Nine disciplines for systems that hold value.
Compare services
Which service examines which layer.
| Service | Contract codeSolidity, Rust, Move programs2 primary | Protocol design and economicsAccounting, incentives, oracles2 primary | Governance and keysRoles, multisigs, timelocks, signers2 primary | Cross-chain messagingBridges, relayers, verifiers1 primary | Off-chain infrastructureFrontends, APIs, RPC, cloud1 primary | Users and walletsSigning flows, approvals, phishing2 primary | Post-deployment activityTransactions, events, fund flows4 primary | Assets and liabilitiesReserves, custody, attestations1 primary |
|---|---|---|---|---|---|---|---|---|
| Smart Contract Auditing | Primary focus | Primary focus | Supporting context | Primary focus | Not covered | Not covered | Not covered | Not covered |
| Formal Verification | Primary focus | Supporting context | Supporting context | Supporting context | Not covered | Not covered | Not covered | Not covered |
| Penetration Testing | Not covered | Not covered | Supporting context | Supporting context | Primary focus | Primary focus | Not covered | Not covered |
| Continuous Monitoring | Supporting context | Supporting context | Primary focus | Supporting context | Not covered | Supporting context | Primary focus | Supporting context |
| Incident Response | Supporting context | Not covered | Supporting context | Supporting context | Supporting context | Supporting context | Primary focus | Not covered |
| Threat Intelligence | Supporting context | Supporting context | Supporting context | Supporting context | Supporting context | Primary focus | Primary focus | Not covered |
| AML & Compliance | Not covered | Not covered | Not covered | Not covered | Not covered | Supporting context | Primary focus | Not covered |
| Proof of Reserves | Not covered | Not covered | Supporting context | Not covered | Not covered | Not covered | Supporting context | Primary focus |
| Security Advisory | Supporting context | Primary focus | Primary focus | Supporting context | Supporting context | Supporting context | Not covered | Not covered |
Primary focus: examined directly and reported on Supporting: used as context, findings referred on Not covered by this service
A source-level security review of smart contracts and the protocol logic they implement. Reviewers reconstruct the intended behaviour from specifications and code, then test it against adversarial conditions: privileged roles, external calls, price inputs, upgrade paths and economic incentives. Every reported issue is reproduced or reasoned to a concrete exploit path before it is classified.
- Manual line-by-line review
- Invariant fuzzing
- Economic attack modelling
- Fix verification
Primary layers: Contract code, Protocol design and economics, Cross-chain messaging
Applicable systems
- EVM contracts in Solidity and Vyper
- Solana programs in Rust and Anchor
- Move-based modules
- Upgradeable proxy systems
- DeFi protocols: lending, AMMs, vaults, staking, bridges
- Token, governance and treasury contracts
Key assessment areas
- Business logic and specification conformance
- Access control and privileged functions
- Reentrancy and external call ordering
- Oracle and price manipulation
- Arithmetic, precision and rounding
- Upgradeability and storage layout
- Economic and incentive attack surfaces
- Cross-contract and integration risk
Typical deliverables
- Scope definition with commit references
- Findings classified by severity and likelihood
- Proof-of-concept tests for material findings
- Remediation guidance per finding
- Fix review against a remediation commit
- Final report suitable for publication
Formal verification expresses critical requirements as mathematical properties and uses tooling to check them against the implementation for all reachable states within a defined model. It complements manual review: it does not replace it. The value lies in writing the right properties, stating the assumptions explicitly, and reporting exactly what was and was not proved.
- Formal specifications
- SMT-based proving
- Bounded model checking
- Counterexample analysis
Primary layers: Contract code
Applicable systems
- Core accounting and solvency logic
- Token and vault share mechanics
- Lending and liquidation engines
- Governance and timelock state machines
- Bridge message validation
- Protocol upgrades with invariant-preserving requirements
Key assessment areas
- Formal specification of protocol requirements
- State invariants and conservation properties
- Safety properties across state transitions
- Model checking of bounded behaviours
- Equivalence checking between versions
- Explicit modelling assumptions and limits
Typical deliverables
- Written specification of properties in plain language and formal notation
- Verification harnesses and rules, handed over for reuse
- Results per property: proved, violated or inconclusive
- Counterexamples with reproduction steps
- Statement of assumptions and verification scope
Blockchain Penetration Testing
Authorised testing of the infrastructure around your contracts.
Most losses in Web3 do not start in a contract. Penetration testing examines the off-chain systems that build transactions, hold keys, serve users and connect to nodes. All testing is conducted under a written authorisation that defines targets, techniques, timing and contacts, and nothing outside that scope is touched.
- Signing-flow testing
- API and auth testing
- Cloud and CI/CD review
- RPC hardening
Primary layers: Off-chain infrastructure, Users and wallets
Applicable systems
- Web3 frontends and dApp interfaces
- Public and internal APIs
- Wallet integrations and signing flows
- Authentication and session management
- Cloud infrastructure and CI/CD pipelines
- RPC endpoints and node infrastructure
- Backend services, indexers and relayers
Key assessment areas
- Transaction construction and signing integrity
- Frontend supply chain and script integrity
- Authentication, authorisation and session handling
- API input validation and business logic
- Secrets management and key exposure
- Cloud configuration and network exposure
- RPC and node hardening
Typical deliverables
- Rules of engagement and authorisation record
- Findings with evidence, impact and reproduction steps
- Risk-ranked remediation plan
- Retest of remediated findings
- Executive and technical reports
An audit describes a system at a point in time. Monitoring watches what happens once it is deployed. We design detection logic from the protocol’s threat model, tune it against historical activity to keep noise low, and route alerts to the people who can act on them. The console on this page runs recorded investigations from Quantix Protocol Research.
