SOLANA SECURITY

Deep Solana expertise, from validators to your program

We worked extensively with the Solana Foundation on the Solana Core code and Account Compression, then took that knowledge to Marginfi, Jupiter, Jito, Raydium, Squads, Kamino and Pyth.

$36.82B+On-chain TVL secured
$1.00B+Vulnerabilities patched

Trusted by teams building the next generation of crypto

Audited Solana core codeMaintainers of AnchorSolana · EVM · Sui · Aptos · Cosmos · NEAR

HOW WE AUDIT

How a Solana audit runs

  1. 01

    Talk it through

    A first conversation about what you’re building, when you need it secured and what worries you most.

  2. 02

    Look at the code

    We sign an MNDA and read the in-scope repositories before committing to anything.

  3. 03

    Agree the scope

    You get a quote sized to duration, likely vulnerabilities and overall complexity. No guesswork.

  4. 04

    Findings as they land

    Once we kick off, issues reach your team as we find them, not weeks later.

  5. 05

    Report and fixes

    A final report with every finding and our suggestions for fixing it.

CLIENTS

Solana teams on OtterSec

“As a blockchain, speed, scalability, and security are critical to our everyday operations. OtterSec's responsiveness, attentiveness, and talent are second-to-none when it comes to securing Solana's core code.”
Dominic Tsang Dominic TsangSolana Foundation
“OtterSec is one of the strongest auditors on Solana. Fast, thorough, and a joy to work with. They are the best in the business and I can’t recommend them enough.”
Armani Ferrante Armani FerranteBackpack

FAQ

Solana audit questions

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Do we wait for the final report to see findings?

No. After kickoff we share findings as they emerge and ask questions as needed. The final report collects our findings and suggestions for fixes.

How is the price worked out?

We quote from the expected duration, the potential vulnerabilities and the overall complexity of your project.

What happens after the report?

We’re not done when your report ships. We stay close with our clients, support their communities and build long-term relationships around stronger security.

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

SOLANA

Put the auditors of Solana’s core code on your program

Tell us what you’re building and when you plan to ship. We’ll tell you whether we’re a fit.

Start the conversation