OtterSec Get in touch

PENTESTING

Pentesting for the code around your contracts

Our research looks at the large, underexplored Web2 attack surfaces that remain in many Web3 applications, with white-box or black-box testing based on what you need.

$36.82B+On-chain TVL secured
$1.00B+Vulnerabilities patched
120+Projects audited
Public audits Request a quote

Trusted by teams building the next generation of crypto

Public audit reportsSeal 911 membersSolana · EVM · Sui · Aptos · Cosmos · NEAR

WHY OTTERSEC

What you get

  1. Help during an active exploit through Seal 911 and the $1 post-hack audit.
  2. Researchers who audited Solana’s core code and have secured Sui since pre-mainnet.
  3. A team that stays close after the report ships and supports your community.
  4. A public report history at osec.io/audits you can check before you hire us.
  5. Coverage across Solidity, Vyper, Solana Rust, CosmWasm, Go, Move, JavaScript, Circom and Halo 2.

FAQ

Pentest questions

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

What does OtterSec audit?

Protocol code, infrastructure and ecosystem integrations: Layer 1 foundations, wallets, DeFi protocols, bridges, compilers, ZK systems and Web2 backends, across Solana, EVM, Sui, Aptos, Cosmos, NEAR, Stellar and more.

How does an audit start?

With an initial discussion of your goals, timeline and security needs to see whether we’re a fit. We then send an MNDA and review the repositories in scope.

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Do we wait for the final report to see findings?

No. After kickoff we share findings as they emerge and ask questions as needed. The final report collects our findings and suggestions for fixes.

PENTEST

Find the Web2 holes before an attacker does

Tell us your stack and your timeline. We’ll scope white-box or black-box testing to fit.

Get an audit