Smart Contract Security Audits for DeFi & Web3
We combine deep EVM expertise with competitive security research experience to help Web3 projects identify critical risks before they become real-world exploits.
What We Can Do
We provide comprehensive security services to help Web3 protocols identify vulnerabilities, reduce risks, and build secure decentralized applications.
Smart Contract Audits
Our researchers perform deep manual reviews of Solidity and EVM-based smart contracts, identifying vulnerabilities in logic, access control, and protocol design
Smart Contract Development
We design and build secure Solidity and EVM-based smart contracts from the ground up, following security best practices and delivering audit-ready, well-tested code.
Economic Attack Research
Beyond code review, we evaluate protocol incentives and economic models to identify risks such as oracle manipulation, price attacks, and accounting vulnerabilities.
Protocol Security Review
We provide comprehensive security assessments for blockchain protocols, covering architecture, integrations, upgrade mechanisms, and critical trust assumptions.
Vulnerability Research
Our team conducts independent security research and vulnerability discovery, helping projects understand emerging threats in the Web3 ecosystem
Pre-Mainnet Security Review
We help early-stage projects identify critical security issues before deployment, protecting user funds and building confidence with the community.
Worked with
Latest articles
View all posts →- Web3 Security
Argent-Style Wallet Exploit: Recovery Wrap and Replay
A wrapped recovery deadline and a replayable signed payload cost an Argent-style smart wallet system about $59.8K on Ethereum. How it worked and how to fix it.
- Web3 Security
Trusting an External Contract's Return Value: The Smart Contract Bug That Keeps Draining Vaults
A vault that lets callers pass in their own contract addresses and then books whatever those contracts return is a drain waiting to happen. Here is how this smart contract vulnerability works, why decompiled bytecode still gives it away in minutes, and the checklist PandaSecurity uses when auditing accounting logic.
- Web3 Security
Sui Bridge Claim Bot Sent $392K to the Cetus Attacker
A recovery bot finalized stale Sui Bridge withdrawals and paid 86 ETH, 109K USDT and 0.9 WBTC to the Cetus exploiter. What went wrong and what to fix.
- Web3 Security
KolanHook Exploit: Unguarded Uniswap v4 Buyback Drained ETH
How a permissionless accept() and a buyback with no slippage limit let an attacker drain 2.31 ETH from the KolanHook Uniswap v4 hook on Ethereum.
- Web3 Security
Inside the UNCX Vesting Exploit: How a $87K Hack Came Down to One Missing Subtraction
UNCX's token vesting contract lost roughly $87.7K when an attacker exploited a share-accounting flaw in release(), topUpVesting(), and cancel(). We break down the root cause, the exact attack sequence, and what builders should take away from it — without the jargon.
- Web3 Security
Autheo THEO Exploit: How a Single Trusted Relayer Key Drained $1.76M on Base
Autheo’s THEO token lost 92% after attackers used a Hyperlane TrustedRelayerIsm misconfiguration to mint 19 million unbacked tokens on Base and extract roughly $1.76 million. Here’s how the attack worked and why single-key security models remain dangerous for cross-chain assets.
- Web3 Security
Uniswap v4 Hooks: How They Work and Where They Break
Uniswap v4 hooks explained: the PoolManager singleton, flash accounting, and what the Cork and Bunni exploits teach us about hook security. A PandaSecurity deep dive.
- Web3 Security
How One Wei of Shares Drained 14,838 DAI: A Uniswap V4 Vault Exploit
An attacker forced a Uniswap V4 vault into a zero-liquidity state, redeemed one minimal share unit, and withdrew roughly 14,838.47 DAI. Panda Security breaks down the transaction, vulnerable code, root cause, and practical fixes.
Secure Web3 protocols
Advanced smart contract audits and security research to help blockchain projects identify vulnerabilities and protect user assets.