# DeFi Security Alliance: complete public content index

This file lists the canonical public pages on defisec.info. Page summaries are taken from the pages’ own metadata. Use the canonical page URL as the citation target.

## Core pages

- [Compare 24 Smart Contract Audit Providers | DeFiSec](https://defisec.info/): Review auditor profiles, public audit reports and selection criteria, then submit one request to find a smart contract security provider for your project.
- [24 Smart Contract Audit Provider Profiles | DeFiSec](https://defisec.info/members): Search 24 DSA auditor profiles with five local filters and compare providers side by side by network, language, service and report availability.
- [156 Web3 Security Tools: Compare & Filter | DeFiSec](https://defisec.info/tools): Compare 156 Web3 security tools across 21 categories. Filter by ecosystem and format, review limitations, and download the source-checked directory.
- [Blockchain Security Articles | DeFi Security Alliance](https://defisec.info/blog): Browse DeFi Security Alliance articles about smart contract auditing, blockchain security, vulnerabilities, audit companies and DeFi risk.
- [33 Smart Contract Security Reports & Analyses | DeFiSec](https://defisec.info/reports): Browse 4 locally hosted PDFs and 23 company analyses with named organizations, technologies, review dates and source-status details.
- [Auditor Selection and Security Review Methodology | DeFiSec](https://defisec.info/methodology): Seven weighted criteria, independent reviewers, evidence, and conflicts.
- [Analysis of Audit Companies](https://defisec.info/analysis_of_audit_companies): DSA presents a unique series of reports on the smart contract and blockchain app auditor market. This report is published for the first time and is not affiliated with any specific vendor. The DSA expert team has performed an in-depth analysis of the blockchain security providers in the market. For that, a methodology was developed, and specific criteria were selected.
- [Audit Builder: Historical App and Report Workflow | DeFiSec](https://defisec.info/audit_builder): Review Audit Builder report workflows and archived plans. The former hosted application is unavailable; current login and report creation cannot be verified.
- [A Comprehensive Guide to Smart Contract Auditing](https://defisec.info/guide_to_smart-contract-auditing): Decentralized finance (DeFi) offers lucrative opportunities somewhat unavailable in the traditional centralized system. In this blockchain-based environment, almost anyone can use smart contracts to launch financial applications without a central authority's approval.
- [The Comprehensive Smart Contract Audit Checklist](https://defisec.info/smart_contract_audit_checklist): Blockchain is supposed to be secure for all participants. However, it is not possible if the company does not strictly follow the smart contract audit checklist for blockchain readiness.

## Blog articles

- [ERC2771 Forwarder Security 32 Cases | DeFiSec](https://defisec.info/blog/erc2771-forwarder-security): 12 of 16 context-aware labeled fixtures fall back to the caller in our model. Check suffix trust, signed requests and nested execution separately.
- [Transient Storage Security 32 Cases | DeFiSec](https://defisec.info/blog/solidity-transient-storage-security): 2 of 16 same-transaction owner observations remain nonzero in our model. Test cleanup, rollback and delegated context before choosing temporary state.
- [ERC3156 Flash Loan Security 64 Cases | DeFiSec](https://defisec.info/blog/erc3156-flash-loan-security): 31 of 32 lender-only accepted inputs fail our illustrative borrower policy. Separate callback identity, authorized work and repayment evidence.
- [Governance Timelock Security 60 Cases | DeFiSec](https://defisec.info/blog/governance-timelock-security): 12 of 24 Ready fixtures fail executor or predecessor checks in our source model. Verify controlled authority, cancellation and target execution.
- [ERC7540 Vault Security 8 Preview Reverts | DeFiSec](https://defisec.info/blog/erc7540-vault-security): 12 configuration and preview combinations expose async vault assumptions. Track request control, partial fulfillment and claimable liquidity separately.
- [ERC7201 Storage Security 58 Namespaces | DeFiSec](https://defisec.info/blog/erc7201-storage-security): 20 namespace IDs were added and none removed between two complete library packages. Verify root identity, field compatibility and state meaning.
- [ERC4337 Paymaster Security 64 Fixtures | DeFiSec](https://defisec.info/blog/erc4337-paymaster-security): 32 of 64 artificial fixtures underreserve prefund when postOp gas is omitted. Compare sponsor authority, deposit checks and settlement failures.
- [L2 Sequencer Security 72 Boundary Cases | DeFiSec](https://defisec.info/blog/l2-sequencer-security): 30 up-only states fall outside our complete recovery policy. Test sequencer grace periods separately from price age, feed failures and fallback paths.
- [ERC1271 Signature Validation 24 Cases | DeFiSec](https://defisec.info/blog/erc1271-signature-validation): 5 prefix matches fall outside the pinned verifier's acceptance in our synthetic grid. Check wallet state, response bytes and action authorization.
- [Permit2 Revocation 7 Temporary Blocks | DeFiSec](https://defisec.info/blog/permit2-revocation): 2 of 16 modeled cleanup combinations still block every old route after token reapproval. Separate stored allowances from both Permit2 nonce families.
- [Safe Module Security 6 Execution Routes | DeFiSec](https://defisec.info/blog/safe-module-security): 2 module entrypoints gain guard hooks in Safe v1.5.0. Compare fixed source releases, verify deployed controls and test treasury recovery paths.
- [EIP7702 Revocation 72 Transaction Cases | DeFiSec](https://defisec.info/blog/eip7702-revocation): 4 modeled execution failures still cleared account delegation. Verify code and nonce state, then inspect token approvals and outstanding signatures.
- [ERC4626 Vault Security 400000 Scenarios | DeFiSec](https://defisec.info/blog/erc4626-vault-security): 90,100 of 100,000 deposits minted zero shares at virtual offset 0 in our bounded model. Separate rounding loss from attacker profit and oracle risk.
- [Airdrop Contract Security 26 Archived Tests | DeFiSec](https://defisec.info/blog/airdrop-contract-security): 5 archived cases test replay or exactly once behavior; a narrow keyword scan finds only 1. Review claim data, signatures and post-expiry authority.
- [Auditing AI Generated Smart Contracts 15 Tasks | DeFiSec](https://defisec.info/blog/auditing-ai-generated-smart-contracts): 62 test declarations are visible inside 15 generation prompts. Our corpus census shows why independent requirements, test oracles and run status matter.
- [Bridge Integration Checklist 12 Core Only Chains | DeFiSec](https://defisec.info/blog/bridge-integration-checklist): 41 core entries and 29 token bridge entries differ in our SDK census. Check source identity, receiver policy, limits and recovery before choosing a route.
- [Crypto Security Score 28 Weights No Coefficients | DeFiSec](https://defisec.info/blog/crypto-security-score): 6 categories combine code, governance and other signals. Our methodology census separates disclosed indicators from missing coefficients and project evidence.
- [DeFi Insurance for Protocols 215 Retired Entries | DeFiSec](https://defisec.info/blog/defi-insurance-for-protocols): 259 Nexus product records are not marked deprecated, but that does not establish purchase capacity. Compare wording, exclusions and claims evidence.
- [Emergency Pause Circuit Breakers 4 Library Files | DeFiSec](https://defisec.info/blog/emergency-pause-circuit-breakers): 3 token extensions guard updates, but 0 public pause functions appear in the four-file library census. Review authority, containment and recovery paths.
- [Smart Contract Security Glossary 67 Labels Matched | DeFiSec](https://defisec.info/blog/smart-contract-security-glossary): 199 Ethereum glossary labels were checked against 44 existing articles. Definitions connect permissions, proofs and review methods to their evidence limits.
- [Smart Contract Security Standards 35 Control Docs | DeFiSec](https://defisec.info/blog/smart-contract-security-standards): 11 control families need different evidence. Our OWASP file census shows how to bind requirements to audit scope, deployment assumptions and review results.
- [Token Listing Audit Requirements 3 Custody Risks | DeFiSec](https://defisec.info/blog/token-listing-audit-requirements): All 3 Coinbase custody examples name an issuer mitigation; only 1 also names the exchange. Separate audits, identity checks, locks and listing decisions.
- [Regulated Crypto Developers 19 MiCA Inputs | DeFiSec](https://defisec.info/blog/top-regulated-crypto-developers): 6 application items depend on the service offered. Compare 10 developers for MiCA, crypto trading, custody and regulated DeFi software.
- [Transaction Simulation Security 92 Test Fixtures | DeFiSec](https://defisec.info/blog/transaction-simulation-security): 12 validation and 14 override filename signals appear in our fixture census. Read state assumptions, signature authority and unknown results before signing.
- [Web3 Cybersecurity 3 Pharos Security Pages | DeFiSec](https://defisec.info/blog/web3-cybersecurity-pharos-production): 66 service pages checked: map Pharos Production security work across contracts, applications and cloud, with scope boundaries and evidence to request.
- [Smart Contract Audit Report Examples 10 PDFs | DeFiSec](https://defisec.info/blog/smart-contract-audit-report-examples): 3 of 10 sampled PDFs were standalone fix reviews. Compare scope, findings, limitations and fix logs without treating keyword matches as assurance scores.
- [Fake Audit Report: 6 of 50 Name Commit and Address | DeFiSec](https://defisec.info/blog/fake-audit-report): Verify a smart contract audit PDF: find it on the firm's own domain, match the commit, then match the deployed address and the proxy implementation.
- [Cross chain bridge security 88 Catalog Entries | DeFiSec](https://defisec.info/blog/cross-chain-bridge-security): 37 bridge-flagged records use a bridge-specific failure label. Compare verification models and historical audit evidence without inventing risk rankings.
- [Solana Smart Contract Audit: 28 Extension Types | DeFiSec](https://defisec.info/blog/solana-smart-contract-audit): 19 mint types and 9 account types appear in our pinned registry scan. Scope signer checks, PDA relationships and the token configurations a program accepts.
- [Smart Contract Fuzzing: 12 of 22 Repos Run It | DeFiSec](https://defisec.info/blog/smart-contract-fuzzing): Echidna 2.3.3, Medusa 1.5.1 and Foundry 1.8.1 compared on budgets, shrinking, coverage and Slither, plus which top-30 DeFi repos keep a stateful fuzz suite.
- [Smart contract audit timeline 3 of 23 Firms | DeFiSec](https://defisec.info/blog/smart-contract-audit-timeline): 55 public pages were checked for duration evidence. Separate start availability, review effort, remediation and release verification before promising launch.
- [Smart contract threat modeling 50 Reports Checked | DeFiSec](https://defisec.info/blog/smart-contract-threat-modeling): 1 actual threat-model document in the matched sample covers a non-DeFi system. Build a DeFi workbook with explicit goals, trust assumptions and scope.
- [White Hat Hacker Web3 6 Contact Fields | DeFiSec](https://defisec.info/blog/white-hat-hacker-web3): 20 protocol records yielded 6 security contact fields at the tested route. Check authorization, local proof and payout terms before reporting a defect.
- [DeFi hacks by auditor 913 Rows Without Audit Data | DeFiSec](https://defisec.info/blog/defi-hacks-by-auditor): 1,253 catalog records expose no explicit audit-provenance keys. Cross-check Beanstalk, Nomad and Ronin with report dates and unresolved scope matches.
- [Top 10 Cybersecurity Companies: 1 Lists Prices | DeFiSec](https://defisec.info/blog/top-cybersecurity-companies): Ten security firms ranked for on-chain and off-chain work, with three public report archives counted, a stale one named and the one firm that publishes prices.
- [Protocol Invariants 12 Views 4 Vault Actions | DeFiSec](https://defisec.info/blog/protocol-invariants): 16 IERC4626 functions expose accounting, limits and previews around 4 state changes. Specify AMM, lending and vault properties with explicit boundaries.
- [Crypto Incident Response: 84 Public Log Entries | DeFiSec](https://defisec.info/blog/crypto-incident-response): 10 takeover labels appear in our public-log census. Prepare pause decisions, verified responder contacts and evidence packets before a protocol incident.
- [Perpetual DEX Security: 34/177 Markets Tiered | DeFiSec](https://defisec.info/blog/perpetual-dex-security): 56 delisted entries were excluded from our margin survey. Scope liquidation math, funding settlement and the loss rules that can close profitable positions.
- [RWA Token Security: 14 Direct Role Gates | DeFiSec](https://defisec.info/blog/rwa-token-security): 6 batch wrappers call guarded methods in our T-REX reference scan. Review forced transfers, reserve evidence and the documents defining a holder claim.
- [Security Disclosure Policy: 1 in 30 Meets RFC 9116 | DeFiSec](https://defisec.info/blog/security-disclosure-policy): VDP clauses to copy, a security.txt template, SEAL Safe Harbor steps and CISA response windows, plus the KYC tiers and funded caps that bounty platforms skip.
- [ERC20 Token Audit 20 Compatibility Fixtures | DeFiSec](https://defisec.info/blog/erc20-token-audit): 12 of 20 unusual token fixtures declare approve directly. Build a listing packet that covers allowance behavior, supply controls and integration limits.
- [Rug Pull Scanner Limits 2 Unknown Pool Results | DeFiSec](https://defisec.info/blog/rug-pull-scanner-limits): 10 WETH pool requests returned 8 negative honeypot results and 2 HTTP 404 responses. Preserve unknowns and inspect controls that a snapshot cannot predict.
- [Smart Contract Backdoors 14 Modules Examined | DeFiSec](https://defisec.info/blog/smart-contract-backdoors): 3 of 14 OpenZeppelin token extension modules directly override the balance update hook. Trace admin powers beyond names, badges and scanner labels.
- [Smart Contract Audit Contest: $38,750 Median Pool | DeFiSec](https://defisec.info/blog/smart-contract-audit-contest): Code4rena is winding down. Across 20 finished contests each, the median pool was $38,750 at Code4rena and $152,608 at Sherlock.
- [Formal Verification Smart Contracts 42 Checks | DeFiSec](https://defisec.info/blog/formal-verification-smart-contracts): 18 of 21 Halmos example test files carry local execution options. Read proof assumptions and historical engagement costs before funding verification.
- [Signature Replay Attack: 3 Findings in 155 Audits | DeFiSec](https://defisec.info/blog/signature-replay-attack): Six fields a signed message must bind, and the replay each one blocks. Of 155 member firm reports 31 mention replay and only 3 file it as a finding.
- [Vyper contract audit 18 Compiler Review Entries | DeFiSec](https://defisec.info/blog/vyper-contract-audit): 10 compiler-index filenames identify limited reviews. Scope Vyper builds, nonreentrancy behavior and tool support against the actual deployed artifact.
- [Reentrancy attack 6 Reports With Findings | DeFiSec](https://defisec.info/blog/reentrancy-attack): 36 of 50 public reports mention reentrancy. A reviewed subset separates named findings from checklists and maps callback variants to testable properties.
- [Smart Contract Audit RFP 9 Separate Fix Reports | DeFiSec](https://defisec.info/blog/smart-contract-audit-rfp): 277 of 286 review paths lack an exact separate fix-file pair. Define remediation evidence in the RFP instead of treating archive filenames as coverage.
- [Crypto Team KYC Verification 842 Archive Folders | DeFiSec](https://defisec.info/blog/crypto-team-kyc-verification): 750 of 842 KYC archive folders contain multiple files. Compare identity scope, privacy terms and public prices without mistaking badges for guarantees.
- [Honeypot Token Detection: 55% of Clean Had Switch | DeFiSec](https://defisec.info/blog/honeypot-token-detection): Of 89 tokens that honeypot.is and GoPlus both called clean in our September 2026 run, 49 still gave the owner a switch that can stop selling.
- [MiCA Security Obligations 2 DORA Linked Articles | DeFiSec](https://defisec.info/blog/mica-security-obligations): 149 MiCA articles contain 6 explicit DORA references across Articles 34 and 68. Map entity scope, resilience controls and current authorization evidence.
- [DeFi Hack Post Mortem 191 Recovery Values Unknown | DeFiSec](https://defisec.info/blog/defi-hack-post-mortem): 197 incident records from 2023 had no source URL in the fetched archive. Build a post mortem from primary evidence and a reconciled recovery ledger.
- [Solidity Static Analysis 100 Detectors | DeFiSec](https://defisec.info/blog/solidity-static-analysis): 14 of 29 High impact Slither detectors carry Medium confidence. Separate tool labels, confirmed behavior and suppressions before handing off an audit.
- [Oracle Manipulation Attack: 89% of Feeds Lag 24h | DeFiSec](https://defisec.info/blog/oracle-manipulation-attack): On Ethereum mainnet 220 of 247 Chainlink feeds may sit a full day between updates. Survey figures, feed tables and an auditor checklist.
- [Upgradeable contract audit 36 Report Mentions | DeFiSec](https://defisec.info/blog/upgradeable-contract-audit): 16 sampled archives contain upgrade-related wording. Accept a release through storage compatibility, initializer checks and verified upgrade authority.
- [Tokenomics Audit: 1/16 Sites Named a Service | DeFiSec](https://defisec.info/blog/tokenomics-audit): 7 of 23 member sites were unreadable in our scan. Compare report scope, simulation evidence and provider offers before commissioning a review.
- [Web3 Security Engineer 4 Roles 3 Currencies | DeFiSec](https://defisec.info/blog/web3-security-engineer): 192 public job entries yielded 4 security titles with disclosed base pay. Compare role scope, geography and ownership before budgeting a hire or retainer.
- [Smart Contract Dependency Risk 14 Imported Files | DeFiSec](https://defisec.info/blog/smart-contract-dependency-risk): 4 direct imports expand to 15 source files in a fixed ERC4626 build input. Scope library overrides, live integrations and dependency update evidence.
- [DAO security audit 15 of 50 Reports | DeFiSec](https://defisec.info/blog/dao-security-audit): 10 sampled archives contain governance wording, which does not prove execution coverage. Trace proposal payloads, delegation, timelocks and treasury roles.
- [Smart Contract Monitoring: 8 of 20 Audit Firms | DeFiSec](https://defisec.info/blog/smart-contract-monitoring): Defender shuts down on July 1 2026. Watch admin roles, upgrades and large withdrawals, then derive thresholds from 30 days of your own events.
- [Flash loan attack 4 Labels in 1253 Records | DeFiSec](https://defisec.info/blog/flash-loan-attack): 155 catalog rows use an oracle-manipulation label without proving their financing path. Trace prices, shares and voting power to the lasting claim.
- [Audit Report Explained: 12 Words for One Column | DeFiSec](https://defisec.info/blog/audit-report-explained): Only 26 of 80 published reports say how a severity was reached. Read the scope and dates first, then the severity rule, then who wrote each label.
- [Crypto Due Diligence Checklist: 16/30 Had Links | DeFiSec](https://defisec.info/blog/crypto-due-diligence-checklist): Only 4 of 30 top TVL records named a GitHub organization, and 2 of 19 audit URLs failed retrieval. Follow our live Lido evidence chain.
- [Crypto Bug Bounty Program 8 Vaults Below Caps | DeFiSec](https://defisec.info/blog/crypto-bug-bounty-program): 10 program pages showed 8 vault balances below advertised maxima. Compare displayed funding, payout conditions, KYC and the work needed to run a bounty.
- [Admin key management 43 Reports Mention Privilege | DeFiSec](https://defisec.info/blog/admin-key-management): 16 sampled archives mention privileged roles. Separate signing, upgrades and containment, then verify revocation across wallet modules and controllers.
- [Lending Protocol Audit: 28 Configs Compared | DeFiSec](https://defisec.info/blog/lending-protocol-audit): 92 collateral rows had a positive borrowing-to-liquidation factor gap in our repository scan. Check accounting, oracle evidence and XRPL credit scope.
- [Solana Audit Companies 14 Token2022 Files | DeFiSec](https://defisec.info/blog/top-solana-audit-companies): Seven Token2022 files appear beyond the dated documentation list. Compare 10 firms using opened reports, scope limits and the evidence needed for a recheck.

