Smart contracts, chain runtimes, and the bridges and infrastructure around them. EVM chains and rollups, Cosmos SDK and CosmWasm, Solana programs, Substrate runtimes, Move-based chains.
We have reviewed a Polkadot runtime continuously since 2019: the state transition logic, the modules that compose it, the on-chain upgrade path, and the contracts running on top. Alongside it we have reviewed dozens of other chains and contract platforms: EVM and rollups, Cosmos, Solana, Move.
A chain that ships does not hold still for an audit. The code changes under you, the upgrade path is itself an attack surface, and the defects worth finding are often the ones that appear only once two subsystems have both moved. Reviewing a release in isolation cannot see those, however carefully it reads the diff.
The first part is the same every time. What follows depends on the system, and we agree it with you.
Always first: understand the system end to end
Illustrative. The mix depends on the system and what is at risk, and we agree it with you.
The defects are specific to the protocol: arithmetic that wraps, state written before the check that guards it, an access decision taken somewhere it cannot be enforced, or an execution-metering mistake in gas, weights or compute units that lets an attacker buy execution cheaply. None of them has a signature a tool could carry, because the thing being violated is your design and nobody else has it.
A finding closes one bug. An invariant with a fuzzer behind it closes the class, and goes on closing it every time someone commits. CosmFuzz, our CosmWasm fuzzer, is public, and the write-up walks a campaign end to end against a token-accounting bug we planted in cw20-base to demonstrate it.
A month after the security alert, about 40% of the Parity Ethereum nodes in Ethernodes.org data were still unpatched. The flaw let any node be crashed remotely, which lowers the compute needed for a 51% attack. It spread slowly because the bug had not been marked critical on the project’s own update track, so clients running default settings never fetched it. How long a patch takes to land is part of the risk.
How
Node versions read from their announced headers in data from Ethernodes.org, acquired on 21 March 2019, a month after the security alert for the remotely triggerable integer overflow we disclosed to Parity that February. Ethernodes.org scans the network through the Ethereum discovery protocol and saw close to 11,000 nodes at that time.
The blockchain ecosystem has a patch problemThree shapes these engagements take. Scope is set with you, and most clients combine them.
We read the contracts against the invariants they are supposed to hold, then try to break them.
We review the chain itself: its state transition logic, the modules that compose it, and the upgrade path, not only what runs on top.
We test the parts that hold value while it is between two systems that trust each other.
Also available: exchange and custody platforms, where the chain is one component and the trading engine, the wallet management and the customer authentication around it are the rest — usually run with our software, cloud and red team practices rather than by this one alone. CosmFuzz and our other fuzzing harnesses are open source, so a team can start finding this class of bug before hiring anyone.
We start from the invariants: what must never be true of your contracts or your chain, written down before anyone reads code. CosmFuzz came out of exactly that: the demonstration in its write-up plants a token-accounting bug in cw20-base and catches it as a violation of one sentence written down in advance. The code is then read against them by hand, because the defects that cost money here are specific to your protocol, not generic bug classes a scanner knows. We build fuzzing harnesses that attack those invariants directly and hand them over, so the same class of bug fails a build before it ever reaches a chain. Nothing goes in the report until we can show it is reachable and what it lets an attacker take.
Tell us what you are building and what you need looked at. You will get an answer from the people who would run the engagement, and if another firm is the better fit for what you are asking, we will name one.
Security Research Labs is a member of the Allurity family. Learn more(opens in a new tab)