Security and tokenomics auditing
We audit token contracts and the economic design around them, then make the market in the result. Findings are reported by vulnerability class rather than by client, so the work informs the next engagement without identifying the last one.
Two kinds of audit
A security audit asks whether the contract does what it claims and whether an attacker can make it do something else. A tokenomics audit asks whether the economic design survives contact with a market — whether unlock schedules concentrate selling pressure at a predictable moment, whether emissions outpace any plausible absorption, whether the float is real.
Both matter and they fail differently. A contract can be flawless and the token still be structurally unsellable. The second failure is the more common one and it is the one almost nobody audits for, because it requires knowing how the instrument will behave in a market rather than how the code behaves in a test.
- Contract review
- Access control, arithmetic, upgrade paths, external calls, and the standard vulnerability classes.
- Economic review
- Supply mechanics, unlock and emission schedule, float composition, and absorption capacity.
- Integration review
- How the token behaves against venues, pools and oracles it will actually meet.
How we report findings
Findings are described by vulnerability class rather than by client. We will tell you the classes we most often find and what they cost when they are missed, and we will not tell you whose contract they were in — which is the same undertaking we give the client whose contract it was.
We do not currently publish named auditor credentials. Firms that do are making a reasonable claim and you should weigh it. What we offer instead is that the audit is performed by the firm that afterwards has to quote the instrument, which means a missed economic flaw becomes our inventory problem rather than a footnote in a report.
What does a smart contract audit cover?
Review of the contract against the standard vulnerability classes: access control, arithmetic handling, reentrancy, upgrade and proxy paths, external call safety, and whether privileged functions can be used in ways the documentation does not describe. The output is a findings list by severity with the reasoning for each.
What is the difference between a security audit and a tokenomics audit?
A security audit examines the code. A tokenomics audit examines the economic design: supply mechanics, unlock timing, emissions against plausible demand, and float composition. A token can pass a security audit cleanly and still be structurally unsellable because the second review was never done.
What happens after the audit?
Findings are remediated and re-reviewed. Then, for most auditors, the engagement ends. For us the next stage is usually making the market in the instrument, which means anything missed at the economic review stage becomes a problem we carry rather than one we handed over.
Who audits the market, not just the contract?
Almost nobody, which is the gap. A clean contract with a manipulated order book is not a safe instrument. Our surveillance work covers the market side continuously after launch, so the contract review and the market monitoring are parts of the same engagement rather than separate purchases.
What you receive
- Findings list by severity with reasoning, and remediation re-review
- Economic review covering supply, unlocks, emissions and float
- Anonymised context on the vulnerability classes we see most often
- Continuity into surveillance once the instrument is trading
How we engage
Engagements begin with a conversation about the instrument, the venues involved and what you are trying to achieve, followed by a written scope. Terms, including how we are compensated, are disclosed in summary before anything is signed.
We do not publish pricing, because scope varies enough that any number on a page would be wrong. Ask and we will tell you.
An auditor who never trades the instrument is never contradicted by it. We make the market afterwards, so an economic flaw we missed shows up on our own book first.