OpSec audit

• Threat model The contracts that hold your funds, the roles that can move them, and the keys, signers and multisigs behind each one, mapped end to end.
• Custody and key ceremony Where the keys live, who holds which share, what a quorum requires in practice, and what happens the day someone leaves or a device is lost.
• Privileged roles Who can upgrade, pause, mint, set parameters or move funds, whether that sits behind a threshold or a single key, and how fast it can be used.
• Multisig signing How transactions are proposed, checked and signed, what a signer actually sees before approving, and what it takes to slip a malicious payload past them.
• Access and change control Access across every system, secrets handling, release and deployment control, and separation between environments.
• People and response Who approves what, how joiners and leavers are handled, which single points of failure need spreading, and whether incident runbooks hold up.

You receive the threat model of your funds and a ranked list of changes to make, each tied to the path it closes. Pair it with Managed Security to keep that threat model current, with every multisig transaction and deployment reviewed as it lands.

The contracts held. A breached Safe{Wallet} developer machine served signers a disguised transaction, and they approved it. Bybit · $1.46B↗ (read the incident write-up)