## Web3 security tool directory

Source review: 2026-09-05. Documentation and provider-page evidence; no runtime or quality benchmark. Canonical directory: https://defisec.info/tools
- [4naly3er](https://defisec.info/tools#tool-4naly3er): Generate a first-pass Solidity findings report for recurring code patterns during audit preparation. Before using: Treat generated findings as review leads, with duplicates and false positives possible. Source: https://github.com/Picodes/4naly3er. Status: documented; checked 2026-09-05.
- [Act](https://defisec.info/tools#tool-act): Write declarative specifications of contract behavior and use them in verification workflows. Before using: A specification must capture intended behavior. Omitted properties remain unchecked. Source: https://github.com/argotorg/act. Status: documented; checked 2026-09-05.
- [Acton](https://defisec.info/tools#tool-acton): Use TON's Acton development toolchain for building and testing smart contract projects. Before using: Match the target language and network settings and add security-specific message-flow scenarios. Source: https://ton-blockchain.github.io/acton/. Status: documented; checked 2026-09-05.
- [Aderyn](https://defisec.info/tools#tool-aderyn): Inspect Solidity source with a Rust-based static analyzer and review findings in the command line or editor. Before using: Confirm compiler and project support before making it a CI gate. Source: https://github.com/Cyfrin/aderyn. Status: documented; checked 2026-09-05.
- [Anchor](https://defisec.info/tools#tool-anchor): Build and test Solana programs with account constraints, interfaces and framework tooling. Before using: Review each account constraint and CPI trust assumption. The framework cannot infer missing authorization rules. Source: https://github.com/otter-sec/anchor. Status: documented; checked 2026-09-05.
- [Ape Framework](https://defisec.info/tools#tool-ape-framework): Use Python accounts, providers, compiler plugins and tests to investigate on-chain applications. Before using: Plugin and provider support determine the available networks and execution environment. Source: https://github.com/ApeWorX/ape. Status: documented; checked 2026-09-05.
- [Aptos CLI](https://defisec.info/tools#tool-aptos-cli): Compile, test and interact with Aptos Move packages through the official command-line interface. Before using: Deployment and test success do not replace a review of capabilities and module invariants. Source: https://aptos.dev/build/cli. Status: documented; checked 2026-09-05.
- [ark-r1cs-std (Arkworks)](https://defisec.info/tools#tool-arkworks): Use ark-r1cs-std constraint gadgets for arithmetic and cryptographic operations inside Rust SNARK circuits. Before using: The reviewed README labels this implementation an academic prototype not ready for production. Source: https://github.com/arkworks-rs/r1cs-std. Status: research; checked 2026-09-05.
- [Arkham](https://defisec.info/tools#tool-arkham): Investigate address activity and attributed entities using blockchain intelligence views. Before using: Entity attribution is analytical evidence and should be corroborated before drawing conclusions. Source: https://info.arkm.com/. Status: documented; checked 2026-09-05.
- [Audit Builder](https://defisec.info/tools#tool-audit-builder): Explore DeFi Security Alliance's workflow for preparing, storing and compiling smart contract audit reports. Before using: Confirm current product access and plan terms. Report generation does not validate the underlying findings. Source: https://defisec.info/audit_builder. Status: documented; checked 2026-09-05.
- [AuditBase](https://defisec.info/tools#tool-auditbase): Use a hosted Solidity scanner to collect potential findings and structured risk-report outputs. Before using: Review evidence behind each finding. Generated risk and compliance labels need separate validation. Source: https://www.auditbase.com/. Status: documented; checked 2026-09-05.
- [Bankrun](https://defisec.info/tools#tool-bankrun): Run Node.js Solana tests using a program-test-based local execution environment. Before using: Deprecated. The repository directs users to LiteSVM. Source: https://github.com/kevinheavey/solana-bankrun. Status: legacy; checked 2026-09-05.
- [Blockaid](https://defisec.info/tools#tool-blockaid): Integrate transaction, address and dapp threat screening into a wallet or application workflow. Before using: Detection results depend on integration coverage and provider data. Review false positives and missed threats. Source: https://blockaid.io/. Status: documented; checked 2026-09-05.
- [Blockscout](https://defisec.info/tools#tool-blockscout): Explore EVM transactions, contract source and chain data with a deployable explorer platform. Before using: Features and indexing completeness vary between hosted chain instances. Source: https://docs.blockscout.com/. Status: documented; checked 2026-09-05.
- [BlockSec Phalcon](https://defisec.info/tools#tool-blocksec-phalcon): Configure detection, alerts and response workflows for suspicious on-chain protocol activity. Before using: Response effectiveness depends on chain support, rule configuration, latency and granted permissions. Source: https://blocksec.com/phalcon/security. Status: documented; checked 2026-09-05.
- [Breadcrumbs](https://defisec.info/tools#tool-breadcrumbs): Visualize and trace blockchain activity through an investigation-oriented analytics interface. Before using: Trace availability and community labels do not prove who controls an address. Source: https://www.breadcrumbs.app/. Status: page-only; checked 2026-09-05.
- [Brownie](https://defisec.info/tools#tool-brownie): Build Python-based deployment scripts and tests for contracts targeting the EVM. Before using: Pin compiler and dependency versions so another reviewer can reproduce results. Source: https://github.com/eth-brownie/brownie. Status: documented; checked 2026-09-05.
- [Burp Suite](https://defisec.info/tools#tool-burp-suite): Analyze HTTP traffic and test dapp frontends, backend APIs and authentication flows. Before using: Available automation depends on the edition and HTTP testing does not analyze on-chain execution. Source: https://portswigger.net/burp/documentation. Status: documented; checked 2026-09-05.
- [Caracal](https://defisec.info/tools#tool-caracal): Run static detectors and inspection outputs for Starknet contracts represented in Cairo or Sierra tooling. Before using: Use the release compatible with the project's Cairo representation and compiler artifacts. Source: https://github.com/crytic/caracal. Status: documented; checked 2026-09-05.
- [cargo-audit](https://defisec.info/tools#tool-cargo-audit): Check Rust dependency lockfiles against RustSec advisories as part of a smart contract or infrastructure build. Before using: Only known advisory coverage is checked. Application logic and unpublished vulnerabilities remain outside scope. Source: https://github.com/rustsec/rustsec. Status: documented; checked 2026-09-05.
- [cargo-deny](https://defisec.info/tools#tool-cargo-deny): Apply Rust dependency policies for advisories, licenses, duplicate versions and allowed sources. Before using: Policy configuration determines what is rejected. Passing policy is not a code-security proof. Source: https://github.com/EmbarkStudios/cargo-deny. Status: documented; checked 2026-09-05.
- [cargo-fuzz](https://defisec.info/tools#tool-cargo-fuzz): Create and run fuzz targets for Rust code using the cargo fuzzing workflow. Before using: A target must expose relevant inputs and assert meaningful behavior to detect a security flaw. Source: https://github.com/rust-fuzz/cargo-fuzz. Status: documented; checked 2026-09-05.
- [Certora Prover](https://defisec.info/tools#tool-certora-prover): Express contract rules in CVL and check them with the Certora verification service. Before using: Specifications, summaries and environmental assumptions define what a successful proof establishes. Source: https://docs.certora.com/en/latest/. Status: documented; checked 2026-09-05.
- [ChainGPT Smart Contract Auditor](https://defisec.info/tools#tool-chaingpt-smart-contract-auditor): Generate AI-assisted smart contract review output through the ChainGPT auditor product. Before using: Reproduce findings and inspect missed logic. Model-generated output is not proof of correctness. Source: https://www.chaingpt.org/smart-contract-auditor. Status: documented; checked 2026-09-05.
- [Chainlink Automation](https://defisec.info/tools#tool-chainlink-automation): Trigger contract maintenance or response functions when configured conditions are met. Before using: Automation executes defined logic. A faulty condition or unsafe target can automate the wrong action. Source: https://docs.chain.link/chainlink-automation. Status: documented; checked 2026-09-05.
- [Circom](https://defisec.info/tools#tool-circom): Compile arithmetic circuits into constraint systems and witness-generation programs for ZK review. Before using: Witness generation success does not establish that every security-relevant relation is constrained. Source: https://github.com/iden3/circom. Status: documented; checked 2026-09-05.
- [Circomspect](https://defisec.info/tools#tool-circomspect): Lint Circom circuits and inspect static-analysis warnings about potentially unsafe circuit constructions. Before using: Static checks do not establish that the full circuit expresses the intended statement. Source: https://github.com/trailofbits/circomspect. Status: documented; checked 2026-09-05.
- [CodeQL](https://defisec.info/tools#tool-codeql): Query supported source-code databases for vulnerability patterns in off-chain applications and infrastructure. Before using: Language support is explicit. Do not assume that general CodeQL coverage includes Solidity contracts. Source: https://codeql.github.com/docs/. Status: documented; checked 2026-09-05.
- [Cosign](https://defisec.info/tools#tool-cosign): Sign and verify container or binary artifacts using the Sigstore ecosystem. Before using: A valid signature identifies an artifact and signing identity, not the correctness of its contents. Source: https://github.com/sigstore/cosign. Status: documented; checked 2026-09-05.
- [CosmWasm VM](https://defisec.info/tools#tool-cosmwasm-vm): Execute CosmWasm contract bytecode through the virtual-machine library for controlled testing and integration. Before using: VM execution requires a correctly modeled host environment and external dependencies. Source: https://github.com/CosmWasm/cosmwasm/tree/main/packages/vm. Status: documented; checked 2026-09-05.
- [cosmwasm-check](https://defisec.info/tools#tool-cosmwasm-check): Check a compiled CosmWasm artifact for compatibility constraints before deployment. Before using: Artifact validation is a technical compatibility check, not a review of contract authorization or economics. Source: https://github.com/CosmWasm/cosmwasm/tree/main/packages/check. Status: documented; checked 2026-09-05.
- [Creusot](https://defisec.info/tools#tool-creusot): Write Rust specifications and discharge verification conditions through a deductive verification toolchain. Before using: Unmodeled dependencies and incomplete proofs limit the guarantee for the full application. Source: https://github.com/creusot-rs/creusot. Status: documented; checked 2026-09-05.
- [crytic-compile](https://defisec.info/tools#tool-crytic-compile): Normalize supported smart contract build systems for analysis tools that need consistent compiler artifacts. Before using: An incorrect build selection can produce analysis of a different contract configuration. Source: https://github.com/crytic/crytic-compile. Status: documented; checked 2026-09-05.
- [crytic/properties](https://defisec.info/tools#tool-crytic-properties): Reuse property templates for common Ethereum operations when designing a contract fuzzing harness. Before using: Adapt properties to the token or protocol specification before interpreting failures. Source: https://github.com/crytic/properties. Status: documented; checked 2026-09-05.
- [cw-multi-test](https://defisec.info/tools#tool-cw-multi-test): Simulate interactions among CosmWasm contracts and modules in Rust integration tests. Before using: Simulation does not reproduce every chain-specific module or production execution detail. Source: https://github.com/CosmWasm/cw-multi-test. Status: documented; checked 2026-09-05.
- [Decurity Semgrep Rules](https://defisec.info/tools#tool-decurity-semgrep-rules): Apply smart contract Semgrep rules informed by known DeFi exploit patterns to source-code review. Before using: Rules cover defined patterns. Manually review matches and unsupported syntax. Source: https://github.com/Decurity/semgrep-smart-contracts. Status: documented; checked 2026-09-05.
- [Dedaub Decompiler](https://defisec.info/tools#tool-dedaub-decompiler): Reconstruct readable contract logic from an EVM address or raw bytecode using a hosted decompiler. Before using: The output is an approximation of source code and must be checked against bytecode and traces. Source: https://docs.dedaub.com/docs/decompiler/. Status: documented; checked 2026-09-05.
- [DeFiLlama](https://defisec.info/tools#tool-defillama): Compare DeFi protocol metrics and inspect publicly exposed information during security due diligence. Before using: Financial metrics provide context and do not measure code security or investment safety. Source: https://defillama.com/. Status: documented; checked 2026-09-05.
- [Diligence Fuzzing](https://defisec.info/tools#tool-diligence-fuzzing): Use the Diligence Fuzzing client to prepare and submit contract fuzzing campaigns to its service. Before using: A public client repository does not establish current hosted-service availability or plan access. Source: https://github.com/ConsenSysDiligence/diligence-fuzzing. Status: documented; checked 2026-09-05.
- [Dune](https://defisec.info/tools#tool-dune): Query indexed blockchain data with SQL to investigate protocol usage and transaction patterns. Before using: Dataset freshness, labels and query logic can affect the conclusion. Source: https://docs.dune.com/. Status: documented; checked 2026-09-05.
- [Echidna](https://defisec.info/tools#tool-echidna): Fuzz sequences of contract calls against developer-written Solidity invariants and retain failing examples. Before using: Reachable states depend on the harness, caller setup, corpus and campaign budget. Source: https://github.com/crytic/echidna. Status: documented; checked 2026-09-05.
- [Echidna Parade](https://defisec.info/tools#tool-echidna-parade): Study a repository of Echidna fuzzing examples and campaign configurations. Before using: The repository is archived. Examples need review against current tool versions. Source: https://github.com/crytic/echidna-parade. Status: legacy; checked 2026-09-05.
- [Ethereum Signature Database](https://defisec.info/tools#tool-ethereum-signature-database): Look up candidate function and event signatures from Ethereum selectors and hashes. Before using: Selector collisions and untrusted submissions make a lookup result a hypothesis. Source: https://www.4byte.directory/. Status: documented; checked 2026-09-05.
- [Etherscan](https://defisec.info/tools#tool-etherscan): Inspect verified contract source, transactions, logs and API data for supported EVM networks. Before using: Source verification establishes a build match. It is not a security audit or endorsement. Source: https://docs.etherscan.io/introduction. Status: documented; checked 2026-09-05.
- [EtherSolve](https://defisec.info/tools#tool-ethersolve): Recover control-flow information from Ethereum bytecode for static-analysis research. Before using: Recovered edges require scrutiny when jump destinations depend on runtime data. Source: https://github.com/SeUniVr/EtherSolve. Status: documented; checked 2026-09-05.
- [EVM Diff](https://defisec.info/tools#tool-evm-diff): Compare published execution-level specifications of EVM-compatible chains in a structured view. Before using: The reviewed README describes early development and says the project should not yet be relied on. Source: https://github.com/mds1/evm-diff. Status: research; checked 2026-09-05.
- [evm.codes](https://defisec.info/tools#tool-evm-codes): Look up EVM opcodes, stack effects and gas-related reference information in an interactive interface. Before using: Use the applicable fork rules. Gas and opcode behavior can vary with the EVM revision. Source: https://www.evm.codes/. Status: documented; checked 2026-09-05.
- [EVMole](https://defisec.info/tools#tool-evmole): Extract selectors, argument information, mutability and storage-layout clues from EVM bytecode. Before using: Inferred interfaces need validation, especially around proxies and unusual dispatch code. Source: https://github.com/cdump/evmole. Status: documented; checked 2026-09-05.
- [Forta](https://defisec.info/tools#tool-forta): Consume or develop blockchain detection bots and alerts for monitoring suspicious activity. Before using: Bot coverage and alert quality vary. Connect alerts to an owned response procedure. Source: https://docs.forta.network/en/latest/. Status: documented; checked 2026-09-05.
- [Foundry](https://defisec.info/tools#tool-foundry): Use Forge tests and invariants, Anvil forks and Cast inspection within an EVM development suite. Before using: Fork tests inherit the selected block, RPC state and assumptions in the test harness. Source: https://github.com/foundry-rs/foundry. Status: documented; checked 2026-09-05.
- [FuzzUtils](https://defisec.info/tools#tool-fuzzutils): Turn failing Echidna or Medusa property sequences into Foundry regression-test cases. Before using: Validate the generated test against the original state, dependencies and failure conditions. Source: https://github.com/crytic/fuzz-utils. Status: documented; checked 2026-09-05.
- [Gigahorse](https://defisec.info/tools#tool-gigahorse): Lift EVM bytecode into an analysis representation for decompilation and custom program analyses. Before using: Analysis quality depends on correct lifting and handling of dynamic control flow. Source: https://github.com/nevillegrech/gigahorse-toolchain. Status: documented; checked 2026-09-05.
