Offensive Security. Web3-Native.
Smart contract audits from application layer to VM internals. Penetration testing, red team operations, and cryptographic primitive review — for teams building at the edge of what has been secured before.
// DEF CON · Infiltrate · 15 yrs offensive security · Web3 + Web2
▋
years offensive security
DEF CON & Infiltrate talks
L1/L2 cores audited
chains audited
undisclosed critical findings
// chains audited
// where we’ve been
Infrastructure-depth security research.
Most auditors review application contracts. We have reviewed the VMs, bridges, consensus engines, and cryptographic primitives they run on.
ZK-SNARK Circuits & L2 Bridge Verification
Reviewed Linea’s L2 bridge for IFT — covering ZK-SNARK-friendly hash functions, circuit isolation, proof aggregation middleware, rollup-to-mainnet exit verification, fraud-proof state roots, and operator liveness constraints.
IBC Routing, Cosmos SDK & Evmos Execution Layer
Audited Cosmos SDK modules, Evmos execution layer, IBC cross-chain routing, token port modules, and light-client relay logic at ZetaChain. Consensus fault detection and state transition analysis on TON, Solana, and Sui core implementations.
RSKj VM, Trie Structures & Two-Way Peg Security
DeFi protocols and L1/L2 infrastructure at RootStock — RSKj VM internals, trie structures, precompiled contracts, two-way peg bridge, gas-cost inflation vectors, and federated HSM-based signing infrastructure.
Noise Protocol, Key Exchange & Ratcheting
Secure code audits for Codex, Waku, Nomos, and Status Wallet in Rust, Nim, and JS — including cryptographic primitive review of Noise handshake protocols, ephemeral key exchange, and ratcheting behaviors.
Consensus Fault Detection on TON, Solana & Sui
Security audits of TON, Solana, and Sui core implementations — focusing on consensus fault detection, fork handling edge cases, and state transition serialization bugs at the protocol layer.
Custom Slither Detectors & Formal Verification
We build the tooling, not just use it. Custom Slither detectors written for client-specific vulnerability classes, alongside Echidna, Medusa, Halmos, and Certora across EVM, Rust, and Cairo codebases.
// our services
What We Do
Hands-on offensive security from smart contract logic to L1 consensus engines. No automated scan reports. No junior consultants. Every engagement is led by a senior engineer who has audited the protocols, VMs, and cryptographic primitives your stack depends on.
// web2 & full-spectrum
Beyond the Blockchain
Web3 doesn’t exist in isolation. Most protocols have web2 attack surfaces — APIs, admin panels, CI/CD pipelines, employee endpoints. We test all of it.
// new attack surface
AI Security & AI × Web3
LLMs, autonomous agents, and on-chain AI systems are the next major attack surface. We bring offensive security research tradecraft to both sides of this stack.
Securing the AI Stack
Prompt injection. Jailbreaks. Data poisoning. RAG pipeline leakage. Agentic privilege escalation. We red team LLM systems using the same offensive mindset we bring to every engagement.
Where Both Worlds Collide
On-chain AI agents. LLM-integrated DeFi governance. AI oracle manipulation. We assess the full cross-stack risk surface where decentralized protocols embed AI components.
// how we work
A Rigorous Process. No Shortcuts.
Every engagement follows a battle-tested methodology — from scoping to final deliverable.
Scoping Call
We review your codebase, architecture docs, and threat model. We define scope, timeline, and commit hash.
Manual Review
Line-by-line analysis by an experienced security researcher. Logic flaws, access control, flash loan vectors, upgradeability risks — nothing is skipped.
Automated & Fuzzing
Custom tools developed by Viper, alongside industry standards: Aderyn (static analysis), Echidna/Medusa (property-based fuzzing), Halmos/Certora (formal verification where applicable).
Initial Report
Findings categorized by severity: Critical / High / Medium / Low / Informational. Each with PoC exploit where applicable.
Remediation Review
Your team implements fixes. We verify each mitigation and update finding status to Resolved or Acknowledged.
Final Report
Publishable PDF report delivered. Can be made public to signal security posture to your community.
// audit reports
We Publish Our Work
Transparency is a security signal. Where clients permit, we publish full audit reports — so the community can verify the work.
ZK-L2 Bridge Security Audit[Confidential]
2 Critical · 2 High · 1 Medium
Under NDACosmos SDK & IBC Cross-Chain Modules[Confidential]
2 Critical · 3 High · 2 Medium
Under NDARSKj VM & Two-Way Peg Bridge[Confidential]
0 Critical · 2 High · 4 Medium · 3 Low
Under NDA// research
Latest Research
Security insights from the field.
Ready to secure your protocol?
We work with a limited number of clients to maintain quality. Reach out early.
Start a Conversation