Retainer · From $3,000 / month
Continuous Security Retainer
Point-in-time audits fit a release model nobody uses any more. If you ship weekly, your security posture is decided by the PR merged last Thursday — not by the report from March. A retainer puts a dedicated reviewer inside that loop.
The economics of the audit-per-release model broke some time ago. Teams ship continuously, audits take weeks to schedule, and the gap gets filled with hope. The predictable result is protocols running for months on a report that describes code they no longer run.
A retainer changes the unit of review from 'the protocol' to 'the change'. Every pull request that touches value flows, access control, oracles or upgrade paths gets read by a researcher who already knows your threat model — so review is fast, because the expensive part (understanding the system) is already paid for.
It also changes the relationship. The researcher is in your Slack, sees the design discussion before the code exists, and can say 'that will break the solvency invariant' while it is still a paragraph rather than a merged PR. That is worth more than any report.
Scope of review
What we look at, and what we're looking for.
PR-level review
Every pull request touching value flows, access control, oracles, upgrades or external integrations, reviewed with your threat model already loaded.
Design consultation
Access to the researcher during design, before code exists — the cheapest possible moment to find a structural problem.
Invariant maintenance
Your suite kept current as the protocol evolves, with new properties added for each new mechanism rather than bit-rotting into a broken CI job.
Dependency & upgrade watch
Monitoring of the libraries and protocols you depend on, and review of every upgrade transaction before it is signed.
Priority incident response
First call on researcher time when something looks wrong, without emergency-rate pricing or a scheduling negotiation.
Quarterly threat-model refresh
A standing review of whether the threat model still describes the system you now have — because after two quarters of shipping, it usually does not.
In practice
What continuous review actually catches
Code on this page is written to illustrate a technique or a finding class. It is not taken from any client engagement.
// ILLUSTRATIVE — a diff that passes CI and breaks an invariant.
// This is the class of change a point-in-time audit structurally cannot see.
function _accrue() internal {
uint256 elapsed = block.timestamp - lastAccrual;
- uint256 interest = (debt * rate * elapsed) / (365 days * 1e18);
+ // "gas optimisation": reorder to divide first
+ uint256 interest = (debt * rate) / 1e18 * elapsed / 365 days;
debt += interest;
lastAccrual = block.timestamp;
}
// Tests pass: the values agree at the magnitudes the tests use.
// The invariant suite does not: at small `debt`, the first division
// truncates to zero and interest stops accruing entirely — a free
// loan for anyone who borrows below the threshold.
//
// Caught in review because the reviewer already knew the accrual
// identity was load-bearing. That context is what a retainer buys.From $3,000 per month, priced on PR volume and protocol complexity. Most teams shipping weekly land between $3,000 and $8,000. Cancel with 30 days' notice — we would rather you leave easily than stay because the exit is awkward.
An audit is a deep read of a fixed commit, ending in a report. A retainer is continuous coverage of change: PR review, design input, invariant maintenance and priority incident response. Most teams need both — an audit before a major launch, a retainer for everything between.
One working day for standard PRs, same day for anything flagged urgent. Speed is possible because the researcher already holds your threat model; that context is most of the cost of any review, and a retainer amortises it.
Yes. You get a dedicated reviewer and a briefed backup, both of whom know your codebase. Rotating strangers through a retainer defeats the entire point, which is accumulated context.
Scoped separately and priced at a reduced rate, because the threat model and much of the system understanding already exist. Retainer clients also get priority scheduling, which matters when your launch date is fixed.
If you are shipping code that holds other people's money, yes — and the smaller the team, the more it tends to matter, because there is usually nobody in-house whose job is to think adversarially. If you are pre-launch and not yet shipping continuously, a single audit plus an invariant suite is the better use of the same budget, and we will tell you that.
Related
Often scoped alongside this.
From $3,000 / month
Send the repo. Scoping is free.
Under two working days to a written scope, a fixed quote and a review plan.