Solidity smart contract audit
Two independent teams, Helix AI and an invariant fuzzing suite on every Solidity codebase, from a single vault to a full perpetuals exchange.
Solidity audits for
Olympus
Limit Break
Dolomite
Onchain · Solidity Audit
Built for the bugs that still reach mainnet.
- Access control Roles, modifiers, initializers, ownership transfer, and every function an outsider can reach.
- External calls Classic, cross-function, cross-contract and read-only reentrancy, token hooks and flash loan callbacks.
- Math and rounding Fixed-point precision, rounding direction, unchecked blocks, casts, and overflow in pre-0.8 code.
- Upgradeability Transparent, UUPS, beacon and diamond proxies, storage layout, and initializers left open.
- Token integrations Fee-on-transfer, rebasing and missing-return tokens, decimals, permit, and approvals.
- Assembly and compiler Yul and inline assembly, memory safety, and known compiler bugs for your Solidity version.
Covers Ethereum, L2s and every EVM chain, Foundry and Hardhat projects, and upgradeable systems. Scope comes from your repository and commit, and the invariant suite stays with the code.
Published work
Solidity work you can read.
- Client storyGMXFour years, 80+ engagements and 38 public reports.
- Case studyVeranta V2Reviewing last, on code with Sherlock's fixes in: 4 Criticals and 18 Highs.
- Case studySynthetix LP vault65 findings, 1 Critical and 4 Highs, all resolved.
- ResearchState of Smart Contract Audits 20269,617 findings across 320 Guardian reports, by severity and category.
- Guide21 Solidity bugs that reach auditsFrom struct deletes to stale prices, and how to catch each one.
- PortfolioEvery public reportGuardian's published reports, by client.
Recent incidents
The bugs a Solidity audit tests for.
-
$197MEuler
A function added to patch an earlier bug skipped the health check. Liquidating the position it left behind paid more than the donation cost.
Mar 2023 Our coverage of the Euler incident
-
$121.1MBalancer
Exact-out swaps rounded the required input down. Repeated in low-liquidity pools, the error drained pools on five chains.
-
$26MTruebit
One unchecked addition in a 2021 contract priced about 240 million TRU at zero.
“Guardian has an impeccable eye to detail and goes above and beyond to ensure that the code is watertight. They are able to assess super advanced Solidity inline-assembly with ease.”
VectorizedSolady Core Contributor“The Guardian team’s attention to detail is top-notch. We sleep soundly at night knowing that Guardian went through every detail of our codebase rigorously.”
Corey CaplanDolomiteQuestions
Solidity audit questions
What do we get from a Solidity audit?
Two independent teams review the same scope, one manual and one driving Helix, Guardian's AI auditor, and only human-verified findings reach the report. You get the report with a fix review, and an invariant fuzzing suite that stays in your repository for every later change.
Do you review inline assembly?
Yes. Yul and assembly blocks are reviewed line by line for memory safety, unchecked math and storage layout, alongside the rest of the code.
Which Solidity version should we deploy?
It depends on the compiler bugs that affect your code and your target chains. Which Solidity version to use lists known bugs by version and a pragma policy.
How do we prepare?
Freeze a commit, document the invariants you rely on, and make the tests pass. How to prepare for a smart contract audit lists the mistakes that slow audits down.
How much does it cost, and how long does it take?
Guardian scopes every audit from your repository and commit, so there is no list price. The cost estimator gives a range from nSLOC, and how long an audit takes covers review windows, code freeze and fix review.
Smart Contract Audit
Other engagements
- Featured · Onchain Vanguard Audit A security audit designed to protect onchain teams facing unprecedented cyber risk. Explore Vanguard
- Managed services Managed Security Dedicated response team, red team, 24/7 attack and defense across every surface you run, onchain and off. Explore Managed Security
- OnchainSmart Contract AuditTwo competing teams, Helix AI and invariant fuzzing.
- OnchainStablecoin AuditMint limits, roles, freezes, oracles and multichain deployments.
- OnchainSolana AuditRust and Anchor programs: accounts, PDAs, CPIs and Token-2022.
- OnchainDeFi Protocol AuditAccounting, oracles, liquidations and integrations.
- OffchainOpSec AuditKeys, signers, privileged roles, and critical operations.
- Penetration testingAll pentestsEvery offchain engagement, and how Guardian runs them.
Start now