimate the cost of each audit individually and provide a quote based on a number of factors, including the size of the codebase, its complexity, novelty, and the cost of the team required for the specific project. We will get back to you within one business day of receiving your request for a quote.

How much does an audit cost?

icon

It depends – we estimate the cost of each audit individually and provide a quote based on a number of factors, including the size of the codebase, its complexity, novelty, and the cost of the team required for the specific project. We will get back to you within one business day of receiving your request for a quote.

Will an audit find all vulnerabilities?

icon

Our security audits are time-limited engagements designed to identify as many issues as possible in the allocated time. While we would like to promise you a 100% hit rate with our unique and robust approach, we believe no security company can make this claim.

Security audits should only be considered one component of your overall security strategy. We offer many cybersecurity services beyond audits and can work with you to review and optimize your overall security posture.

Will an audit find all vulnerabilities?

icon

Our security audits are time-limited engagements designed to identify as many issues as possible in the allocated time. While we would like to promise you a 100% hit rate with our unique and robust approach, we believe no security company can make this claim.

Security audits should only be considered one component of your overall security strategy. We offer many cybersecurity services beyond audits and can work with you to review and optimize your overall security posture.

Will an audit find all vulnerabilities?

icon

Our security audits are time-limited engagements designed to identify as many issues as possible in the allocated time. While we would like to promise you a 100% hit rate with our unique and robust approach, we believe no security company can make this claim.

Security audits should only be considered one component of your overall security strategy. We offer many cybersecurity services beyond audits and can work with you to review and optimize your overall security posture.

Do you do incremental audits?

icon

For minor or major updates to an already audited codebase, we offer incremental audits. Changes in one part of the code can impact other areas, so we perform a thorough review of possible effects on the entire codebase, not just the changes.

To maintain consistency and minimize friction, we aim to keep the same audit team for these reviews. Depending on the time elapsed between audits and the availability of the original team, additional time may be needed for re-familiarization with the protocol.

Scoping for incremental audits is determined on a case-by-case basis, using a practical and common-sense approach.

Do you do incremental audits?

icon

For minor or major updates to an already audited codebase, we offer incremental audits. Changes in one part of the code can impact other areas, so we perform a thorough review of possible effects on the entire codebase, not just the changes.

To maintain consistency and minimize friction, we aim to keep the same audit team for these reviews. Depending on the time elapsed between audits and the availability of the original team, additional time may be needed for re-familiarization with the protocol.

Scoping for incremental audits is determined on a case-by-case basis, using a practical and common-sense approach.

Do you do incremental audits?

icon

For minor or major updates to an already audited codebase, we offer incremental audits. Changes in one part of the code can impact other areas, so we perform a thorough review of possible effects on the entire codebase, not just the changes.

To maintain consistency and minimize friction, we aim to keep the same audit team for these reviews. Depending on the time elapsed between audits and the availability of the original team, additional time may be needed for re-familiarization with the protocol.

Scoping for incremental audits is determined on a case-by-case basis, using a practical and common-sense approach.

How long does an audit take?

icon

The timeline for each audit depends on the complexity of the project and will be provided with our initial quote on a case-by-case basis. Audits may take anything from 0.5 weeks for simple projects, to 12 weeks for very complex projects. In most cases, they take 1 to 2 weeks.

In addition to the duration of the audit itself, you should account for time to apply our recommendations. Our verification of your fixes of the issues we identify is included as part of our audit service. Our auditors remain available for 3 weeks after the initial report has been delivered for this process.

How long does an audit take?

icon

The timeline for each audit depends on the complexity of the project and will be provided with our initial quote on a case-by-case basis. Audits may take anything from 0.5 weeks for simple projects, to 12 weeks for very complex projects. In most cases, they take 1 to 2 weeks.

In addition to the duration of the audit itself, you should account for time to apply our recommendations. Our verification of your fixes of the issues we identify is included as part of our audit service. Our auditors remain available for 3 weeks after the initial report has been delivered for this process.

How long does an audit take?

icon

The timeline for each audit depends on the complexity of the project and will be provided with our initial quote on a case-by-case basis. Audits may take anything from 0.5 weeks for simple projects, to 12 weeks for very complex projects. In most cases, they take 1 to 2 weeks.

In addition to the duration of the audit itself, you should account for time to apply our recommendations. Our verification of your fixes of the issues we identify is included as part of our audit service. Our auditors remain available for 3 weeks after the initial report has been delivered for this process.

When should I request a quote?

icon

We recommend reaching out as early as possible to avoid delays in case of longer lead times. We do not require a codebase that is ready for the audit when we create a quote.

As long as we receive a work-progress version together with a description of the functionality to be added, we can create an estimate of the effort and budget required. We also offer blanket reservations to clients who do not have a finalized codebase that will be refined closer to the audit start date.

When should I request a quote?

icon

We recommend reaching out as early as possible to avoid delays in case of longer lead times. We do not require a codebase that is ready for the audit when we create a quote.

As long as we receive a work-progress version together with a description of the functionality to be added, we can create an estimate of the effort and budget required. We also offer blanket reservations to clients who do not have a finalized codebase that will be refined closer to the audit start date.

When should I request a quote?

icon

We recommend reaching out as early as possible to avoid delays in case of longer lead times. We do not require a codebase that is ready for the audit when we create a quote.

As long as we receive a work-progress version together with a description of the functionality to be added, we can create an estimate of the effort and budget required. We also offer blanket reservations to clients who do not have a finalized codebase that will be refined closer to the audit start date.

How is Oak Security different from other firms?

icon

Oak Security uses a unique auditing process, based on blinded, independent reviews using a mix of methodologies. Each auditor assigned to your audit will work independently during the first phase of the project, initially not sharing their results. Each of the auditors follows their own methodology within our framework. This blinded approach has the advantage that auditors do not bias each other, whilst ensuring a wider breadth of techniques being applied. It also allows us to monitor the contributions of our auditors, which can be used to ensure high and consistent quality across projects.

After this initial phase, the auditors will share their findings in a consensus step and produce a report which lists issues encountered together with recommendations. The final version of our report is transparently published to our GitHub repository.

View our published audit reports and testimonials.

How is Oak Security different from other firms?

icon

Oak Security uses a unique auditing process, based on blinded, independent reviews using a mix of methodologies. Each auditor assigned to your audit will work independently during the first phase of the project, initially not sharing their results. Each of the auditors follows their own methodology within our framework. This blinded approach has the advantage that auditors do not bias each other, whilst ensuring a wider breadth of techniques being applied. It also allows us to monitor the contributions of our auditors, which can be used to ensure high and consistent quality across projects.

After this initial phase, the auditors will share their findings in a consensus step and produce a report which lists issues encountered together with recommendations. The final version of our report is transparently published to our GitHub repository.

View our published audit reports and testimonials.

How is Oak Security different from other firms?

icon

Oak Security uses a unique auditing process, based on blinded, independent reviews using a mix of methodologies. Each auditor assigned to your audit will work independently during the first phase of the project, initially not sharing their results. Each of the auditors follows their own methodology within our framework. This blinded approach has the advantage that auditors do not bias each other, whilst ensuring a wider breadth of techniques being applied. It also allows us to monitor the contributions of our auditors, which can be used to ensure high and consistent quality across projects.

After this initial phase, the auditors will share their findings in a consensus step and produce a report which lists issues encountered together with recommendations. The final version of our report is transparently published to our GitHub repository.

View our published audit reports and testimonials.

Request a quote

I need an NDA

Talk to us

Request a quote

I need an NDA

Talk to us

Request a quote

I need an NDA

Talk to us