How to Vet Web3 Security Firms: 10 Checks Beyond Logos
Quick answer. Ask for evidence, not logos: public reports with finding statuses and the commit checked in each fix review, named people for each surface, a stated method, tests beyond contracts, an honest account of incidents after launch, and written retest, data and independence terms.
Video transcript
A client logo shows a firm was hired. It does not show what the firm found, or whether the fix held.
Guardian publishes this guide and sells audits and managed security. The Security Alliance, SEAL, says to judge reviewers on track record, published reports, method and references.
Ask for public reports on systems like yours. Every finding needs a status, every fix review should name its commit, then read every Critical and High.
Guardian's archive lists 9,617 findings across 320 reports, with Critical and High at 12.4 percent. Severity counts follow each firm's own definitions. They are not a safety score.
Get named people for each surface, including cloud and signing services, and call references with similar systems. Then ask which technique runs on which component.
Map every surface beyond contracts. In Guardian's Synthetix Withdrawal Flow report, one private key served the relayer, watcher and teller roles. The public report lists that High finding as pending.
After launch, ask about incidents in reviewed systems, and the scope and commit at the time. A specific answer beats a spotless list. Avoid firms that guarantee finding every vulnerability.
Then put terms in writing: staffing, fix review rounds, access and data deletion, publication rights, and who calls you when a Critical is found.
Read the full ten checks, then test Guardian's audit against them. Start with our public reports at guardian.security.
Why Logos Prove Little
A client logo shows that a firm was hired. It does not show what the firm found, or whether the fix held. Security Alliance (SEAL) Frameworks
The Security Alliance (SEAL) tells buyers to judge reviewers on track record, published reports, domain fit, technical capability, method and references. Security Alliance (SEAL) Frameworks
Our guide to choosing a smart contract auditor asks 15 questions about one audit. This page vets the firm across every surface you hire it for, and after launch.
Our top smart contract auditors ranking profiles the firms; these checks test any of them. Guardian publishes this page and sells audits and managed security. Guardian, Guardian
Public Reports and Findings
Check 1: find the evidence trail. Ask for public reports on systems like yours, at a stable URL or PDF on the firm's own site. Guardian, Security Alliance (SEAL) Frameworks
Treat gaps with care. Public reports are a selection, and a firm may hold strong work that clients chose not to publish.
Check 2: read the statuses and the fix review. Each finding should carry a status, and each resolution note should say what changed. Guardian, Guardian
The fix-review round should name the commit it checked. Without it, you cannot tell which code a resolved status describes. Guardian, Guardian
In Guardian's EthenaLock report, the main and remediation rounds each name their commit, and all three informational findings cite a fixing commit. Guardian
Per-finding commits are not universal. Many reports, Guardian's included, record one commit per round, and some resolution notes are blank. Guardian
A pending or acknowledged status records no verified fix. Some public reports, Guardian's included, leave every finding pending; ask why. Guardian, Guardian
Check 3: read the Criticals, not the count. Open every Critical and High finding and its resolution note before comparing firms. Guardian
Guardian's public archive lists 9,617 findings across 320 reports. Of those, 343 are Critical and 845 High, together 12.4%. Guardian
Severity totals follow each firm's own definitions. They are not a safety score, so compare findings on code similar to yours. Guardian
Named Researchers and Method
Check 4: get names for each surface. The audit lead is one person; ask who tests your API, cloud, wallets and signing services too. Guardian, Security Alliance (SEAL) Frameworks
See whether reports name their reviewers. Guardian's EthenaLock report, for example, names four auditors. Guardian
SEAL separates web3 expertise from web2 expertise for traditional systems. Ask for public work showing each, tied to named people or stable handles. Security Alliance (SEAL) Frameworks
Then call references. SEAL puts them first in its due diligence steps; choose teams whose systems look like yours. Security Alliance (SEAL) Frameworks
Check 5: ask how the method fits together. SEAL looks for automated tools, thorough manual review and deeper testing such as fuzzing or formal verification. Security Alliance (SEAL) Frameworks
Ethereum.org says audits will not catch every bug and mainly add another round of review. Ethereum.org
It recommends combining unit tests with property-based testing through static and dynamic analysis, and describes formal verification for proving a contract meets its specification. Ethereum.org
Ask which technique runs on which component, who reads the tool output, and how a tool result becomes a confirmed finding. Security Alliance (SEAL) Frameworks, Ethereum.org
Coverage Beyond Smart Contracts
Check 6: map every surface. SEAL's review scope spans applications, infrastructure, data systems, third-party integrations and process, not only contracts. Security Alliance (SEAL) Frameworks
For an onchain team, that can mean web apps, APIs, cloud, CI/CD, wallets, SDKs, DNS, keepers, relayers and signing services. Guardian, Security Alliance (SEAL) Frameworks
Ask the firm to name a test for each surface in scope, and to list what it excludes.
