Three levels
- Security record: everything Trustblock holds about one project’s security.
- Security report: any document in a record written by a party other than Trustblock and the project’s team. Today: audit reports, plus automated scans and off-chain penetration tests, which are kept out of the counts. Later, each in its own section with its own count: automated scans, risk assessments, penetration tests, internal reviews (the project’s own), KYC checks, post-mortems.
- Audit report: the only kind counted as “audits” today.
Definition and criteria
An audit report is a public report in which a party other than the project’s team (a firm, a team assembled by an audit platform, or individual researchers) reviews or verifies the project’s smart contracts or protocol code as of a stated date, commit or deployed address. “Audit” is the industry’s usual word for this work. Trustblock does not treat an audit as a certification: it covers the code as of that date.The criteria, all observable:
- The author is not the project’s team.
- The subject is the project’s smart contracts or protocol code. A review of an app, a wallet front end or a server is a penetration test, not an audit.
- The report names a date, a commit or a deployed address.
- The report is public.
- It was commissioned by the project or on its behalf. Unsolicited reviews are not listed.
Types
Every audit report has exactly one type. The type describes how the work was done. Beside it, Trustblock shows the firm’s own word for the report, as data: Audit · firm’s term: security review. The firm’s word is taken from the report’s cover or title first, then its file name. A web address is not shown as the firm’s word: it names a section of the firm’s site, not the report. Where no word is found, nothing is shown.
Firms are named below in alphabetical order. The lists are not a ranking.
Audit
The usual form: a firm, a team assembled by an audit platform, or individual researchers review the code under an agreed scope and period, and are paid a fee. What firms call it: audit, security review, security assessment, code review, collaborative audit. Firms with at least 10 audit reports of this type on Trustblock: ABDK Consulting, Ackee Blockchain Security, Cairo Security Clan, Cantina, CertiK, Certora, CFG Ninja, ChainSecurity, CODESPECT, Coinsult, Consensys, Cyberscope, Cyfrin, EtherAuthority, Extropy, GuardGate, Guardian Audits, Hacken, Halborn, HashEx, Hexens, Nethermind Security, Oak Security, OpenZeppelin, OXORIO, Paladin, Pashov Audit Group, PeckShield, Quantstamp, QuillAudits, Resonance Security, Revoluzion, SecureWise, Sigma Prime, SolidProof, Vital Block Security, Zellic, Zokyo, and 15 other firms.Audit competition
Many researchers review the same code in a fixed window, usually open to all. Most of the pay is a share of a set pool, split by valid findings; some roles are paid a fixed fee. What firms call it: audit contest, audit competition, competitive audit. On Trustblock: Cantina. Examples of other competition platforms: CodeHawks, Code4rena, Hats, Immunefi, Sherlock.Formal verification
Machine-checked verification of stated properties of the code. What firms call it: formal verification report. On Trustblock: CertiK, Certora. Examples of other formal verification firms: Runtime Verification, Veridise.Placement rules
The report’s own description decides, never Trustblock’s judgment.- Manual review plus formal verification in one report (for example Certora’s “-FV-MR” reports): type audit, with the attribute “includes formal verification”.
- Fuzzing or invariant campaigns: audit.
- A mitigation or fix review run as a competition (a Code4rena restricted competition, a Sherlock lead review): audit competition, with the attribute “version of” the original report.
- A report published from a guarded launch takes the type of its review. The launch program itself is not a report.
- Joint reports by several firms are counted once for the project and shown on each firm’s page (until co-authors are recorded, on the first-named firm’s page).
Versions and series
These are attributes of an audit report, not types.- Version of: a v2, final, fix review or mitigation review is merged into the earlier report only when the report itself names that earlier report (same firm, same scope). Never by how close the dates are. Numbered titles (“Audit 2”) and product versions (“v3”) are not merged. A fix review whose original Trustblock does not hold stays listed alone, marked “fix review”.
- Part of a series: recurring reports from one standing engagement stay counted, since each covers different code, and are grouped on the page: “75 audit reports, 72 in CertiK’s retainer series”.
- Includes formal verification: a report of type audit that also verifies stated properties by machine.
Counting
- The unit is one published audit report, after named versions are merged. Trustblock says “N audit reports” everywhere: the front page, tables, project pages, the label, the widget, the API and llms.txt.
- The large counts on some projects are series: they are grouped on the page, not merged.
- Page titles keep the word “audits”: “{Project} audits: {N} audit reports by {F} security firms”. Each report’s line shows its date, and its commit where Trustblock holds it.
What is not an audit
These can be part of a project’s security record, but they are not audit reports and are not counted as audits:- Automated scans.
- Bug bounties: a bounty program is not a report. A disclosed bounty finding goes in the record, not in the count.
- Risk assessments.
- Penetration tests of off-chain systems: an app, a wallet front end or a server.
- The project’s internal reviews: written by the project’s own team.
- KYC checks.
- Post-mortems.