- Privileged-operation rules
- Event and trace decoding
- Anomaly thresholds
- Incident replay
Primary layers: Governance and keys, Post-deployment activity
Applicable systems
- Deployed protocol contracts
- Multisig and governance executors
- Treasury and fee-collection addresses
- Proxy admin and upgrade paths
- Oracle feeds and price dependencies
- Bridge and cross-chain message flows
Key assessment areas
- Privileged contract operations
- Smart contract event streams
- Treasury and large-value movements
- Contract upgrades and admin changes
- Suspicious transaction patterns
- Protocol risk indicators
Typical deliverables
- Monitoring design derived from the threat model
- Detection rule set with thresholds and rationale
- Alert routing and escalation runbook
- Periodic tuning and coverage review
During an incident the first hours decide how much can be contained and what evidence survives. Quantix provides technical analysis to help teams understand what happened, how, and what can still be done. Engagement depends on availability at the time of request; response times are agreed per engagement and are not guaranteed through this website.
- Transaction reconstruction
- Fund-flow tracing
- Root-cause analysis
- Containment planning
Primary layers: Post-deployment activity
Applicable systems
- Exploited or suspected-compromised contracts
- Compromised keys and signing infrastructure
- Frontend or DNS compromise
- Bridge and cross-chain incidents
- Governance and admin-key misuse
Key assessment areas
- Initial incident triage
- Transaction reconstruction
- On-chain fund tracing
- Attack-path analysis
- Evidence preservation
- Containment recommendations
- Root-cause assessment
Typical deliverables
- Triage summary and immediate recommendations
- Annotated transaction timeline
- Fund-flow trace with address annotations
- Root-cause analysis
- Post-incident report and hardening plan
Threat intelligence connects what attackers are doing across the ecosystem to the specific exposure of your protocol. Quantix analysts study exploit techniques, malicious contract patterns, phishing infrastructure and fund-laundering paths, then map them to your architecture as prioritised briefings, detection rules and hardening actions.
- Technique tracking
- Indicator development
- Exposure mapping
- Analyst briefings
Primary layers: Users and wallets, Post-deployment activity
Applicable systems
- DeFi protocols and their integrations
- Wallets and front-end infrastructure
- Bridges and cross-chain messaging
- Exchanges and custody providers
- Security operations teams
Key assessment areas
- Exploit technique tracking
- Malicious contract and approval patterns
- Phishing and drainer infrastructure
- Pre-attack on-chain indicators
- Laundering paths after an incident
- Exposure mapping to your architecture
Typical deliverables
- Threat landscape briefing for your stack
- Indicator sets and detection rules
- Exposure assessment with prioritised actions
- Periodic intelligence reports
Transaction risk analytics combines address classification, exposure scoring and graph analysis of fund flows. It supports onboarding decisions, investigations and reporting obligations by showing how an address relates to known risk categories, through which paths, and with what confidence.
- Address classification
- Exposure scoring
- Fund-flow graphs
- Case reporting
Primary layers: Post-deployment activity
Applicable systems
- Exchanges and on/off-ramps
- Custodians and payment providers
- DeFi front ends with screening obligations
- Treasury and investigations teams
Key assessment areas
- Wallet risk assessment
- Address classification
- Direct and indirect exposure
- Transaction-flow analysis
- Entity relationship mapping
- Suspicious activity indicators
Typical deliverables
- Address and wallet risk reports
- Fund-flow investigation reports
- Screening policy and threshold design
- Analyst workspace access with the Quantix graph
A credible proof of reserves needs both sides of the balance sheet. Quantix designs and reviews the technical process: how custodied assets are attested and tied to on-chain balances, how customer liabilities are committed to in a Merkle tree that each user can verify, and what the result does and does not prove.
- Merkle liability trees
- Address-ownership proofs
- Balance reconciliation
- Coverage reporting
Primary layers: Assets and liabilities
Applicable systems
- Centralised exchanges
- Custodians and wallet providers
- Stablecoin and tokenised-asset issuers
- Lending desks
Key assessment areas
- Asset attestation and address ownership
- Liability tree construction
- Merkle inclusion proofs
- Reserve coverage computation
- Custodian verification
- On-chain balance analysis
Typical deliverables
- Verification methodology document
- Liability tree and proof specification
- Independent recomputation of reserve coverage
- User-facing verification tool review
Advisory work brings security reasoning into design decisions before code is written or before an architecture becomes hard to change. It covers protocol design, key management, governance, infrastructure and development practice, and produces decisions and documents the team can keep using.
- Threat modelling
- Architecture review
- Key-management design
- Security roadmaps
Primary layers: Protocol design and economics, Governance and keys
Applicable systems
- Protocols in design or pre-audit stages
- Key-management and custody architectures
- Governance and upgrade frameworks
- Cross-chain and bridge designs
- Security programmes for growing engineering teams
Key assessment areas
- Protocol architecture review
- Threat modelling
- Secure development practices
- Key-management architecture
- Governance security
- Infrastructure risk assessment
- Security-readiness planning
Typical deliverables
- Architecture review memo
- Threat model with prioritised mitigations
- Key-management and governance recommendations
- Audit-readiness checklist
- Security roadmap
Combining services
Most engagements start with one question: what would hurt most if it failed?
Before launch
Advisory during design, a smart contract audit on the release commit, and formal verification for the accounting core.
Before a major upgrade
A differential audit of the changes, a review of the upgrade path itself, and updated monitoring rules for the new code.
After deployment
Penetration testing of the frontend and signing infrastructure, monitoring of privileged operations, threat briefings and an incident plan.
Not sure which service you need?
Describe the system and what worries you most. We will recommend the smallest combination of services that covers it, and say plainly where one review is enough.