- [Gitleaks](https://defisec.info/tools#tool-gitleaks): Search repositories and files for patterns associated with accidentally committed secrets. Before using: Review matches and rotate exposed credentials. Deleting a finding does not invalidate the secret. Source: https://github.com/gitleaks/gitleaks. Status: documented; checked 2026-09-05.
- [GoPlus Security](https://defisec.info/tools#tool-goplus-security): Query token, address, approval and related security signals through the GoPlus API platform. Before using: Field availability varies by endpoint and chain. Unknown results need explicit handling. Source: https://docs.gopluslabs.io/docs/getting-started. Status: documented; checked 2026-09-05.
- [Greed](https://defisec.info/tools#tool-greed): Perform symbolic execution on EVM contract binaries through a research-oriented analysis engine. Before using: Configure execution bounds and environment models before interpreting reachable paths. Source: https://github.com/ucsb-seclab/greed. Status: documented; checked 2026-09-05.
- [Halmos](https://defisec.info/tools#tool-halmos): Run Solidity properties as symbolic tests to search for counterexamples over symbolic inputs. Before using: Loop bounds, external-call models and solver limits constrain conclusions. Source: https://github.com/a16z/halmos. Status: documented; checked 2026-09-05.
- [Hardhat](https://defisec.info/tools#tool-hardhat): Compile, test, deploy and debug EVM contracts in a JavaScript and TypeScript development environment. Before using: Testing validates the scenarios and assertions you write, not every possible execution. Source: https://github.com/NomicFoundation/hardhat. Status: documented; checked 2026-09-05.
- [HashEx ABI Encoder](https://defisec.info/tools#tool-hashex-abi-encoder): Encode Solidity function or constructor parameters into ABI-compatible calldata using a web interface. Before using: Check types and parameter order. Encoding correctness does not establish transaction safety. Source: https://abi.hashex.org/. Status: page-only; checked 2026-09-05.
- [HashEx Fork Checker](https://defisec.info/tools#tool-hashex-fork-checker): Compare forked smart contract code using HashEx's published fork-checking interface. Before using: Code similarity does not establish equivalent permissions, deployment state or security. Source: https://forkchecker.hashex.org/. Status: page-only; checked 2026-09-05.
- [Heimdall-rs](https://defisec.info/tools#tool-heimdall-rs): Inspect unverified EVM contracts with a bytecode-analysis toolkit for reverse engineering. Before using: Recovered structures are analytical guesses rather than authenticated original source. Source: https://github.com/Jon-Becker/heimdall-rs. Status: documented; checked 2026-09-05.
- [hevm](https://defisec.info/tools#tool-hevm): Execute EVM code concretely or symbolically to investigate contract behavior and properties. Before using: Choose compatible EVM semantics and explicitly model the surrounding environment. Source: https://github.com/argotorg/hevm. Status: documented; checked 2026-09-05.
- [Hexagate](https://defisec.info/tools#tool-hexagate): Evaluate Chainalysis Hexagate for detecting on-chain threats and organizing protective responses. Before using: Provider claims and alert coverage need validation against your protocol's threat model. Source: https://www.chainalysis.com/product/hexagate/. Status: documented; checked 2026-09-05.
- [Honeypot.is](https://defisec.info/tools#tool-honeypot-is): Simulate token trading and inspect honeypot-related checks through a token-analysis API. Before using: Results depend on supported routes and current state. Sellability can change after the check. Source: https://docs.honeypot.is/. Status: documented; checked 2026-09-05.
- [Hypernative](https://defisec.info/tools#tool-hypernative): Evaluate a hosted platform for blockchain threat detection, monitoring and automated response. Before using: Confirm supported assets, integration requirements and response controls for your environment. Source: https://www.hypernative.io/. Status: documented; checked 2026-09-05.
- [ItyFuzz](https://defisec.info/tools#tool-ityfuzz): Explore smart contract bytecode with hybrid fuzzing to generate vulnerability candidates and execution traces. Before using: Investigate findings and reproduce them in a controlled environment with the same state. Source: https://github.com/fuzzland/ityfuzz. Status: documented; checked 2026-09-05.
- [Kani](https://defisec.info/tools#tool-kani): Check Rust properties with bounded model checking and obtain counterexamples for failing assertions. Before using: Bounds and modeled Rust behavior limit coverage. Chain-specific account rules need separate properties. Source: https://github.com/model-checking/kani. Status: documented; checked 2026-09-05.
- [KEVM](https://defisec.info/tools#tool-kevm): Use the K specification of EVM execution to support semantics-based contract analysis and verification. Before using: Requires familiarity with K and careful alignment with the relevant EVM revision. Source: https://github.com/runtimeverification/evm-semantics. Status: documented; checked 2026-09-05.
- [Kontrol](https://defisec.info/tools#tool-kontrol): Apply K-based reasoning to Foundry-style Solidity tests when a property needs symbolic verification. Before using: Proof claims depend on harness assumptions, supported features and completed proof obligations. Source: https://github.com/runtimeverification/kontrol. Status: documented; checked 2026-09-05.
- [LiteSVM](https://defisec.info/tools#tool-litesvm): Execute Solana program tests in a lightweight local SVM environment. Before using: Local execution does not reproduce every validator, networking or live-state condition. Source: https://github.com/LiteSVM/litesvm. Status: documented; checked 2026-09-05.
- [Manticore](https://defisec.info/tools#tool-manticore): Script symbolic execution of smart contracts and binaries for research and legacy analysis. Before using: The repository is archived and the owner no longer maintains the project. Source: https://github.com/trailofbits/manticore. Status: legacy; checked 2026-09-05.
- [Medusa](https://defisec.info/tools#tool-medusa): Run parallel coverage-guided Solidity fuzzing campaigns with configurable test properties and call sequences. Before using: Coverage growth alone does not establish that the chosen invariants express the intended rules. Source: https://github.com/crytic/medusa. Status: documented; checked 2026-09-05.
- [Misti](https://defisec.info/tools#tool-misti): Run static analysis for TON contracts through the Misti analyzer and its supported language tooling. Before using: Check language and compiler support. Asynchronous protocol behavior also needs execution tests. Source: https://github.com/nowarp/misti. Status: documented; checked 2026-09-05.
- [Mollusk](https://defisec.info/tools#tool-mollusk): Run focused Solana instruction tests with explicit account inputs and expected output checks. Before using: Compose additional scenarios for interactions across instructions and programs. Source: https://github.com/anza-xyz/mollusk. Status: documented; checked 2026-09-05.
- [Move Prover](https://defisec.info/tools#tool-move-prover): Specify and verify Move module properties using the prover code within the Aptos repository. Before using: The reviewed subtree retains an experimental-code notice. Aptos Move tooling does not automatically cover Sui execution semantics. Source: https://github.com/aptos-labs/aptos-core/tree/main/third_party/move/move-prover. Status: research; checked 2026-09-05.
- [Mythril](https://defisec.info/tools#tool-mythril): Explore EVM bytecode with symbolic execution to find potential contract vulnerabilities. Before using: Path exploration and time bounds can leave relevant execution sequences unexplored. Source: https://github.com/ConsenSysDiligence/mythril. Status: documented; checked 2026-09-05.
- [Noir](https://defisec.info/tools#tool-noir): Write and compile zero-knowledge programs using a DSL and ACIR-compatible proving workflow. Before using: The reviewed README describes early development and warns against production use of that implementation. Source: https://github.com/noir-lang/noir. Status: research; checked 2026-09-05.
- [Olympix](https://defisec.info/tools#tool-olympix): Integrate automated Solidity analysis and testing assistance into a development security workflow. Before using: Evaluate actual findings on representative code before relying on provider performance claims. Source: https://olympix.security/. Status: documented; checked 2026-09-05.
- [OpenSSF Scorecard](https://defisec.info/tools#tool-openssf-scorecard): Inspect repository security practices through automated supply-chain checks and supporting observations. Before using: A repository score is a process signal and does not establish the absence of vulnerabilities. Source: https://github.com/ossf/scorecard. Status: documented; checked 2026-09-05.
- [OpenZeppelin Contracts](https://defisec.info/tools#tool-openzeppelin-contracts): Build and review token, access-control, governance and utility contracts using a reusable Solidity library. Before using: Custom extensions and configuration still need review, even when the underlying component is audited. Source: https://github.com/OpenZeppelin/openzeppelin-contracts. Status: documented; checked 2026-09-05.
- [OpenZeppelin Monitor](https://defisec.info/tools#tool-openzeppelin-monitor): Run configurable blockchain monitors that trigger notifications when selected on-chain conditions match. Before using: A monitor needs suitable RPC access, tested rules and a maintained notification path. Source: https://github.com/OpenZeppelin/openzeppelin-monitor. Status: documented; checked 2026-09-05.
- [OpenZeppelin Relayer](https://defisec.info/tools#tool-openzeppelin-relayer): Operate a relayer service for controlled transaction submission and signing infrastructure. Before using: Key storage, authorization, retries and operating procedures remain part of the security boundary. Source: https://github.com/OpenZeppelin/openzeppelin-relayer. Status: documented; checked 2026-09-05.
- [OpenZeppelin Upgrades](https://defisec.info/tools#tool-openzeppelin-upgrades): Validate and manage upgradeable contracts with deployment plugins and storage-layout checks. Before using: Storage compatibility checks do not prove an upgrade preserves application behavior. Source: https://github.com/OpenZeppelin/openzeppelin-upgrades. Status: documented; checked 2026-09-05.
- [OpenZeppelin Wizard](https://defisec.info/tools#tool-openzeppelin-wizard): Generate a starting contract from OpenZeppelin components and selected features. Before using: Review generated permissions, upgrade choices and subsequent modifications before deployment. Source: https://wizard.openzeppelin.com/. Status: documented; checked 2026-09-05.
- [OSV-Scanner](https://defisec.info/tools#tool-osv-scanner): Scan supported dependency manifests and lockfiles for vulnerabilities recorded in OSV. Before using: Package matching and advisory freshness limit coverage of the dependency graph. Source: https://github.com/google/osv-scanner. Status: documented; checked 2026-09-05.
- [Panoramix](https://defisec.info/tools#tool-panoramix): Decompile EVM bytecode into a readable representation for investigating contracts without published source. Before using: Decompiler output can misrepresent complex control flow and compiler-specific patterns. Source: https://github.com/palkeo/panoramix. Status: documented; checked 2026-09-05.
- [Phalcon Explorer](https://defisec.info/tools#tool-phalcon-explorer): Inspect decoded transaction flows, calls and asset movements while investigating EVM activity. Before using: Decoded labels and traces need interpretation against the underlying transaction and contract state. Source: https://blocksec.com/phalcon/explorer. Status: documented; checked 2026-09-05.
- [Phink](https://defisec.info/tools#tool-phink): Fuzz ink! smart contracts with an instrumentation and coverage-oriented workflow for Substrate projects. Before using: Requires a supported contract build and meaningful entry-point and invariant configuration. Source: https://github.com/srlabs/phink. Status: documented; checked 2026-09-05.
- [Picus](https://defisec.info/tools#tool-picus): Check uniqueness of circuit signals to investigate under-constrained Circom, R1CS and gnark circuits. Before using: Uniqueness is one property. It does not prove all intended application constraints. Source: https://github.com/Veridise/Picus. Status: documented; checked 2026-09-05.
- [Pocket Universe](https://defisec.info/tools#tool-pocket-universe): Preview wallet interactions through a browser extension that screens transactions for scam signals. Before using: Check current chain and wallet support. Simulation cannot predict every future contract-state change. Source: https://www.pocketuniverse.app/. Status: documented; checked 2026-09-05.
- [Prusti](https://defisec.info/tools#tool-prusti): Verify annotated Rust functions against contracts using the Viper verification infrastructure. Before using: Prototype constraints and supported language features may exclude parts of a production project. Source: https://github.com/viperproject/prusti-dev. Status: research; checked 2026-09-05.
- [pyevmasm](https://defisec.info/tools#tool-pyevmasm): Assemble and disassemble EVM instructions when inspecting raw bytecode and instruction sequences. Before using: Instruction decoding alone does not reveal contract intent or prove exploitability. Source: https://github.com/crytic/pyevmasm. Status: documented; checked 2026-09-05.
- [Quick Intel](https://defisec.info/tools#tool-quick-intel): Inspect token contracts and associated risk signals using the Quick Intel analysis tools and APIs. Before using: Confirm supported chains and the meaning of individual flags before using them as a decision rule. Source: https://docs.quickintel.io/. Status: documented; checked 2026-09-05.
- [Rabby Wallet](https://defisec.info/tools#tool-rabby-wallet): Review EVM transactions and interact with dapps through a wallet that presents pre-signing risk information. Before using: Simulation and warnings cannot guarantee the safety of a transaction or protect a disclosed seed phrase. Source: https://github.com/RabbyHub/Rabby. Status: documented; checked 2026-09-05.
- [Remix IDE](https://defisec.info/tools#tool-remix-ide): Inspect, compile and test Solidity contracts in a browser-based development environment. Before using: Use the intended compiler and execution environment when reproducing an audit finding. Source: https://remix-ide.readthedocs.io/en/latest/. Status: documented; checked 2026-09-05.
- [Revoke.cash](https://defisec.info/tools#tool-revoke-cash): Inspect token approvals and remove selected allowances on supported networks. Before using: Revocation requires an on-chain transaction and does not recover assets already transferred. Source: https://revoke.cash/. Status: documented; checked 2026-09-05.
- [Rhinestone](https://defisec.info/tools#tool-rhinestone): Build modular smart-account workflows and configure account capabilities with the Rhinestone stack. Before using: Each module and permission expands the account's trust and authorization model. Source: https://docs.rhinestone.dev/home/introduction/welcome-to-rhinestone. Status: documented; checked 2026-09-05.
- [Rugcheck](https://defisec.info/tools#tool-rugcheck): Inspect Solana token signals such as holder concentration, liquidity and token metadata before interaction. Before using: A token-risk report is a snapshot and cannot establish future liquidity or issuer behavior. Source: https://rugcheck.xyz/. Status: page-only; checked 2026-09-05.
- [Safe](https://defisec.info/tools#tool-safe): Manage a smart-account treasury with multiple owners, signing thresholds and transaction-review features. Before using: Owner independence, modules, signing interfaces and transaction review determine the operational protection. Source: https://www.safe.global/. Status: documented; checked 2026-09-05.
- [Safe Transaction Builder](https://defisec.info/tools#tool-safe-transaction-builder): Prepare, review, export and batch contract calls for execution through a Safe account. Before using: Review each target, value, operation and calldata item. Batching can conceal an unwanted permission change. Source: https://help.safe.global/articles/4180673514-transaction-builder. Status: documented; checked 2026-09-05.
- [Scaffold-ETH 2](https://defisec.info/tools#tool-scaffold-eth-2): Build a local Ethereum application and test interface for contract experiments and reproducible demonstrations. Before using: A development scaffold is supporting infrastructure. Production integrations need their own review. Source: https://github.com/scaffold-eth/scaffold-eth-2. Status: documented; checked 2026-09-05.
- [Scarb](https://defisec.info/tools#tool-scarb): Manage Cairo dependencies and builds to make Starknet review artifacts reproducible. Before using: Package resolution and successful compilation do not assess contract security. Source: https://github.com/software-mansion/scarb. Status: documented; checked 2026-09-05.
- [Scribble](https://defisec.info/tools#tool-scribble): Instrument Solidity specifications as runtime checks that tests and fuzzing campaigns can exercise. Before using: Annotations must encode the correct property. Instrumentation changes the analyzed build. Source: https://github.com/ConsenSysDiligence/scribble. Status: documented; checked 2026-09-05.
- [Securify 2](https://defisec.info/tools#tool-securify-2): Analyze Solidity contracts against a collection of compliance and violation patterns using static analysis. Before using: Check the repository's compiler requirements before using it on a modern codebase. Source: https://github.com/eth-sri/securify2. Status: documented; checked 2026-09-05.
- [Semgrep](https://defisec.info/tools#tool-semgrep): Apply code-analysis rules across application code and integrate findings into a development workflow. Before using: Language support, rules and analysis mode determine coverage. Contract-specific rules may need configuration. Source: https://docs.semgrep.dev/. Status: documented; checked 2026-09-05.