Check 7: probe key and role separation. Ask which signing keys each service holds, and whether one key can act in several roles. Guardian
Guardian's Synthetix Withdrawal Flow report shows why. All 73 scoped files, 25,915 nSLOC, were offchain Go services, including the relayer, subaccount and trading services. Guardian
Finding H-14, rated High, found one private key serving the relayer, watcher and teller roles, though the contract expected a quorum of independent watchers. Guardian
Guardian recommended separate, independent keys. The public report lists H-14 as pending, with no resolution or retest recorded. Guardian
A contract-only review would not see that key. Guardian
Check 8: test sign-in against the standard. For Sign-In with Ethereum, ERC-4361 requires checks on the domain, URI, chain ID, nonce and time fields. Ethereum Improvement Proposals
The nonce must be at least eight characters, and a fresh, high-entropy nonce per session is recommended. Ethereum Improvement Proposals
Ask for the test cases, including contract-wallet signatures and expired messages, rather than screenshots of a working login. Ethereum Improvement Proposals
Track Record After Launch
Check 9: ask what happened later. Request a list of incidents involving systems the firm reviewed, with any public post-mortem. Security Alliance (SEAL) Frameworks
For each one, get the scope and commit reviewed at the time. SEAL defines a review as time-boxed, so check whether the exploited code was in scope. Security Alliance (SEAL) Frameworks
Code changed after the review, new signers and new cloud settings are new risk. They need their own review or monitoring. Security Alliance (SEAL) Frameworks
Then ask what the firm changed in its own process afterward. A specific answer tells you more than a spotless list.
Ask what the firm covers once the report ships: update reviews, bounty triage, monitoring and incident response. Guardian
Guardian's Managed Security page, for example, describes continuous testing, managed bounty triage, and 24/7 monitoring and response across contracts, multisigs, signing services, DNS and cloud. Guardian
Commercial and Data Terms
Check 10: put the terms in writing. SEAL asks you to compare cost against scope and confirm availability fits your timeline. Security Alliance (SEAL) Frameworks
Our audit RFP template sets out staffing, fix review, publication and conflict clauses, and our vendor due diligence questionnaire covers vendor-level controls.
Staffing: the quote should name the people from Check 4, with engineer-weeks per surface. Names missing from the quote are a warning.
Fix review: count the included rounds, confirm the same people run them, and check each round names its commit. Guardian
Access: the firm will hold your code, and sometimes credentials. Ask how it limits that access, and when it deletes your data after the engagement.
Publication: agree who may publish the report and when. A public report is the evidence later buyers and allocators will check.
Independence: ask in writing about subcontractors and any concurrent work for a direct competitor.
Guarantees: SEAL flags vendors that guarantee finding every vulnerability. Security Alliance (SEAL) Frameworks
Escalation: name who calls you the day a Critical is found, and how the firm reaches your signers.
Checklist for Blockchain Security Firms
Send the checks before the first call, and weight answers that come with a link, commit, name or clause.
| Check | Ask for | Red flag |
|---|---|---|
| 1. Public reports | Report URLs on systems like yours | Logos with no reports behind them |
| 2. Fix review | Statuses, notes, commit per round | Resolved status with no round commit |
| 3. Criticals | Every Critical and High with its resolution | A severity count offered as a safety score |
| 4. People | Named testers per surface, references with similar systems | One name covering every surface |
| 5. Method | Which technique runs on which component | Unclear method or no standard report format |
| 6. Surfaces | A named test per surface, plus exclusions | A single line reading offchain review |
| 7. Keys | A key separation finding the firm reported, and its status | No view of which service holds which key |
| 8. Sign-in | ERC-4361 test cases, contract wallets, expired messages | Screenshots of a working login |
| 9. After launch | Incidents, scope and commit then, process changes | A spotless list with no context |
| 10. Terms | Staffing, fix review, access, publication, independence, escalation in writing | A guarantee of finding every vulnerability |
Frequently Asked Questions
Is an audit badge proof that a firm did good work?
No. SEAL says an external review is not a certificate of safety, and should be a recurring commitment rather than a one-time badge. Follow any badge to the full report before you rely on it. Security Alliance (SEAL) Frameworks
Does a hacked client mean the security firm is weak?
Not on its own. SEAL notes that experienced teams have reviewed many codebases, which raises the odds that some are later compromised. Weigh the firm's record across many reports rather than one incident. Security Alliance (SEAL) Frameworks
What is the fairest way to compare two firms' results?
SEAL says comparing reviewers who audited the same code at the same time is more meaningful than comparing reviews done one after another. If you commission parallel reviews, line up which findings each team caught. Security Alliance (SEAL) Frameworks
Related reading
- how to choose a smart contract auditor
- top smart contract auditors
- smart contract audit rfp template
- digital asset vendor due diligence questionnaire
- how to read a smart contract audit report
Sources
- Guardian: Published Smart Contract Audit Reports
- Guardian: Smart Contract Audit
- Guardian: Managed Security
- Security Alliance (SEAL) Frameworks: Vendor Selection
- Security Alliance (SEAL) Frameworks: External Security Reviews
- Ethereum.org: Smart contract security
- Ethereum Improvement Proposals: ERC-4361: Sign-In with Ethereum
- Guardian: EthenaLock Security Review
- Guardian: Synthetix Withdrawal Flow: H-14 Shared Key for Relayer, Teller and Watcher
Test Guardian's Audit Against the 10 Checks
If contract code is your main risk, a Guardian smart contract audit puts two independent teams on one scope, and the invariant suite stays with you. Read our public reports, then send us the checklist.