Core engagement · From $8,000 · 3–5 weeks
DeFi Protocol Security Review
DeFi protocols fail in two ways: the code does something it shouldn't, or the code does exactly what it should and the economics still collapse. We review both — value flows, oracle dependencies, liquidation mechanics and accounting invariants, under the market conditions an attacker chooses.
A DeFi review is a superset of a contract audit. Everything in a standard audit still applies, and then we model the protocol as an adversary with capital: flash loans, favourable ordering, control of a pool, and the ability to pick the moment.
The questions that matter are rarely about a single function. Can I move the price this contract reads, inside one transaction? What happens to the liquidation queue when the underlying gaps 40% in a block? Does the share price go up in a way that lets me redeem more than I put in? Is there a sequence of individually-correct operations whose composition is insolvency?
That is why this engagement always includes an invariant suite. Some properties — solvency, conservation of value, monotonic share price — cannot be argued into safety by reading. They have to be searched for counterexamples.
Scope of review
What we look at, and what we're looking for.
Oracle dependency
Every price read, traced to its source. Spot-vs-TWAP, staleness and deviation bounds, heartbeat handling, L2 sequencer uptime, and the flash-loan cost of moving each input.
Liquidation mechanics
Incentive sizing, partial-liquidation maths, bad-debt handling, whether liquidations can be blocked or forced, and behaviour under gap moves and gas spikes.
Share & accounting maths
ERC-4626 semantics, rounding direction on every conversion, first-depositor inflation, donation attacks, and the drift that accumulates over thousands of operations.
Interest & fee models
Rate curve behaviour at the boundaries, accrual timing, compounding precision, and what happens when utilisation hits 100% or a market is empty.
MEV & ordering
Sandwich and back-run exposure, slippage and deadline protection, priority-gas games around liquidations, and whether ordering changes any protocol outcome.
Composability risk
Every integrated protocol treated as hostile: what if it pauses, upgrades, returns unexpected values, or is itself exploited while holding your funds?
In practice
The invariant a DeFi review is built around
Code on this page is written to illustrate a technique or a finding class. It is not taken from any client engagement.
// ILLUSTRATIVE — the properties we encode for a lending market
contract LendingInvariants is Test {
// The protocol can never owe more than it holds plus what is owed to it.
function invariant_solvency() public view {
assertGe(
market.totalCollateralValue() + market.reserves(),
market.totalDebtValue()
);
}
// Share price must never decrease outside of a realised loss event.
function invariant_sharePriceMonotonic() public view {
assertGe(vault.convertToAssets(1e18), ghost_lastSharePrice);
}
// No sequence of user actions may leave a position both
// unhealthy and unliquidatable.
function invariant_noStuckBadDebt() public view {
for (uint256 i; i < ghost_positions.length; ++i) {
address p = ghost_positions[i];
if (!market.isHealthy(p)) assertTrue(market.canLiquidate(p));
}
}
}From $8,000, with most full protocol reviews landing between $8,000 and $30,000 depending on lines of code, the number of external integrations and how novel the economic design is. A fork of well-understood code costs less than a new mechanism, because the search space is smaller.
Three to five weeks for a typical lending market, AMM or vault system, including the invariant suite and remediation verification. Perpetuals, options and anything with a novel margin engine usually runs longer — we would rather quote five weeks and be right than three and rush the economics.
Yes. We model attack cost versus profit for the paths that matter: oracle manipulation, liquidation griefing, share-price inflation, incentive extraction and governance capture. Where a finding is purely economic, we say so and quantify it rather than dressing it up as a code bug.
An invariant is a property that must hold no matter what sequence of actions users take — for example, total collateral value always covers total debt. Invariant tests generate random sequences of calls and search for a counterexample. Reading cannot prove these properties over thousands of interleaved operations; searching can find the case where they break.
Yes, and the diff is where we spend our time. Forks are dangerous precisely because the base is well-tested: teams assume the whole thing is safe and the changes get less scrutiny than a greenfield build would. We review the diff adversarially and check every assumption the original design relied on that your changes may have broken.
Yes, as a Very Complex engagement. Margin engines, funding rates, mark-price mechanisms, ADL and insurance funds all get modelled explicitly. These are the highest-difficulty DeFi audits and we scope them accordingly rather than pretending they price like a staking contract.
Related
Often scoped alongside this.
From $8,000
Send the repo. Scoping is free.
Under two working days to a written scope, a fixed quote and a review plan.