- [Sentio](https://defisec.info/tools#tool-sentio): Index blockchain events and build analytics to investigate application activity and transaction behavior. Before using: An indexer's coverage and processor logic determine which events reach the analysis. Source: https://docs.sentio.xyz/docs/readme. Status: documented; checked 2026-09-05.
- [Sherlock Audit Engine](https://defisec.info/tools#tool-sherlock-ai): Evaluate Sherlock Audit Engine, which combines AI analysis with security-researcher review in an engagement workflow. Before using: This is a review service workflow. Confirm scope and researcher involvement for the specific engagement. Source: https://sherlock.xyz/. Status: documented; checked 2026-09-05.
- [Sierra Analyzer](https://defisec.info/tools#tool-sierra-analyzer): Decompile Sierra files, inspect call graphs and run detectors or symbolic test generation. Before using: The README states that the project is no longer maintained. Source: https://github.com/FuzzingLabs/sierra-analyzer. Status: legacy; checked 2026-09-05.
- [Slither](https://defisec.info/tools#tool-slither): Run Solidity and Vyper detectors, inspect contract structure and build custom static analyses before manual review. Before using: Requires a reproducible build. Detector findings need contextual triage. Source: https://github.com/crytic/slither. Status: documented; checked 2026-09-05.
- [Slitherin](https://defisec.info/tools#tool-slitherin): Add Pessimistic's detector collection to Slither-based Solidity reviews. Before using: Requires a compatible Slither environment and detector-specific triage. Source: https://github.com/pessimistic-io/slitherin. Status: documented; checked 2026-09-05.
- [Smart Contract Sanctuary](https://defisec.info/tools#tool-smart-contract-sanctuary): Search a collected corpus of verified smart contract sources for implementation examples and comparison. Before using: A collected source file is neither an audit endorsement nor a guarantee of current deployed behavior. Source: https://github.com/tintinweb/smart-contract-sanctuary. Status: documented; checked 2026-09-05.
- [SmartCheck](https://defisec.info/tools#tool-smartcheck): Inspect legacy Solidity code with pattern-based vulnerability and bug detection. Before using: Deprecated since 2020. Its README warns about incorrect analysis from Solidity 0.6 onward. Source: https://github.com/smartdec/smartcheck. Status: legacy; checked 2026-09-05.
- [snarkjs](https://defisec.info/tools#tool-snarkjs): Inspect circuit artifacts, generate and verify proofs and work with supported setup-ceremony formats. Before using: Proof verification checks the encoded circuit, which may omit the intended application constraint. Source: https://github.com/iden3/snarkjs. Status: documented; checked 2026-09-05.
- [sol2uml](https://defisec.info/tools#tool-sol2uml): Generate Solidity class diagrams and storage visualizations to understand a contract system. Before using: Diagrams can simplify relationships. Validate storage and inheritance details against compiler artifacts. Source: https://github.com/naddison36/sol2uml. Status: documented; checked 2026-09-05.
- [Solady](https://defisec.info/tools#tool-solady): Use optimized Solidity components as implementation references or dependencies in a contract project. Before using: Low-level optimizations require careful review of assumptions and integration behavior. Source: https://github.com/Vectorized/solady. Status: documented; checked 2026-09-05.
- [Solana Explorer](https://defisec.info/tools#tool-solana-explorer): Inspect Solana clusters, transactions, accounts and programs using the ecosystem's explorer project. Before using: A successful transaction or verified label is not evidence that a program is secure. Source: https://github.com/solana-foundation/explorer. Status: documented; checked 2026-09-05.
- [Solana Playground](https://defisec.info/tools#tool-solana-playground): Develop, compile and test Solana programs through a browser-based workspace. Before using: Reproduce critical findings in a pinned environment with controlled keys and dependencies. Source: https://github.com/solana-playground/solana-playground. Status: documented; checked 2026-09-05.
- [solana-security-txt](https://defisec.info/tools#tool-solana-security-txt): Embed a machine-readable security contact and disclosure information in a Solana program. Before using: Contact metadata helps reporting but does not validate the deployed program's logic. Source: https://github.com/neodyme-labs/solana-security-txt. Status: documented; checked 2026-09-05.
- [solana-verify](https://defisec.info/tools#tool-solana-verify): Rebuild a Solana program deterministically and compare its binary with an on-chain program or buffer. Before using: A matching binary establishes source correspondence, not the absence of vulnerabilities. Source: https://github.com/solana-foundation/solana-verifiable-build. Status: documented; checked 2026-09-05.
- [Solang](https://defisec.info/tools#tool-solang): Compile Solidity for supported alternative targets, including Solana, and inspect target-specific diagnostics. Before using: Solidity syntax compatibility does not imply Ethereum execution semantics on another target. Source: https://github.com/hyperledger-solang/solang. Status: documented; checked 2026-09-05.
- [solc-select](https://defisec.info/tools#tool-solc-select): Install and switch Solidity compiler versions when reproducing a specific contract build. Before using: Match the full build settings as well as the compiler version. Source: https://github.com/crytic/solc-select. Status: documented; checked 2026-09-05.
- [solfuzz-agave](https://defisec.info/tools#tool-solfuzz-agave): Use an Agave execution target in Solana runtime differential fuzzing research. Before using: This is runtime test infrastructure, not a turnkey detector for application-level program bugs. Source: https://github.com/firedancer-io/solfuzz-agave. Status: documented; checked 2026-09-05.
- [solgrep](https://defisec.info/tools#tool-solgrep): Search Solidity syntax structures to locate relevant declarations and patterns across a review scope. Before using: Structural matches are navigation aids and need manual analysis of their context. Source: https://github.com/tintinweb/solgrep. Status: documented; checked 2026-09-05.
- [Solhint](https://defisec.info/tools#tool-solhint): Enforce Solidity style, naming and selected security rules in editor and CI workflows. Before using: A clean lint result does not establish correctness of protocol logic. Source: https://github.com/protofire/solhint. Status: documented; checked 2026-09-05.
- [Solidity Metrics](https://defisec.info/tools#tool-solidity-metrics): Measure Solidity code structure and produce scope information for audit preparation. Before using: Line counts and complexity indicators help scope work but do not measure security quality. Source: https://github.com/ConsenSysDiligence/solidity-metrics. Status: documented; checked 2026-09-05.
- [Solidity SMTChecker](https://defisec.info/tools#tool-solidity-smtchecker): Use Solidity's built-in model checker to evaluate assertions and selected safety properties at compilation. Before using: Review unsupported features and solver results. An inconclusive result is not a proof. Source: https://docs.soliditylang.org/en/latest/smtchecker.html. Status: documented; checked 2026-09-05.
- [Solidity Visual Developer](https://defisec.info/tools#tool-solidity-visual-developer): Use editor annotations, contract navigation, graphs and inline review helpers while reading Solidity. Before using: Visual cues assist the reviewer. They do not independently validate security properties. Source: https://github.com/ConsenSysDiligence/vscode-solidity-auditor. Status: documented; checked 2026-09-05.
- [solidity-coverage](https://defisec.info/tools#tool-solidity-coverage): Measure which Solidity statements and branches a test suite exercises. Before using: High coverage can coexist with missing assertions and untested economic failure modes. Source: https://github.com/sc-forks/solidity-coverage. Status: documented; checked 2026-09-05.
- [SolidityScan](https://defisec.info/tools#tool-solidityscan): Submit Solidity projects or deployed contracts to a hosted scanner and review vulnerability reports. Before using: An automated report and score require independent triage and do not constitute a complete manual audit. Source: https://docs.solidityscan.com/. Status: documented; checked 2026-09-05.
- [Solmate](https://defisec.info/tools#tool-solmate): Study compact Solidity building blocks for tokens, authorization and related contract patterns. Before using: Review the project's maintenance notice and individual component assumptions before adoption. Source: https://github.com/transmissions11/solmate. Status: legacy; checked 2026-09-05.
- [Solodit](https://defisec.info/tools#tool-solodit): Search published smart contract findings and mitigations to identify relevant bug patterns during review. Before using: A historical finding is context. Confirm whether its assumptions apply to the target code. Source: https://solodit.cyfrin.io/. Status: documented; checked 2026-09-05.
- [Solscan](https://defisec.info/tools#tool-solscan): Inspect Solana transactions, program interactions, accounts and token details in an explorer. Before using: Explorer labels and parsed views should be checked against raw account and transaction data. Source: https://solscan.io/. Status: documented; checked 2026-09-05.
- [Sourcify](https://defisec.info/tools#tool-sourcify): Verify and retrieve contract source by matching compiler artifacts to deployed EVM bytecode. Before using: A source match does not validate contract permissions, business logic or upgrade governance. Source: https://docs.sourcify.dev/. Status: documented; checked 2026-09-05.
- [Sourcify Signature Database (OpenChain)](https://defisec.info/tools#tool-openchain-signature-database): Look up function and event signatures through the OpenChain destination now served by Sourcify. Before using: A matching hash does not authenticate an ABI or establish a contract's implementation. Source: https://4byte.sourcify.dev/signatures/index.html. Status: page-only; checked 2026-09-05.
- [Starknet Foundry](https://defisec.info/tools#tool-starknet-foundry): Test, fuzz and interact with Starknet contracts using the snforge and sncast tool suite. Before using: Match Cairo and network versions and test account-contract interactions explicitly. Source: https://github.com/foundry-rs/starknet-foundry. Status: documented; checked 2026-09-05.
- [Sui CLI](https://defisec.info/tools#tool-sui-cli): Compile and test Move packages and inspect Sui objects and transactions with official command-line tools. Before using: Add adversarial object-ownership and capability scenarios beyond the standard unit tests. Source: https://docs.sui.io/references/cli. Status: documented; checked 2026-09-05.
- [Surya](https://defisec.info/tools#tool-surya): Generate Solidity contract graphs, inheritance views and inspection reports while mapping a codebase. Before using: Graph output needs manual interpretation and may not represent every dynamic interaction. Source: https://github.com/ConsenSysDiligence/surya. Status: documented; checked 2026-09-05.
- [Syft](https://defisec.info/tools#tool-syft): Generate a software bill of materials for container images and filesystems used in a deployment. Before using: An SBOM is an inventory. Pair it with advisory analysis and artifact-integrity checks. Source: https://github.com/anchore/syft. Status: documented; checked 2026-09-05.
- [Tact](https://defisec.info/tools#tool-tact): Compile and inspect Tact contracts when maintaining or auditing existing TON applications. Before using: The reviewed README marks Tact deprecated and directs new language users to Tolk. Source: https://github.com/tact-lang/tact. Status: legacy; checked 2026-09-05.
- [Tenderly](https://defisec.info/tools#tool-tenderly): Simulate transactions and inspect execution traces or state changes before an on-chain operation. Before using: Results depend on the chosen block, transaction inputs and simulation environment. Source: https://docs.tenderly.co/introduction. Status: documented; checked 2026-09-05.
- [Thoth](https://defisec.info/tools#tool-thoth): Inspect Cairo and Starknet artifacts with disassembly, graphs and symbolic-analysis research tools. Before using: The repository is archived and states it is no longer maintained. Source: https://github.com/FuzzingLabs/thoth. Status: legacy; checked 2026-09-05.
- [TokenSniffer](https://defisec.info/tools#tool-tokensniffer): Inspect automated token scam flags, similarity information and optional holder or liquidity metrics. Before using: A score summarizes selected signals. It does not guarantee that a token will remain safe to trade. Source: https://tokensniffer.readme.io/reference/introduction. Status: documented; checked 2026-09-05.
- [Tolk](https://defisec.info/tools#tool-tolk): Compile Tolk smart contracts for TON and inspect build output during code review. Before using: Language tooling does not prove that asynchronous message and authorization logic is correct. Source: https://docs.ton.org/tolk/overview. Status: documented; checked 2026-09-05.
- [TON Blueprint](https://defisec.info/tools#tool-ton-blueprint): Build and test TON contracts using the Blueprint development workflow found in existing projects. Before using: The reviewed README marks Blueprint deprecated and points users to Acton. Source: https://github.com/ton-org/blueprint. Status: legacy; checked 2026-09-05.
- [TON Contract Executor](https://defisec.info/tools#tool-ton-contract-executor): Execute TON contract code locally for investigating contract behavior in a test environment. Before using: The repository is archived. Verify compatibility before reproducing historical tests. Source: https://github.com/ton-community/ton-contract-executor. Status: legacy; checked 2026-09-05.
- [TON Sandbox](https://defisec.info/tools#tool-ton-sandbox): Execute TON contracts in a local sandbox for message-flow and state-transition tests. Before using: Add asynchronous message ordering, bounce and failure scenarios beyond successful transfers. Source: https://github.com/ton-blockchain/sandbox. Status: documented; checked 2026-09-05.
- [Trident](https://defisec.info/tools#tool-trident): Write Rust-based fuzzing campaigns that exercise Solana program instructions and account interactions. Before using: Meaningful account-state generation and invariants are required to find authorization bugs. Source: https://github.com/Ackee-Blockchain/trident. Status: documented; checked 2026-09-05.
- [Trivy](https://defisec.info/tools#tool-trivy): Scan containers, repositories and infrastructure configuration for dependency and deployment risks. Before using: Findings depend on supported scanners and databases, with contract economics outside scope. Source: https://github.com/aquasecurity/trivy. Status: documented; checked 2026-09-05.
- [TruffleHog](https://defisec.info/tools#tool-trufflehog): Find potential leaked credentials in supported data sources and verify supported credential types. Before using: Live verification can contact providers. Use authorized sources and handle findings as sensitive data. Source: https://github.com/trufflesecurity/trufflehog. Status: documented; checked 2026-09-05.
- [Vandal](https://defisec.info/tools#tool-vandal): Disassemble and analyze EVM bytecode with a static-analysis framework and intermediate representation. Before using: Check opcode and compiler compatibility for current deployments before using results. Source: https://github.com/usyd-blockchain/vandal. Status: documented; checked 2026-09-05.
- [VeriSol](https://defisec.info/tools#tool-verisol): Translate Solidity verification problems into a formal-analysis workflow for studying contract properties. Before using: The repository is archived. Retain it for compatible historical and research cases. Source: https://github.com/microsoft/VeriSol. Status: legacy; checked 2026-09-05.
- [Verus](https://defisec.info/tools#tool-verus): Annotate Rust programs with specifications and prove properties using deductive verification. Before using: Proof annotations and supported Rust features require engineering effort. Source: https://github.com/verus-lang/verus. Status: documented; checked 2026-09-05.
- [Vyper](https://defisec.info/tools#tool-vyper): Compile Vyper contracts and inspect compiler output as part of a reproducible contract review. Before using: A successful compilation does not verify the application's economic assumptions. Source: https://github.com/vyperlang/vyper. Status: documented; checked 2026-09-05.
- [Wake](https://defisec.info/tools#tool-wake): Combine Solidity vulnerability detectors with Python-based testing and fuzzing in one development framework. Before using: The build configuration and test harness determine which behavior is exercised. Source: https://github.com/Ackee-Blockchain/wake. Status: documented; checked 2026-09-05.
- [WhatsABI](https://defisec.info/tools#tool-whatsabi): Infer an ABI, resolve supported proxy patterns and collect metadata from Ethereum bytecode. Before using: Inferred types and proxy resolution can be incomplete for custom dispatch patterns. Source: https://github.com/shazow/whatsabi. Status: documented; checked 2026-09-05.
- [ZAP](https://defisec.info/tools#tool-zap): Inspect and test the web application and API surfaces around a protocol using a web-security scanner. Before using: Web scanning covers the interface layer. Smart contract logic requires separate analysis. Source: https://www.zaproxy.org/docs/. Status: documented; checked 2026-09-05.
- [Zodiac](https://defisec.info/tools#tool-zodiac): Compose DAO and smart-account controls using modular governance and execution tooling. Before using: Module permissions and interaction paths need review as a complete authorization system. Source: https://github.com/gnosisguild/zodiac. Status: documented; checked 2026-09-05.
- [Download the tool catalog as JSON](https://defisec.info/downloads/research/web3-security-tools.json)

