Four documents come out of the two weeks. What we look at and what you receive are the same list, read from opposite ends. You keep all four. Even if you never speak to us again.
What each document is built from:
Every assumption we could break, with severity and the constraint that must hold: trust boundaries between smart contracts, who holds admin keys and upgrade rights, and where the economic mechanism fails under stress.
Who can act when something goes wrong, through which path, and how fast: pause authority, the multisig or timelock behind it, upgrade and migration routes, and what the protocol does in degraded mode.
The outside systems whose failure becomes yours, and your cap on each: oracles and price feeds, bridges and cross-chain integrations, keepers, relayers and the sequencer.
Decisions still reversible today, each with the point after which it is not: invariants the spec leaves unstated, parameters and thresholds nobody has justified, and the mainnet deployment sequence.
Two pages out of the four documents. The structure is what every review produces; the figures here are illustrative.
The gap is the point. Two smart contracts, the one holding user balances and the one holding liquidity, are controlled by the same key that deployed them, and the right-hand column says how long that stays fixable.
Every finding carries what it is, how far it reaches, what it takes to fix, and the date after which fixing it stops being cheap.
That is deliberate. Days three to seven are one engineer alone with the repo, the deploy scripts, and whatever documentation stopped being true a few months ago. Interrupting that makes the review worse. Your team has better things to do anyway.
One call. Send the repo, any diagrams, and the spec even if it is half-written. What we mostly need to know is which decisions are already frozen.
The reviewer works through the system alone and builds the risk register and the dependency list.
Two hours with your engineers, while findings can still be argued with.
Four documents, walked through once, with open questions ranked by deadline.
Every question in this review is one we had to answer ourselves first. In systems where an outage costs money and an on-chain upgrade cannot be taken back. The person paged at three in the morning was one of us.
CPAYBuilt and operated by our team rather than delivered and handed over. 5+ years in production, with real merchants and users, under irreversible on-chain finality.Read the caseUnder NDAConfidential DEX on BaseAMM and liquidity mechanics under real market pressure, with the intervention paths that go with them. 2.5 years live, under NDA, with zero emergency stops.Read the case
Panther WalletA migration from a non-custodial to a custodial model, carried out under live balances. No loss of funds, and the custody boundary redrawn in production.Read the caseMissing documentation is not a blocker. Its absence is itself one of the things we report on.
Something is built, and some decisions are already frozen. Too early and there is nothing to bite on. Too late and every finding needs a governance vote instead of a pull request.
Signals the review is worth booking now:
Signals it is the wrong step today:
Three endings, and we commit to all three.
The architecture holds. The register becomes the list of constraints that have to stay true after you ship, and the open questions have answers you chose rather than inherited.
A specific set of decisions to reverse before deployment, each with the date after which reversing it stops being an option. Usually a shorter list than teams expect, and usually not the part they were worried about.
Sometimes what has to change does not fit in the window you have. Moving a launch costs a few weeks. Launching into a decision you cannot take back costs the rest of the product's life. We say so, and the review has paid for itself in the saying.
You are buying the list of decisions you can still change. What you do with it is yours.
If yours is not here, ask on the first call. We would rather talk you out of this than sell you a review that does not fit.
