Offchain automation pentests
Keepers, relayers, liquidation bots, and threshold signers hold privileges and use them unattended. Guardian examines what they do when their inputs are hostile and when part of the set is already compromised.
Offchain · Offchain Automation Pentest
The systems that act on your behalf while nobody is watching.
- Threshold signing Share generation and storage, participant authentication, what a subset below threshold can force, and recovery after one node is compromised.
- Bot and keeper privileges What each automated key can call, whether the contract constrains it beyond trusting the caller, and the ceiling on a single run.
- Input integrity Oracle and price-feed handling, staleness and deviation limits, and what the automation does with an input it cannot validate.
- Failure behavior Whether a stuck, spammed, or partially failing job halts safely or keeps acting, and how an operator intervenes mid-incident.
- Schedulers and jobs Cron jobs, sequencers, risk engines, and oracle update scripts: what causes each run to fire, and what a mistimed, skipped, or duplicated run does onchain.
- Data pipelines Where the numbers come from before they are signed, how they are validated in transit, and whether a manipulated upstream source reaches the chain unchallenged.
These systems are custom by nature, so the review starts by establishing what the automation is supposed to guarantee and then works through the paths that break that guarantee: triggers, state transitions, key handling, retry logic, and the threat model of the automation-to-chain boundary. Source code access is required.
Offchain threshold signing was broken. The signing set produced valid signatures for transactions it should have refused. THORChain · $10M (read the incident write-up)
Scoped like a code review, by what has to be read.
Audits & Pentests
Other engagements
Start now