## Auditor and market research

- [0xGuard Audit: Insights & Analysis](https://defisec.info/0xguard_company_analysis_report): 0xGuard is a new company with a large portfolio. Though the team and founders are anonymous, it's gaining recognition in media and for its audits.
- [BlockSAFU Analysis Report](https://defisec.info/blocksafu_company_analysis_report): Research of the audit company Block Safu. The DSA expert team has performed an in-depth analysis of the Block Safu audit company. Read the full report
- [Get Insights: Analytical Report on Certik Audit Company](https://defisec.info/certik_company_analysis_report): Get Insights into Certik Audit Company with Our Analytical Report: A Must-Read for Ensuring Crypto Project Security.
- [Certora Analysis Report](https://defisec.info/certora-company-analysis-report): Explore our comprehensive review of Certora on DeFi Security Alliance, offering key insights to guide your smart contract auditor selection.
- [ChainSecurity Audit: Insights & Analysis](https://defisec.info/chainsecurity_company_analysis_report): With a solid track record since 2017, ChainSecurity has been auditing smart contracts for blue-chip DeFi protocols, central banks, and Web3 projects.
- [Coinsult Audit: Insights & Analysis](https://defisec.info/coinsult_company_analysis_report): Discover Insights: Analytical Report on Coinsult Audit Firm for Comprehensive Evaluation
- [ContractChecker Audit: Insights & Analysis](https://defisec.info/contractchecker_company_analysis_report): ContractChecker will help you with everything from developing and auditing smart contracts to creating Launchpad, NFT Marketplaces and unique DApps. The ContractChecker Dapp also has utilities such as Multi Sender, Locker and Private Sale available to eve
- [ContractWolf Audit: Insights & Analysis](https://defisec.info/contractwolf_company_analysis_report): ContractWolf provides smart contract audits, security and development services to ensure the safety and integrity of blockchain projects.
- [Cyberscope Audit: Insights & Analysis](https://defisec.info/cyberscope_company_analysis_report): Cyberscope is a new auditor but has a portfolio of 1200+ projects. It published its first report in 2021 and is now a well-known name in DeFi security.
- [Cyfrin Analysis Report](https://defisec.info/cyfrin-company-analysis-report): Cyfrin bring smart contract audits, tools, and education to hundreds of thousands of users, partners, and blockchain protocols.
- [DeFiMoon Audit: Insights & Analysis](https://defisec.info/defimoon_company_analysis_report): Discover DeFiMoon, a trusted auditing company with a growing portfolio. Their tools, media coverage, and expertise ensure your DeFi projects are secure.
- [Haсken Analysis Report](https://defisec.info/haken_company_analysis_report): DSA presents a unique series of reports on the smart contract and blockchain app auditor market. This report is published for the first time and is not affiliated with any specific vendor. The DSA expert team has performed an in-depth analysis of the Hacken audit company. Read full report
- [Halborn Analysis Report](https://defisec.info/halborn-company-analysis-report): Explore our comprehensive review of Helborn on DeFi Security Alliance. Halborn is a blockchain security firm with full-stack security solutions.
- [Get Insights: Analytical Report on HashEx Audit Company](https://defisec.info/hashex_company_analysis_report): Get Insights into HashEx Audit Company with Our Analytical Report: A Must-Read for Ensuring Crypto Project Security.
- [Hashlock Analysis Report](https://defisec.info/hashlock_company_analysis_report): Hashlock: Pioneering in blockchain security research to foster safe web3 innovation, reflecting core values.
- [ImmuneBytes Analysis Report](https://defisec.info/immunebytes_company_analysis_report): ImmuneBytes - a blockchain security audit firm with the goal of making the Web3 space more secure to build through innovative and effective solutions.
- [PeckShield Analysis Report](https://defisec.info/peckshield_company_analysis_report): PeckShield, founded in 2018, specializes in blockchain security, offering solutions like DAppTotal and CoinHolmes, with a globally recognized team and strategic partnerships.
- [QuillAudits: Analytical Report of the Leading Audit Company](https://defisec.info/quillaudit_company_analysis_report): Discover the QuillAudits, a leading audit company, through our in-depth analysis.
- [RugFreeCoins Analysis Report](https://defisec.info/rugfreecoins_company_analysis_report): A review of the audit company Rug Free Coins. The DSA expert team has performed an in-depth analysis of the RugFreeCoins audit company. Read the full report.
- [Sigma Prime Analysis Report](https://defisec.info/sigma-prime-company-analysis-report): Sigma Prime is a blockchain security and research firm, born with the vision of conducting the comprehensive security research and applying it to the Blockchain industry to boost safe innovation.
- [Source Hat Smart Contract Audit Company Analysis | DeFiSec](https://defisec.info/sourcehat_company_analysis_report): Review the DeFi Security Alliance analysis of Source Hat, its smart contract audit process, services and public company information.
- [SolidProof Audit: Insights & Analysis](https://defisec.info/solidproof_company_analysis_report): SolidProof offers Smart Contract Audits, KYC support, and marketing solutions for diverse crypto markets, guiding and supporting cryptocurrency projects
- [Zokyo Audit: Insights & Analysis](https://defisec.info/zokyo_company_analysis_report): Zokyo secures, builds, and funds legendary Web3 companies

## Downloadable reports and papers

- [Astromarket Audit Report by 0xGuard | DeFiSec](https://defisec.info/reports/0xguard-astromarket-audit): Download the June 2022 0xGuard security assessment for the Astromarket Rust contract on NEAR and review its recorded findings and audit period.
- [Ayoken Audit Report by Defimoon | DeFiSec](https://defisec.info/reports/defimoon-ayoken-audit): Download the September 2022 Defimoon smart contract audit report for Ayoken on Binance Smart Chain and review the documented risk summary.
- [Umbrella Protocol Audit by Rapid Labs | DeFiSec](https://defisec.info/reports/rapidlabs-umbrella-protocol-audit): Download the August 2022 Rapid Labs security audit for the Umbrella Protocol Solidity contracts on Binance Smart Chain.
- [Greedy, Prodigal and Suicidal Contracts Paper | DeFiSec](https://defisec.info/reports/smart-contract-weakness-classification): Download the 2018 research paper Finding the Greedy, Prodigal, and Suicidal Contracts at Scale and review its verified document details.
- [Pharos Production: 2026 Audit Evidence Review | DeFiSec](https://defisec.info/reports/pharos-production-evidence-review-2026): The service page describes a priced audit process. Public customer-report evidence was not established in this bounded check.
- [OpenZeppelin: ZKsync OS Audit Evidence Review | DeFiSec](https://defisec.info/reports/openzeppelin-evidence-review-2026): A published Rust review provides scoped revisions and issue updates; its exclusions matter when assessing relevance to a new engagement.
- [Trail of Bits: 2 Finding Resolutions Examined | DeFiSec](https://defisec.info/reports/trail-of-bits-evidence-review-2026): The Kiln Lagoon vault report separates project coverage and fix review, but its resolution narratives require more care than a status total.
- [Hacken: 1,373 Public Audit Records Examined | DeFiSec](https://defisec.info/reports/hacken-evidence-review-2026): The public API enables a reproducible completeness check, while its records and report narratives serve different purposes.
- [Quantstamp: 2 Audit Reports Examined | DeFiSec](https://defisec.info/reports/quantstamp-evidence-review-2026): Two PDFs linked from the audit service page offer scope and outcome evidence, but their age limits what they say about the team available today.
- [23 Audit Providers: Public Evidence Study | DeFiSec](https://defisec.info/reports/audit-provider-evidence-study-2026): A directory-wide access check and five purposive dossiers show why marketing claims, traceability, and technical judgment need separate fields.

## Security guides and articles

- [The Top 5 Most Common Smart Contract Vulnerabilities](https://defisec.info/5_most_common_vulnerabilities): The blockchain industry is making big steps toward achieving security for all participants, however, it’s still not a done deal just yet. Hackers come up with new ways to exploit vulnerabilities and steal funds. Sadly, this lowers the trust in blockchain technology. In the last two years over $5 billion worth of assets was stolen due to multiple attacks on decentralized finances.
- [AI and Blockchain in Web3 Security: Discovering a New Horizon of Possibilities](https://defisec.info/ai_and_blockchain): Discover the fusion of AI and blockchain in Web3 security, unlocking new possibilities to fortify decentralized applications.
- [Building Secure Crypto Projects Smart Contract Audit Builder](https://defisec.info/audit_builder_dsa): In this sense, a report has to reflect best all the issues uncovered during the audit.
- [Blockchain Audit and Security Companies: The Case for Integrated Legal Services](https://defisec.info/blockchain_audit_and_security_companies): Explore the importance of integrated legal services for blockchain audit and security companies.
- [Crypto Cyber Security Awards by DeFi Security Alliance](https://defisec.info/crypto-cyber-security-awards): The winners will be listed on DSA for free. Special prize includes news and articles publishing, a badge, and top spots in search results. DSA Audit Builder.
- [DeFi Security: Situation and Solution](https://defisec.info/defi_security_situation_solution): The 2022 Crypto Crime Report of Chainalysis has revealed an alarming fact: Only in the first quarter of 2022 did cyberpunks pocket 1.3 billion dollars from cryptocurrency transactions. Most victims were from DeFi protocols. This means DeFi has both high benefits and plenty of risks.
- [Enhancing Smart Contract Security with Echidna Fuzz Testing](https://defisec.info/enhancing_smart_contract_security_with_echidna_fuzz_testing): Boost smart contract security with Echidna fuzz testing. Uncover vulnerabilities and ensure reliability in Solidity contracts.
- [Building Crypto Projects: A Developer's Guide](https://defisec.info/framework_setup): Developers often ask how to correctly, efficiently, and securely set up a framework for developing smart contracts. This guide aims to help new developers do it quickly and conveniently.
- [Building secure Smart Contracts with Rust on NEAR Protocol](https://defisec.info/how_to_build_secure_smart_contracts_with_rust_on_near_protocol): Do you want to create secure smart contracts with Rust on NEAR Protocol? Learn how in this guide by Blaize’s experts.
- [How to Identify Hidden Mint Functions in Smart Contracts](https://defisec.info/how_to_spot_hidden_mint_functions): In this article we will talk about a sneaky trick that the scammers use in order to fool the investors as well as the auditors in order to perform the classic “Rug Pull” scam by creating new tokens and harming the tokenomics, and how to read SolidProof’s report to make sure if there is a potential of this scam in a project
- [Importance of 360° audits: What PaladinAI is offering](https://defisec.info/importance_of_360_audits_what_paladinai_is_offering): Finding the right project to invest in gets tougher by the day and a complete auditing tool definitely helps you make better informed investment decisions
- [Critical Role of Smart Contract Audits in the DeFi Space](https://defisec.info/importance_of_the_security_audit_for_defi_projects): The most important topic in blockchain has always been security.
- [Securing Your Crypto Project: An In-Depth Look into the Smart Contract Audit Process](https://defisec.info/look_inside_a_smart_contract_audit): Auditing smart contracts is a vital part of building up security in DeFi.
- [Navigating the Landscape of Smart Contract Auditors: Insights from the Quadrant Analysis](https://defisec.info/navigating_the_landscape_of_smart_contract_auditors): Discover key insights and navigate the complex world of smart contract auditors with our article on the Quadrant Analysis.
- [Protecting Your Investments in the DeFi Space](https://defisec.info/security_state_of_defi_and_risk_mitigation_ideas): “DeFi,” sounds like no alien term now. We are in a time where decentralized finance has engraved its significance as a blockchain-based alternative for financial systems and scaling its adoption rate at an incredible pace.
- [Understanding the Cost of Securing Your Crypto Project](https://defisec.info/smart_contract_audits_pricing_explained): While approaching an auditor, the first thing a client wants to know is always the price. Some would be more secretive, while others would list offers right there on the main page.
- [Securing Your Solana-based Crypto Project](https://defisec.info/solana_top_vulnerabilities): Currently, the Solana blockchain is very popular. The reason for this popularity is the very low transaction fees. More and more popular projects are being launched on the Solana blockchain, so now it is absolutely necessary to be aware of all the key vulnerabilities of Solana.
- [The Most Cost-Effective Smart Contract Auditors of 2023](https://defisec.info/the_most-cost-effective-smart-contract-auditors): Discover 2023's best value smart contract auditors: Expert, affordable firms ensuring your blockchain's integrity and security.
- [The Importance of Expert Opinion for Investors](https://defisec.info/understanding_crypto): Whether you're a shrimp or a whale, if you're swimming in this ocean, you have to learn how to keep yourself safe. Contract Checker offers you the most secure environment.
- [Securing the Future: Web3 Security and Auditing in the Age of Decentralized AI](https://defisec.info/web3_security_and_auditing_in_the_age_of_decentralized_ai): Discover the latest in Web3 security and AI auditing with PaladinAI
- [The Importance of Multiple Smart Contract Audits](https://defisec.info/why_do_you_need_several_audits): Auditing a project is a very important step in the process of developing a project.
- [The Importance of Upgraded Launch Strategies](https://defisec.info/why_we_need_better_launch_models_in_crypto_world): In the world of cryptocurrency, launches play a crucial role in the success or failure of a new project.

