PENTESTING
Web3 apps still have Web2 attack surfaces. We test both.
Our research looks at the large, underexplored Web2 attack surfaces that remain in many Web3 applications, with white-box or black-box testing based on what you need.
Trusted by teams building the next generation of crypto
HOW WE AUDIT
The engagement
-
01
A scoping call
Tell us your goals, timeline and security needs, and we work out together whether we’re the right fit.
-
02
MNDA and repositories
Under an MNDA, we review the repositories in scope to understand your project and what you’re asking for.
-
03
A clear quote
Pricing follows the expected duration, the potential vulnerabilities and how complex the system is.
-
04
The audit
Researchers start work, raise findings as they appear and come to you with questions along the way.
-
05
Your report
You receive the written findings with suggested fixes, and we stay close after it ships.
FAQ
Pentest questions
Is it only manual review?
No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.
What does OtterSec audit?
Protocol code, infrastructure and ecosystem integrations: Layer 1 foundations, wallets, DeFi protocols, bridges, compilers, ZK systems and Web2 backends, across Solana, EVM, Sui, Aptos, Cosmos, NEAR, Stellar and more.
How does an audit start?
With an initial discussion of your goals, timeline and security needs to see whether we’re a fit. We then send an MNDA and review the repositories in scope.
Who have you worked with?
Teams including Solana, Tether, Sui, Aptos, Circle, Movement, LayerZero, Wormhole, MetaMask, Jupiter, Pyth, Phantom, Jito and Backpack.
What if we are mid-incident?
As members of Seal 911 we join war rooms and work incidents even when the affected parties aren’t our clients. Teams shouldn’t have to make even more hard decisions during an active exploit, so our $1 post-hack audit lets us help when they need it most.
PENTEST
Find the Web2 holes before an attacker does
Tell us your stack and your timeline. We’ll scope white-box or black-box testing to fit.
Get an audit