Pre-production reviews for new protocols, markets, chains, and token systems.
Penetration Testing
Everything around the contracts, attacked like it holds the funds.
Web apps, APIs, cloud, keepers, extensions and SDKs, tested by the researchers who audit your contracts, with a focus on exploitable paths to funds, not checklist coverage.
What Guardian tests
Pick an engagement.
Every surface between your users and the chain. Select one to see what the engagement covers.
Offchain · Infrastructure Pentest
The servers, accounts, and vendors your protocol depends on.
Your cloud accounts, pipelines and vendor consoles, attacked the way an intruder escalates toward something that signs.
- Cloud posture
- Secrets handling
- Build and deploy
- Vendor consoles
The breach was at a cloud database provider. Nothing onchain had to fail for the funds to move. Mixin · $200M (read the incident write-up)
Get an Infrastructure Pentest
Scoped by the cloud accounts and platforms in play.
Offchain · WebApp Pentest
The interface between a user and their funds.
The flows that authenticate users, authorize actions and move funds, attacked where a wrong answer costs money.
- Authentication
- Authorization
- Value-moving flows
- Business logic
Withdrawals were approved while two-factor authentication was bypassed. The control existed and did not hold. Crypto.com · $34M (read the incident write-up)
Get a WebApp Pentest
Scoped by what a user can actually do in the app.
Offchain · API Pentest
What a stolen key is worth once someone else is holding it.
What each key can reach, how far its permissions stretch, and what happens once one is stolen.
- Key scoping
- Endpoint authorization
- Abuse resistance
- Surface discovery
Exchange API keys were stolen and traded. The keys stayed valid, and the trades they placed were authorized. 3Commas · $22M (read the incident write-up)
Get an API Pentest
Scoped by endpoint count and the roles behind them.
Offchain · Browser Extension Pentest
Software you ship that runs inside every page a user opens.
What a hostile site can pull out of your extension, and what a bad update could do to its users.
- Permissions and manifest
- Key and session storage
- Signing flows
- Supply chain
One phished developer account was enough to publish a malicious update. It reached roughly 400,000 users before anyone noticed. Cyberhaven · 400k users (read the incident write-up)
Get a Browser Extension Pentest
Send the store listing and the repository to get scoped.
Offchain · SDK Audit
The library your integrators install and stop thinking about.
What your library does with a payload on its way to a wallet, and what one bad release would cost integrators.
- Transaction construction
- Key and credential handling
- Published artifact
- Release control
The wallet was never broken. Three malicious versions of the library it publishes reached every dApp that had installed it. Ledger Connect Kit · $600K (read the incident write-up)
Get an SDK Audit
Scoped by the public surface and the release pipeline.
Offchain · Offchain Automation Pentest
The systems that act on your behalf while nobody is watching.
Keepers, relayers, bots and threshold signers, tested with hostile inputs and part of the set compromised.
- Threshold signing
- Keeper and bot privileges
- Input integrity
- Failure behavior
Offchain threshold signing was broken. The signing set produced valid signatures for transactions it should have refused. THORChain · $10M (read the incident write-up)
Get an Offchain Automation Pentest
Scoped like a code review, by what has to be read.
Offchain · OpSec Audit
Every path to your funds, and who can walk it.
Keys, signers, privileged roles and the people around them, mapped and tested.
- Threat model
- Custody and key ceremony
- Privileged roles
- Multisig signing
The contracts held. A breached Safe{Wallet} developer machine served signers a disguised transaction, and they approved it. Bybit · $1.46B (read the incident write-up)
Get an OpSec Audit
Scoped by the funds at stake and who can move them.
Coverage
Focused reviews for migrations, parameter changes, governance updates, and hot fixes.
Rapid analysis when a protocol needs to understand exposure, blast radius, and recovery paths.
Start now