## Alliance member profiles

- [Smart Contract Audits from $8,000 | Pharos Production](https://defisec.info/members/pharos-production): DeFi cybersecurity services for Ethereum, Solana and TON teams: smart contract audits, web3 pentests and cloud reviews with published prices and NDA reports.
- [ImmuneBytes: 2022 MaticX Audit Report | DeFiSec](https://defisec.info/members/immunebytes): Inspect the April 2022 MaticX audit, named Solidity contracts and current ImmuneBytes payment models before requesting a scoped security review.
- [VeriChains Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/verichains): Review the DeFi Security Alliance profile for VeriChains, including its listed security services, provider details and related local reports.
- [HashEx Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/hashex): Review the DeFi Security Alliance profile for HashEx, including its listed security services, provider details and related local reports.
- [SlowMist Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/slowmist): Review the DeFi Security Alliance profile for SlowMist, including its listed security services, provider details and related local reports.
- [Expelee Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/expelee): Review the DeFi Security Alliance profile for Expelee, including its listed security services, provider details and related local reports.
- [PeckShield Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/peckshield): Review the DeFi Security Alliance profile for PeckShield, including its listed security services, provider details and related local reports.
- [HYDN Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/hydn): Review the DeFi Security Alliance profile for HYDN, including its listed security services, provider details and related local reports.
- [Cyberscope Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/cyberscope): Review the DeFi Security Alliance profile for Cyberscope, including its listed security services, provider details and related local reports.
- [Blaize Security Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/blaize-security): Review the DeFi Security Alliance profile for Blaize Security, including its listed security services, provider details and related local reports.
- [SolidProof Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/solidproof): Review the DeFi Security Alliance profile for SolidProof, including its listed security services and related local reports.
- [Callisto Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/callisto): Review the DeFi Security Alliance profile for Callisto, including its listed security services, provider details and related local reports.
- [Rapid Labs Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/rapid-labs): Review the DeFi Security Alliance profile for Rapid Labs, including its listed security services, provider details and related local reports.
- [CyStack Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/cystack): Review the DeFi Security Alliance profile for CyStack, including its listed security services, provider details and related local reports.
- [Source Hat Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/source-hat): Review the DeFi Security Alliance profile for Source Hat, including its listed security services, provider details and related local reports.
- [BlockSec Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/blocksec): Review the DeFi Security Alliance profile for BlockSec, including its listed security services, provider details and related local reports.
- [Quantstamp Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/quantstamp): Review the DeFi Security Alliance profile for Quantstamp, including its listed security services, provider details and related local reports.
- [OpenZeppelin Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/openzeppelin): Review the DeFi Security Alliance profile for OpenZeppelin, including its listed security services, provider details and related local reports.
- [ShellBoxes Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/shellboxes): Review the DeFi Security Alliance profile for ShellBoxes, including its listed security services, provider details and related local reports.
- [Trail of Bits Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/trail-of-bits): Review the DeFi Security Alliance profile for Trail of Bits, including its listed security services, provider details and related local reports.
- [0xGuard Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/0xguard): Review the DeFi Security Alliance profile for 0xGuard, including its listed security services, provider details and related local reports.
- [QuillAudits Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/quillaudits): Review the DeFi Security Alliance profile for QuillAudits, including its listed security services, provider details and related local reports.
- [Paladin AI Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/paladin-ai): Review the DeFi Security Alliance profile for Paladin AI, including its listed security services, provider details and related local reports.
- [Hacken Smart Contract Audit Profile | DeFiSec](https://defisec.info/members/hacken): Review the DeFi Security Alliance profile for Hacken, including its listed security services, provider details and related local reports.

## Alliance and participation pages

- [Badges "DeFi Security Alliance Member"](https://defisec.info/badges): Showcase your commitment to blockchain security with the 'DeFi Security Alliance Member' badge on your site. Confirm your alliance involvement proudly!
- [HashEx Solidity Certification for Smart Contract Auditors](https://defisec.info/solidity_certification): One of the DSA members, HashEx offers a certification program that allows grading and confirming the skills of an auditor.

