Blockchain Security Testing
and Smart Contract Audits
Before You Deploy
Blockchain security testing
Manual Smart Contract Audits and Testing for the Whole Web3 Stack
Deployed smart contracts are hard to change and hold value directly, so a single flaw can be costly. iSpyCyber reviews contract code line by line, tests protocol economics and access control, and assesses the wallets, nodes, bridges and web front ends around them. Every finding is validated, risk-rated and delivered with fixes your developers can apply before and after deployment.
Why organisations choose iSpyCyber
Solidity and EVM depth
Line-by-line review of Solidity contracts and EVM behaviour, including upgradeable proxies and inline assembly.
DeFi economics
Oracle manipulation, flash-loan attacks, MEV exposure and incentive flaws that pure code review can miss.
Tool-assisted, human-led
Static analysis, fuzzing and invariant testing support manual review, and every result is confirmed by a reviewer.
Beyond the contract
Wallets, key management, nodes, bridges and dApp front ends are tested as part of one system.
Developer-ready fixes
Precise, code-level remediation with test cases, and verification of the fixed commit.
Continuous validation
Re-review confirms every fix, and iefyx, our AI-native VAPT platform, keeps off-chain exposure visible between engagements.
Coverage
What We Test in Your Blockchain Systems
Our reviewers use the SWC Registry, the OWASP Smart Contract Top 10 and known exploit patterns as a baseline, then look for flaws specific to your protocol.
Smart contract logic
Reentrancy, arithmetic, unchecked calls, denial of service and logic errors against the intended specification.
Access control
Owner and admin privileges, role management, initialisers, timelocks and multisig governance.
Upgradeability
Proxy patterns, storage collisions, initialisation and upgrade authorisation.
DeFi and tokenomics
Oracle and price manipulation, flash-loan attacks, slippage, rounding and reward accounting.
Bridges and cross-chain
Message validation, relayer trust, replay protection and lock and mint accounting.
Wallets and key management
Key generation and storage, signing flows, seed handling, HSM and custody controls.
Nodes and infrastructure
RPC exposure, validator and node configuration, peer-to-peer settings and monitoring.
dApp front ends and APIs
Transaction tampering, signature phishing risks, web vulnerabilities and back-end API flaws.
Signatures and standards
EIP-712 and permit signatures, ERC-20, ERC-721 and ERC-1155 conformance and replay risks.
Methodology
A Proven Six-Phase Testing Methodology
Aligned to the SWC Registry, OWASP Smart Contract Top 10 and EEA EthTrust Security Levels, and tailored to your protocol design and deployment plans.
- OWASP Smart Contract Top 10
- SWC Registry
- EEA EthTrust Security Levels
- NIST SP 800-115
- CVSS 3.1
2–4
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Days 1–2
Scope and plan
Contracts, commit hash, chains, off-chain components and specifications agreed and frozen for review.
Key activities
- Freeze the commit and list contracts in scope
- Collect specifications, diagrams and test suites
- Agree timelines, testnets and communication channels
- Output: Signed scope and frozen commit
02
- Days 2–4
Map and model
Architecture, privileged roles, value flows and trust assumptions mapped and threat-modelled.
Key activities
- Map contracts, dependencies and external calls
- Document roles, privileges and value flows
- Threat-model economic and cross-chain attacks
- Output: Threat model and review plan
03
- Days 3–12
Discover
Line-by-line manual review supported by static analysis, fuzzing and invariant testing.
Key activities
- Manual line-by-line code review
- Static analysis and property-based fuzzing
- Wallet, node and front-end testing where in scope
- Output: Candidate issue list
04
- Days 9–14
Exploit and validate
Impact proven on forked chains or testnets, attack paths chained and false positives eliminated.
Key activities
- Write proof-of-concept exploits on a local fork
- Model economic impact of each attack path
- Rate every finding by severity and likelihood
- Output: Validated, risk-rated findings
05
- Days 14–17
Report and debrief
Audit report and a live walkthrough with your developers, founders and governance leads.
Key activities
- Executive summary for leadership and investors
- Code-level findings with proof of concept
- Live walkthrough and Q&A with your developers
- Output: Audit report and debrief
06
- After remediation
Fix and retest
Review of each fix against the updated commit before deployment.
Key activities
- Developer Q&A while fixes are built
- Review fixes on the updated commit
- Final report noting the reviewed commit hash
- Output: Fix review report
Effort distribution
Where the testing time goes
Most of every audit is spent on manual, line-by-line review and attack modelling by experienced reviewers. Percentages are indicative for a typical smart contract audit.
Quality built into every phase
Every finding reproduced
Critical and high issues are proven with a working test case.
Risk rated in context
Severity reflects value at risk and likelihood of exploitation.
Fixed commit reviewed
Reports name the exact commit hash that was reviewed.
Closure confirmed
Fix review proves each issue is resolved before deployment.
Engagement models
Choose the Testing Approach That Fits Your Risk
Every approach uses the same methodology. The difference is how much context our testers start with, and how deep they can go.
Black box
Deployed contract addresses and public dApp only, simulating an external attacker. Best for assessing live protocols and third-party exposure.
Grey box
Verified source and documentation for contracts, with limited off-chain access. Best for protocol upgrades and focused reviews.
White box
Full repository, specifications, tests and infrastructure access for the deepest coverage. Best for pre-launch audits of DeFi, bridges and custody systems.
Not sure which approach you need?
Our specialists will recommend a scope based on your contracts, chains, value at risk and launch timeline.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear business context for decision-makers, precise technical detail for engineers and evidence your auditors can rely on.
Executive summary
Overall risk posture, key themes and value at risk in plain language for founders, investors and boards.
Technical findings
Every issue with severity, affected contracts and lines, proof-of-concept test cases and clear explanation.
Remediation roadmap
Prioritised, code-level fixes and design recommendations so the highest-impact issues are resolved first.
Retest report
Independent confirmation of which issues are resolved on the named commit, ready to publish or share.
Supports your compliance and assurance requirements
- OWASP Smart Contract Top 10
- SWC Registry
- EEA EthTrust
- ISO/IEC 27001
- SOC 2
- CERT-In guidelines
- DPDP Act 2023
- NIST SP 800-115
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
Blockchain security testing for every industry
FAQ
Blockchain security testing questions, answered
Can’t find what you need? Talk to our security team.
The basics
What is a smart contract audit?
A smart contract audit is a manual, line-by-line review of contract code, supported by analysis tools, that identifies vulnerabilities, logic errors and design weaknesses before or after deployment, and explains how to fix each one.
Which blockchains and languages do you cover?
Our core focus is Solidity and Vyper on Ethereum and other EVM chains, including layer 2 networks. We also assess wallets, nodes, bridges and dApp front ends regardless of chain.
Does an audit guarantee our contracts are secure?
No audit can guarantee the absence of vulnerabilities. It significantly reduces risk, and we recommend combining it with thorough testing, monitoring, bug bounties and re-review after changes.
Working with us
What do you need from us to start?
A frozen commit hash, the contracts in scope, specifications or design documents, the existing test suite and deployment details for any off-chain components.
How long does an audit take?
Most audits take two to four weeks, depending on lines of code, complexity and external integrations. We confirm the timeline once we have reviewed the repository.
Do you review our fixes?
Yes. We review each fix on the updated commit and issue a final report that names the reviewed commit hash.
Get started
Audit Before You Deploy.
Protect the Value You Hold.
Talk to our blockchain security specialists about a scoped smart contract audit or Web3 security assessment.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries