DeFi protocol security audit
DeFi protocols break at the seams: accounting, oracles, liquidations and the protocols they plug into. Guardian audits the mechanism, not just the code.
DeFi audits for
Dolomite
Olympus
Onchain · DeFi Protocol Audit
Where the money moves, the math has to hold.
- Accounting and solvency Share math, vault NAV, interest and reward accrual, donations, first depositors and rounding direction.
- Oracles Spot prices and TWAPs, staleness, deviation and fallbacks, and manipulation with borrowed capital.
- Liquidations and bad debt Health checks, incentives, auto-deleveraging, cascades and who absorbs the shortfall.
- Economic attacks Flash loans, MEV and sandwiches, same-block governance, and incentives that pay to attack.
- Integrations Every protocol you plug into, weird tokens, callbacks, and assumptions about other teams' upgrades.
- Keepers and admin Keeper and relayer trust, parameter changes, pause and upgrade paths, and timelocks.
Covers lending, perps, AMMs and DEXs, vaults, staking and bridges. Two teams and the invariant suite test the mechanism at flash-loan scale, not only the code.
Published work
DeFi protocols Guardian has reviewed.
- Client storyGMXPerpetuals: 80+ engagements and a seat on the GMX DAO Security Committee.
- Case studyDolomiteA lending platform integrated with GMX V2.
- Case studyOrderlyCross-chain perpetuals settlement.
- Case studyUmamiDelta-neutral GMX V2 index vaults with internal hedging.
- Case studyPoolsharkCover and Limit concentrated-liquidity AMMs.
- Case studySynthetix BFP marketA delta-neutral perpetuals market on Ethereum mainnet.
Recent incidents
The failures a DeFi audit tests for.
-
$223MCetus
A faulty overflow check in an imported math library let a one-token deposit buy enormous liquidity.
May 2025 Our breakdown of the Cetus incident
-
$121.1MBalancer
Exact-out swaps rounded the required input down. Repeated in low-liquidity pools, the error drained pools on five chains.
-
$8.4MBunni
Withdrawals rounded an idle balance down, which the team assumed was safe. Repeated at scale, it paid out.
Sep 2025 Our coverage of the Bunni incident
“10/10 They are hands down some of the absolute best security minds in the space. This is how auditing DeFi protocols should be.”
AlphakeyPoolshark“Our experience with Guardian has been amazing. All security researchers on the team were exceptional at understanding all intricacies of the design and the team is well suited to audit any novel DeFi product that comes their way.”
Umami ChanUmami FinanceQuestions
DeFi audit questions
Do you test economic attacks, not just code bugs?
Yes. Every audit assumes the attacker can borrow vast sums, so oracle inputs, liquidation incentives, rounding and governance are tested at flash-loan scale, and the invariant suite fuzzes solvency and accounting across every reachable state.
Do you have checklists for lending and perps?
Yes: the lending protocol audit checklist and the perp DEX audit checklist each list 40 checks.
Can you review the keepers and backend too?
Yes. Keepers, relayers and APIs are covered by an Offchain Automation Pentest, run alongside the contracts, as on GMX's keeper service.
How much does it cost, and how long does it take?
Guardian scopes every audit from your repository and commit, so there is no list price. The cost estimator gives a range from nSLOC, and how long an audit takes covers review windows, code freeze and fix review.
Smart Contract Audit
Other engagements
- Featured · Onchain Vanguard Audit A security audit designed to protect onchain teams facing unprecedented cyber risk. Explore Vanguard
- Managed services Managed Security Dedicated response team, red team, 24/7 attack and defense across every surface you run, onchain and off. Explore Managed Security
- OnchainSmart Contract AuditTwo competing teams, Helix AI and invariant fuzzing.
- OnchainStablecoin AuditMint limits, roles, freezes, oracles and multichain deployments.
- OnchainSolidity AuditAccess control, reentrancy, math, upgrades and assembly.
- OnchainSolana AuditRust and Anchor programs: accounts, PDAs, CPIs and Token-2022.
- OffchainOpSec AuditKeys, signers, privileged roles, and critical operations.
- Penetration testingAll pentestsEvery offchain engagement, and how Guardian runs them.
Start now