## Site services and policies

- [Privacy Policy | DeFi Security Alliance](https://defisec.info/privacy): How defisec.info handles form submissions, first-party event counts, Ahrefs Web Analytics, Cloudflare Turnstile and delivery records.
- [Request a Smart Contract Audit | DeFiSec](https://defisec.info/request-audit): Send your network, codebase and timeline. Choose an auditor or let DeFiSec route your request to one of 23 listed security providers.
- [7 Site Data and Accessibility Updates | DeFiSec](https://defisec.info/updates): Review dated DeFi Security Alliance changes to member pages, audit documents, accessibility, metadata and site performance.
- [5-Field DeFi Security Alliance Application | DeFiSec](https://defisec.info/join): Submit five required details for the initial DSA membership review, including a company website and public smart contract security evidence.
- [6-Field Cybersecurity Awards Application | DeFiSec](https://defisec.info/participate): Submit six required details for the DSA cybersecurity awards, including the category, company website and public evidence for the judges.
- [Correct a Provider Profile or Report | DeFiSec](https://defisec.info/report-correction): Submit a specific correction with a supporting source.
- [Cryptocrat: 2023 Historical Auditor Profile | DeFiSec](https://defisec.info/members/cryptocrat): Inspect the 2023 Cryptocrat directory record and its former website. Current activity, contact details and audit pricing remain unverified.
- [Blockchain Security Articles: Page 2 | DeFi Security Alliance](https://defisec.info/blog/page/2): Browse DeFi Security Alliance articles about smart contract auditing, blockchain security, vulnerabilities, audit companies and DeFi risk.
- [Blockchain Security Articles: Page 3 | DeFi Security Alliance](https://defisec.info/blog/page/3): Browse DeFi Security Alliance articles about smart contract auditing, blockchain security, vulnerabilities, audit companies and DeFi risk.
- [Blockchain Security Articles: Page 4 | DeFi Security Alliance](https://defisec.info/blog/page/4): Browse DeFi Security Alliance articles about smart contract auditing, blockchain security, vulnerabilities, audit companies and DeFi risk.
- [Blockchain Security Articles: Page 5 | DeFi Security Alliance](https://defisec.info/blog/page/5): Browse DeFi Security Alliance articles about smart contract auditing, blockchain security, vulnerabilities, audit companies and DeFi risk.
- [EU DeFi Regulation: Scope and Country Guides | DeFiSec](https://defisec.info/regulation): Identify the actor, service and token before choosing a regulatory route. Compare national procedures and connect security controls to documented evidence.
- [France DeFi Regulation: AMF and Certification | DeFiSec](https://defisec.info/regulation/france): Distinguish AMF provider authorization from smart contract certification research. Map French application documents to security and operational evidence.
- [DeFi en France : AMF, agrément et certification | DeFiSec](https://defisec.info/fr/regulation/france): Distinguez l’agrément PSCA des travaux sur la certification des smart contracts. Reliez les documents AMF aux preuves de sécurité et de résilience.
- [Malta DeFi Regulation: MFSA and MDIA TARF | DeFiSec](https://defisec.info/regulation/malta): Separate the MFSA crypto-asset provider route from MDIA technology assessment. Compare their scope and prepare an evidence inventory for the relevant process.
- [Germany DeFi Regulation: BaFin and CASP Evidence | DeFiSec](https://defisec.info/regulation/germany): Prepare a German CASP application: BaFin, KMAG, authorization or notification, DORA evidence and cross-border service checks.
- [DeFi in Deutschland: BaFin, MiCAR und Nachweise | DeFiSec](https://defisec.info/de/regulation/germany): CASP-Antrag in Deutschland vorbereiten: BaFin, KMAG, Zulassung oder Notifizierung, DORA-Nachweise und grenzüberschreitende Dienste.
- [Netherlands DeFi Regulation: AFM and DNB | DeFiSec](https://defisec.info/regulation/netherlands): Understand AFM and DNB responsibilities, CASP application documents and the technical evidence behind IT/DORA, continuity and asset segregation.
- [DeFi in Nederland: AFM, DNB en CASP-aanvraag | DeFiSec](https://defisec.info/nl/regulation/netherlands): Bekijk de taken van AFM en DNB, CASP-aanvraagdocumenten en bewijsstukken voor IT/DORA, bedrijfscontinuïteit en vermogensscheiding.
- [Italy DeFi Regulation: Consob and Banca d’Italia | DeFiSec](https://defisec.info/regulation/italy): Choose an Italian CASP procedure by entity and service. Review Consob and Banca d’Italia roles, notification, application evidence and operational controls.
- [DeFi in Italia: Consob, Banca d’Italia e CASP | DeFiSec](https://defisec.info/it/regulation/italy): Individua il procedimento CASP per soggetto e servizio: ruoli di Consob e Banca d’Italia, notifica, documentazione e controlli operativi.
- [Spain DeFi Regulation: CNMV and Provider Checks | DeFiSec](https://defisec.info/regulation/spain): Verify a crypto provider in Spain: current permission, legal entity, authorized services, white papers and technical integration evidence.
- [DeFi en España: CNMV y verificación de proveedores | DeFiSec](https://defisec.info/es/regulation/spain): Verifica un proveedor de criptoactivos en España: entidad jurídica, habilitación, servicios, libros blancos y seguridad de la integración.
- [Ireland DeFi Regulation: CASP and Local Substance | DeFiSec](https://defisec.info/regulation/ireland): Prepare an Irish CASP file: Central Bank Portal, KFD, local accountability, ICT dependencies and operational readiness evidence.
- [Luxembourg DeFi Regulation: CSSF and White Papers | DeFiSec](https://defisec.info/regulation/luxembourg): Separate Luxembourg CASP and issuer procedures. Review token classification, CSSF eDesk white paper notification and technical evidence.
- [DeFi au Luxembourg : CSSF et livres blancs | DeFiSec](https://defisec.info/fr/regulation/luxembourg): Distinguez les procédures PSCA et émetteur au Luxembourg : classification du jeton, notification eDesk à la CSSF et preuves techniques.
- [DORA for CASPs: Evidence and ICT Register | DeFiSec](https://defisec.info/regulation/topics/dora-casp-evidence): Map DORA governance, testing, incidents and ICT supplier arrangements to evidence. Download a preparation worksheet and distinguish routine tests from TLPT.
- [EU Travel Rule: CASPs and Self-Hosted Wallets | DeFiSec](https://defisec.info/regulation/topics/travel-rule-self-hosted-wallets): Regulation 2023/1113: distinguish CASP transfer information, identity checks and self-hosted address-control assessment. Includes a scenario worksheet.
- [DAC8: Reporting Data and the 2026-2027 Timeline | DeFiSec](https://defisec.info/regulation/topics/dac8-crypto-reporting): DAC8 starts with 2026 activity. Map tax residence and transactions; distinguish domestic filing from the 30 September 2027 exchange between authorities.
- [RWA Tokens: MiCA or MiFID II Classification | DeFiSec](https://defisec.info/regulation/topics/rwa-mica-mifid): Classify token rights before choosing a regulatory route. Compare securities, pooled investments and MiCA assets, then map the outcome to technical controls.
- [Data Act Article 36: Smart Contracts and Scope | DeFiSec](https://defisec.info/regulation/topics/data-act-smart-contracts): Article 36 covers data-sharing agreements. Check the proposed Digital Omnibus deletion and map current requirements to control evidence and responsible parties.
- [France Smart Contract Certification: ACPR-AMF | DeFiSec](https://defisec.info/regulation/topics/france-smart-contract-certification): ACPR-AMF working-group research: understand proposed principles, audit methods and certification scenarios. Prepare evidence with a scope worksheet.
- [Smart contracts : travaux ACPR-AMF en France | DeFiSec](https://defisec.info/fr/regulation/topics/france-smart-contract-certification): Distinguez les propositions du groupe ACPR-AMF, les méthodes d’audit et les scénarios de certification. Une grille aide à définir le périmètre des preuves.
- [Malta MDIA TARF: Assessment Levels and Evidence | DeFiSec](https://defisec.info/regulation/topics/malta-mdia-tarf): Compare TARF levels 0-3, assessors and recognition outcomes. Prepare an IDPS blueprint and distinguish MDIA technology assessment from CASP authorization.
- [MiCA Review 2026: DeFi Questions and Legal Status | DeFiSec](https://defisec.info/regulation/topics/mica-review): The consultation closes 30 September 2026. Read the DeFi certification questions and prepare a product impact worksheet while tracking the legal status.
- [Austria DeFi Regulation: FMA CASP Application | DeFiSec](https://defisec.info/regulation/austria): Prepare an Austrian CASP file: FMA submission, document languages, custody outsourcing and a worksheet linking application answers to evidence.
- [Lithuania DeFi Regulation: CASP Readiness | DeFiSec](https://defisec.info/regulation/lithuania): Distinguish Lithuanian CASP licensing from former VASP registration. Review governance, funding and outsourced controls with a readiness worksheet.
- [Hungary DeFi Regulation: MNB and Validation Repeal | DeFiSec](https://defisec.info/regulation/hungary): Check MNB authorization, ERA submissions and the 2026 repeal of Hungary’s exchange-validation regime. Build a dated control and permission record.
- [Poland DeFi Regulation: KNF Status and EU Access | DeFiSec](https://defisec.info/regulation/poland): Read the KNF authority-gap position, distinguish Polish applications from EU cross-border services and verify the permission behind a provider’s offer.
- [Belgium DeFi Regulation: FSMA and NBB Routes | DeFiSec](https://defisec.info/regulation/belgium): Identify FSMA or NBB competence, distinguish CASP authorization from notification and map the Belgian procedure to customer and technical evidence.
- [Estonia DeFi Regulation: CASP Portal and Evidence | DeFiSec](https://defisec.info/regulation/estonia): Use Estonia’s CASP application portal, check document languages and distinguish the processing fee from capital. Prepare a submission evidence worksheet.
- [Czechia DeFi Regulation: CNB Routes and Token Scope | DeFiSec](https://defisec.info/regulation/czechia): Separate CNB CASP applications, institutional notifications and token classification. Examine liquidation rights and prepare a Czech regulatory evidence map.
