OtterSec Get in touch

SOLANA SECURITY

Your Solana protocol, audited by people who fuzz the validator

We worked extensively with the Solana Foundation on the Solana Core code and Account Compression, then took that knowledge to Marginfi, Jupiter, Jito, Raydium, Squads, Kamino and Pyth.

$36.82B+On-chain TVL secured
$1.00B+Vulnerabilities patched
Public audits Request a quote

Trusted by teams building the next generation of crypto

Audited Solana core codeMaintainers of AnchorSolana · EVM · Sui · Aptos · Cosmos · NEAR

WHAT WE AUDIT

Solana work, end to end

From the runtime and the compiler toolchain to the programs your users touch.

Solana

Solana Core code and Account Compression with the Solana Foundation, plus Marginfi, Jupiter, Jito, Raydium, Squads, Kamino, Pyth and more.

Anchor

We maintain Anchor, the secure-by-default Solana smart contract framework, and publish open-source Binary Ninja tooling for decompiling sBPF programs.

Fuzzing

A core discipline: differential compiler fuzzers for Vyper, transactional fuzzers for Solana validators, rBPF JIT fuzzers and Move VM bytecode fuzzers.

Formal verification

Our own tooling and a novel verification framework for Solana. We also worked with the Aptos core team to formally verify their standard library.

CLIENTS

Solana teams on OtterSec

“As a blockchain, speed, scalability, and security are critical to our everyday operations. OtterSec's responsiveness, attentiveness, and talent are second-to-none when it comes to securing Solana's core code.”
Dominic Tsang Dominic TsangSolana Foundation
“OtterSec is one of the strongest auditors on Solana. Fast, thorough, and a joy to work with. They are the best in the business and I can’t recommend them enough.”
Armani Ferrante Armani FerranteBackpack
“Their website says protecting Blockchain ideas, but their command of JavaScript is impressive. If you've got something that you think would be "too hard for pentesters to understand" - these folks will surprise you. They're not your average pentester.”
Zbigniew Tenerowicz Zbigniew TenerowiczMetaMask

FAQ

Solana audit questions

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Do we wait for the final report to see findings?

No. After kickoff we share findings as they emerge and ask questions as needed. The final report collects our findings and suggestions for fixes.

How is the price worked out?

We quote from the expected duration, the potential vulnerabilities and the overall complexity of your project.

How does an audit start?

With an initial discussion of your goals, timeline and security needs to see whether we’re a fit. We then send an MNDA and review the repositories in scope.

SOLANA

Put the auditors of Solana’s core code on your program

Tell us what you’re building and when you plan to ship. We’ll tell you whether we’re a fit.

Start the conversation