Invariant and fuzz testing
We write down the properties your system must hold and test them with stateful invariant suites and fuzzing in Foundry.
Pre-audit hardening for smart contracts
Audits are expensive and time-boxed. Every hour an auditor spends on a missing test, an unchecked return value or a rounding error that a fuzzer would have caught is an hour not spent on the issues only an expert can find. Pre-audit hardening clears that ground first.
This is not a security audit and does not replace one. It prepares your code so the audit can focus on the deeper issues.
01 / WHO THIS IS FOR
Who this is for
- Teams with an audit booked in the coming weeks
- Codebases that grew fast and have thin or uneven test coverage
- Teams that want the audit report to be about the hard problems, not the basics
02 / WHAT WE DO
What we do
Static analysis
Slither and Aderyn, with every result triaged as a real issue, a false positive or an accepted design decision.
Test gap review
Line and branch coverage, plus mutation testing on the critical paths to find tests that cannot fail.
Fixes
Issues we find are fixed with minimal changes and regression tests, or documented for your team to decide on.
Documentation for the auditors
Architecture notes, known risks and the list of invariants, so the auditors start with context instead of guessing.
03 / HOW IT WORKS
How it works
- 01ScopeAccess to the repository, a frozen commit and a fixed quote.
- 02HardeningTwo to four weeks of testing, analysis and fixes, depending on the size of the codebase.
- 03ReportFindings, the static analysis triage and the remaining risks, in writing.
- 04HandoverEverything merged into your repository and ready to send to the audit firm.
04 / WHAT YOU GET
What you get
| DELIVERABLE | FORM |
|---|---|
| New invariant, fuzz and regression tests in your repository | Repository |
| Fixes for the issues found, each in its own commit | Repository |
| A report with the findings, the static analysis triage and the remaining risks | Document |
| Documentation for the auditors | Document |
05 / RELATED WORK
- Money market (open source), with a mutation pass over every rounding site
- Every rounding direction is a solvency decision
06 / FAQ
Questions about pre-audit hardening
Is this a security audit?
No. It is preparation for one. If your contracts will hold user funds, you should still get an independent audit.
Will it reduce the cost of my audit?
The initial quote is usually set by code size and complexity, so it rarely goes down. What a hardened codebase helps avoid is the extra cost: longer fix reviews, additional review rounds, or a second audit when the first one finds too much.
Does the code need to be finished?
It works best on a feature-complete codebase that is close to the audit freeze. Earlier than that, a Protocol Design Review is usually a better fit.
Can you help after the audit too?
Yes. Audit Support & Remediation covers triaging the findings, fixing them and supporting the auditors' fix review.