Skip to content

Solidity · Ethereum · Base · Arbitrum

Smart-contract audits, proven on a fork of the live chain.

Every finding says how firmly it is established. The strongest come with a passing test against the contracts you deployed.

Start an audit See how it works

Your first audit is free.

How it works

From repository to report in four steps.

  1. 01

    Connect GitHub or upload an archive

  2. 02

    We check the project and you choose the scope

    AUDITED
    Your contracts
    CONTEXT
    Libraries are read as context
    OUT
    Tests and mocks are left out

  3. 03

    Add the deployed contract addresses and get a fixed quote

  4. 04

    The audit runs; the report follows

    The audit maps the deployment, reviews, verifies, and proves findings on a fork.

Evidence tiers

Every finding says how firmly it is established.

Each finding in the report carries one of four tiers. The tier tells you what was shown, and under which conditions.

  • Proven

    TIER 1

    A test passed on a fork of the live chain, and an independent review found the test sound.

  • Proven under a specific configuration

    TIER 2

    The test passes on a fork when a stated configuration holds. The report names that configuration.

  • Proven, requires a privileged action

    TIER 3

    The test passes on a fork, and the path depends on an action by a privileged role. The report names the role.

  • Supported by review, not yet proven

    TIER 4

    Review supports the finding. No passing test exists for it yet, and the report says so.

In the report

What a finding looks like.

Each finding states its severity, its evidence tier and the affected contract. When a finding is proven, the test that proves it is part of the report.

Example finding EX-01

Liquidation accepts a stale oracle price

Severity
High
Evidence
Proven
Affected contract
LendingPool.sol · Base

liquidate() reads the oracle without checking when the price was last updated, so a position can be liquidated at a price the market has moved away from.

test/EX01_StalePrice.t.solproof test · excerpt 
// fork of Base at the audited block
function test_liquidateAtStalePrice() public {
    vm.createSelectFork("base", FORK_BLOCK);
    vm.warp(block.timestamp + 3 hours);
    vm.prank(liquidator);
    pool.liquidate(borrower, USDC, debt);
    assertGt(usdc.balanceOf(liquidator), debt);
}

[PASS] test_liquidateAtStalePrice()

What we audit

Solidity smart contracts on Ethereum, Base and Arbitrum.

Chains

  • Ethereum
  • Base
  • Arbitrum

Protocols

  • Lending
  • DEXs and AMMs
  • Vaults
  • Stablecoins
  • Bridges
  • Governance

Coming next

Fintech backend APIs

Notify meSign in and choose Notify me; we write when it opens.

Rust and Solana programs

Notify meSign in and choose Notify me; we write when it opens.

Pricing

One price per engagement, fixed from the quote before you start. Never per call.

Start an audit

  • Your first audit is free

    One per person, standard size.

  • Pay by card or by invoice

    Invoices are payable net 30.

  • Larger engagements

    Reviewed by Tekmer before they start.

Security and data

Your code stays contained.

  • Read-only GitHub access

    Tekmer reads your repository. It does not write to it.

  • Isolated sandboxes

    Your code is built and proofs run only in isolated sandboxes.

  • A local fork only

    Proofs run against a local fork. Nothing is ever sent to the live chain.

  • Deletion is complete

    Delete an engagement and its code and reports go with it.

FAQ

Questions

What does “proven” mean?

A test passed on a fork of the live chain, against the contracts you deployed, and an independent review found the test sound. Findings that fall short of that carry a lower tier, and the report says which.

What is in scope?

Solidity smart contracts on Ethereum, Base and Arbitrum: lending, DEXs and AMMs, vaults, stablecoins, bridges and governance. You choose the scope. Your contracts are audited, libraries are read as context, and tests and mocks are left out.

How is the price set?

One price per engagement, fixed from the quote before you start, never per call. Your first audit is free (one per person, standard size). Pay by card or by invoice, net 30.

Does anything touch the live chain?

No. Proofs run against a local fork, inside isolated sandboxes. Nothing is ever sent to the live chain.

What happens to my code afterwards?

GitHub access is read-only. When you delete an engagement, its code and reports go with it.

Start with a free audit.

Start an audit

One per person, standard size.