Security for the systems that deploy, operate, and protect your protocol — CI/CD pipelines, signing keys, nodes, and privileged ops. We audit Web3 infrastructure around your contracts, not traditional web2 enterprise IT.
Most protocol losses are not novel smart contract bugs — they come from leaked deployer keys, compromised CI/CD, unsafe mainnet promotion, or privileged bots and admin access. A clean contract audit does not help if the pipeline that ships bytecode or the wallet that controls upgrades is exposed.
We review the operational layer your team relies on at launch and in production: how contracts are built and promoted, who can sign deployments, how RPC and indexer infrastructure is run, and whether secrets, access, and runbooks match the risk of the assets you protect.
Foundry/Hardhat scripts, GitHub Actions, environment gates, bytecode verification, and mainnet promotion workflows
Deployer wallets, multisig setup (e.g. Safe), HSM/Web3Signer usage, and separation of testnet vs mainnet keys
Validator and RPC infrastructure, private endpoints, signing on nodes, and rollout practices for client upgrades
Subgraphs, custom indexers, relayers, and backends that hold keys or trigger on-chain actions
GitHub/cloud IAM around protocol repos, secrets managers, RPC URLs, and admin access to production systems