OtterSec Get in touch

EVM AND SOLIDITY

EVM security, from your contracts to the compiler underneath

We’ve audited teams like Vyper, LayerZero, Wormhole, Euler and MetaMask, served on Uniswap’s bridge committee and researched malicious hook usage in Uniswap v4.

$36.82B+On-chain TVL secured
120+Projects audited
Public audits Get in touch

Trusted by teams building the next generation of crypto

Served on Uniswap’s bridge committeePublic audit reportsSolana · EVM · Sui · Aptos · Cosmos · NEAR

FAQ

EVM audit FAQ

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

Can we read past audits?

Yes. Every public security review from the OtterSec team is listed at osec.io/audits.

Do we wait for the final report to see findings?

No. After kickoff we share findings as they emerge and ask questions as needed. The final report collects our findings and suggestions for fixes.

Do you work beyond the major chains?

Yes. We love niche languages and have worked with teams on Optimism, Arbitrum, Polygon, Algorand, Stellar, Sei, StarkNet and more.

WHAT WE AUDIT

EVM coverage, in depth

Solidity and Vyper contracts, the compilers that build them and the systems around them.

EVM and Solidity

Experts in Solidity who have audited teams like Vyper, LayerZero, Wormhole, Euler and MetaMask, and researched malicious hook usage in Uniswap v4.

Compilers and VMs

We have audited the Ethereum stack down to the compiler, and our Solana validator fuzzing led to multiple critical denial-of-service findings.

Fuzzing

A core discipline: differential compiler fuzzers for Vyper, transactional fuzzers for Solana validators, rBPF JIT fuzzers and Move VM bytecode fuzzers.

Bridges and messaging

Cross-chain infrastructure for teams like LayerZero and Wormhole. We have also served on Uniswap’s bridge committee.

HOW WE AUDIT

From scoping to report

  1. 01

    Initial discussion

    We discuss your goals, timeline and security needs to see whether we’re a fit.

  2. 02

    Info gathering

    We send an MNDA and look at the repositories in scope to understand the details of your project.

  3. 03

    Quote

    We deliver a quote based on expected duration, potential vulnerabilities and the overall complexity of your project.

  4. 04

    Kickoff

    The audit begins. We share findings as they emerge and ask questions as needed.

  5. 05

    Report delivery

    At completion you get a report with our findings and suggestions for fixes.

Get in touch

EVM

Get your Solidity reviewed by compiler-level auditors

Share your scope and timeline. We’ll come back with a quote based on duration, potential vulnerabilities and complexity.

Get in touch