- [Portugal DeFi Regulation: Banco de Portugal and CMVM | DeFiSec](https://defisec.info/regulation/portugal): Map Portugal’s MiCA responsibilities between Banco de Portugal and CMVM. Prepare CASP application, conduct and security evidence for a coordinated review.
- [DeFi in Österreich: CASP-Antrag bei der FMA | DeFiSec](https://defisec.info/de/regulation/austria): Den österreichischen CASP-Antrag vorbereiten: FMA-Einreichung, Dokumentensprache, ausgelagerte Verwahrung und eine Arbeitstabelle für Nachweise.
- [DeFi Lietuvoje: pasirengimas CASP licencijai | DeFiSec](https://defisec.info/lt/regulation/lithuania): Atskirkite CASP licenciją nuo ankstesnės VASP registracijos. Įvertinkite valdyseną, finansavimą ir perduotų funkcijų kontrolę pagal praktinę lentelę.
- [DeFi Magyarországon: MNB és a validálás kivezetése | DeFiSec](https://defisec.info/hu/regulation/hungary): MNB-engedélyezés, ERA-beadványok és a kriptoátváltás validálási rendszerének 2026-os megszüntetése. Engedélyek és technikai kontrollok ellenőrző táblázata.
- [DeFi w Polsce: stanowisko KNF i dostęp z UE | DeFiSec](https://defisec.info/pl/regulation/poland): Sprawdź stanowisko KNF, odróżnij krajowy wniosek od usług transgranicznych w UE i zweryfikuj uprawnienia podmiotu oferującego usługi krypto.
- [DeFi en Belgique : procédures FSMA et BNB | DeFiSec](https://defisec.info/fr/regulation/belgium): Identifiez la compétence de la FSMA ou de la BNB, distinguez agrément et notification CASP et préparez les preuves clients et techniques du dossier.
- [DeFi in België: FSMA- en NBB-procedures | DeFiSec](https://defisec.info/nl/regulation/belgium): Bepaal de bevoegdheid van FSMA of NBB, onderscheid een CASP-vergunning van een kennisgeving en koppel de procedure aan klant- en technisch bewijs.
- [DeFi Eestis: CASP-i taotlusportaal ja tõendid | DeFiSec](https://defisec.info/et/regulation/estonia): Kasutage Eesti CASP-i taotlusportaali, kontrollige dokumentide keelt ja eristage menetlustasu kapitalist. Koostage taotluse tõendite tööleht.
- [DeFi v Česku: postupy ČNB a klasifikace tokenů | DeFiSec](https://defisec.info/cs/regulation/czechia): Rozlište žádost CASP, oznámení finanční instituce a klasifikaci tokenu. Posuďte právo na vypořádání při likvidaci a připravte mapu důkazů.
- [DeFi em Portugal: Banco de Portugal e CMVM | DeFiSec](https://defisec.info/pt/regulation/portugal): Identifique as competências MiCA do Banco de Portugal e da CMVM. Prepare provas de autorização CASP, conduta e segurança para uma análise coordenada.
- [Bulgaria DeFi Regulation: FSC CASP Application | DeFiSec](https://defisec.info/regulation/bulgaria): Prepare a Bulgarian CASP application: FSC and BNB roles, Bulgarian documents, custody controls and a worksheet linking policies to operating evidence.
- [Croatia DeFi Regulation: Hanfa CASP Preparation | DeFiSec](https://defisec.info/regulation/croatia): Understand Hanfa’s optional preliminary meeting, formal CASP application and current permission checks. Build a Croatian service and management evidence file.
- [Cyprus DeFi: CySEC, CBC and EMT Services | DeFiSec](https://defisec.info/regulation/cyprus): Map CySEC and CBC responsibilities, prepare Form 2 attachments and examine EMT custody or transfers under the separate payment-services framework.
- [Denmark DeFi: Finanstilsynet Control Principles | DeFiSec](https://defisec.info/regulation/denmark): Use Danish supervisory principles to assess DeFi control, interface operators and present autonomy. Prepare a service map for a MiCA filing through Virk.
- [Finland DeFi Regulation: FIN-FSA AML Evidence | DeFiSec](https://defisec.info/regulation/finland): Prepare Finnish CASP AML evidence: separate risks, sanctions, accountable staff, policy controls and effectiveness reviews aligned with adopted EU standards.
- [Greece DeFi: HCMC, Bank of Greece and EMT | DeFiSec](https://defisec.info/regulation/greece): Compare Article 60 notifications and CASP applications in Greece. Map institutional status, EMT payment functions and evidence for service classification.
- [Latvia CASP: Latvijas Banka Application | DeFiSec](https://defisec.info/regulation/latvia): Prepare a Latvian CASP file: free consultation, review fees, continuity tests and ICT suppliers. Separate application costs from ongoing supervision.
- [Romania DeFi Regulation: DAC8 Reporting and ANAF | DeFiSec](https://defisec.info/regulation/romania): Prepare Romanian DAC8 reporting for 2026: 15 March 2027 deadline, tax-residence evidence and ANAF submissions. Separate tax duties from MiCA permission.
- [Slovakia DeFi Regulation: NBS CASP Readiness | DeFiSec](https://defisec.info/regulation/slovakia): Avoid NBS CASP application gaps: incorrect service classification, nominal management and untested technical arrangements. Prepare the Slovak evidence file.
- [Slovenia DeFi Regulation: ATVP and Banka Slovenije | DeFiSec](https://defisec.info/regulation/slovenia): Map Slovenia’s ZIUTK responsibilities between ATVP and Banka Slovenije. Prepare CASP, EMT and outsourced-process evidence after the MiCA transition.
- [Sweden DeFi: FI CASP Application Language | DeFiSec](https://defisec.info/regulation/sweden): Prepare a Swedish CASP file: Swedish policies, the English ICT-contract exception, FI case references and current permission checks after the transition.
- [DeFi в България: заявление за CASP пред КФН | DeFiSec](https://defisec.info/bg/regulation/bulgaria): Подгответе заявление за CASP в България: компетентност на КФН и БНБ, документи на български, контрол върху активите и доказателства за дейността.
- [DeFi u Hrvatskoj: priprema zahtjeva Hanfi | DeFiSec](https://defisec.info/hr/regulation/croatia): Razumijte neobvezni prethodni sastanak s Hanfom, formalni zahtjev za CASP i provjeru odobrenja. Pripremite dokaze o uslugama i upravi.
- [DeFi στην Κύπρο: CySEC, ΚΤΚ και υπηρεσίες EMT | DeFiSec](https://defisec.info/el/regulation/cyprus): Χαρτογραφήστε τις αρμοδιότητες CySEC και ΚΤΚ, τα παραρτήματα του Form 2 και τις υπηρεσίες πληρωμών που συνδέονται με φύλαξη ή μεταφορές EMT.
- [DeFi i Danmark: decentralisering og MiCA | DeFiSec](https://defisec.info/da/regulation/denmark): Brug danske tilsynsprincipper til at vurdere DeFi-kontrol, brugerflader og faktisk autonomi. Forbered et servicekort til en MiCA-indsendelse via Virk.
- [DeFi Suomessa: Finanssivalvonnan AML-aineisto | DeFiSec](https://defisec.info/fi/regulation/finland): Valmistele suomalaisen CASP-hakemuksen AML-aineisto: erilliset riskit, pakotteet, vastuuhenkilöt, kontrollit ja tehokkuusarviot EU-standardien mukaisesti.
- [DeFi στην Ελλάδα: ΕΚ, Τράπεζα της Ελλάδος και EMT | DeFiSec](https://defisec.info/el/regulation/greece): Προσδιορίστε τις αρμοδιότητες της Επιτροπής Κεφαλαιαγοράς και της Τράπεζας της Ελλάδος για υπηρεσίες κρυπτοστοιχείων και λειτουργίες πληρωμών EMT.
- [DeFi Latvijā: Latvijas Bankas CASP pieteikums | DeFiSec](https://defisec.info/lv/regulation/latvia): Nošķiriet bezmaksas sākotnējo konsultāciju, dokumentu izskatīšanas maksu un uzraudzību. Sagatavojiet CASP darbības nepārtrauktības un IKT pierādījumus.
- [DeFi în România: raportarea DAC8 și ANAF | DeFiSec](https://defisec.info/ro/regulation/romania): Pregătiți raportarea DAC8 pentru 2026: termenul de 15 martie 2027, dovezile rezidenței fiscale și ANAF. Separați obligațiile fiscale de autorizarea MiCA.
- [DeFi na Slovensku: pripravenosť žiadosti NBS | DeFiSec](https://defisec.info/sk/regulation/slovakia): Predíďte nedostatkom žiadostí CASP: nesprávnej klasifikácii služieb, formálnemu vedeniu a neovereným technickým riešeniam. Pripravte dôkazy pre NBS.
- [DeFi v Sloveniji: ATVP in Banka Slovenije | DeFiSec](https://defisec.info/sl/regulation/slovenia): Razmejite pristojnosti po ZIUTK med ATVP in Banko Slovenije. Pripravite dokazila za CASP, EMT in zunanje izvajanje po prehodnem obdobju MiCA.
- [DeFi i Sverige: språk i FI:s CASP-ansökan | DeFiSec](https://defisec.info/sv/regulation/sweden): Förbered en svensk CASP-ansökan: svenska policyer, undantaget för engelska IKT-avtal, FI:s ärendenummer och behörighet efter övergångsperioden.
- [DeFi dans l’UE : périmètre et guides nationaux | DeFiSec](https://defisec.info/fr/regulation): Identifiez l’acteur, le service et le jeton avant de choisir une procédure. Comparez les démarches nationales et reliez les contrôles aux preuves.
- [DeFi in der EU: Geltungsbereich und Länderleitfäden | DeFiSec](https://defisec.info/de/regulation): Bestimmen Sie Akteur, Dienstleistung und Token vor der Verfahrenswahl. Vergleichen Sie nationale Abläufe und verbinden Sie Kontrollen mit Nachweisen.
- [DeFi in de EU: reikwijdte en landengidsen | DeFiSec](https://defisec.info/nl/regulation): Bepaal actor, dienst en token voordat u een procedure kiest. Vergelijk nationale routes en verbind beveiligingsmaatregelen met aantoonbaar bewijs.
- [DeFi nell’UE: ambito e guide nazionali | DeFiSec](https://defisec.info/it/regulation): Identifica soggetto, servizio e token prima di scegliere la procedura. Confronta i percorsi nazionali e collega i controlli di sicurezza alle prove.
- [DeFi en la UE: alcance y guías nacionales | DeFiSec](https://defisec.info/es/regulation): Identifica al actor, el servicio y el token antes de elegir el procedimiento. Compara las vías nacionales y vincula los controles con pruebas documentadas.
- [DeFi f’Malta: MFSA, MDIA u evidenza teknika | DeFiSec](https://defisec.info/mt/regulation/malta): Issepara l-proċedura tal-MFSA għall-fornituri mill-valutazzjoni teknoloġika tal-MDIA. Qabbel l-ambitu u ħejji inventarju tal-evidenza.
- [DeFi in Éirinn: CASP, KFD agus fianaise | DeFiSec](https://defisec.info/ga/regulation/ireland): Ullmhaigh comhad CASP Éireannach: Tairseach an Bhainc Ceannais, KFD, cuntasacht áitiúil, spleáchais TFC agus fianaise ullmhachta oibríochtúla.
- [DeFi in Luxemburg: CSSF, eDesk und Token-Einstufung | DeFiSec](https://defisec.info/de/regulation/luxembourg): Trennen Sie Luxemburger CASP- und Emittentenverfahren. Prüfen Sie Token-Einstufung, Whitepaper-Notifizierung über CSSF eDesk und technische Nachweise.
- [DeFi zu Lëtzebuerg: CSSF, eDesk an Token | DeFiSec](https://defisec.info/lb/regulation/luxembourg): Trennt d’CASP- an d’Emittenteprozeduren. Préift d’Token-Klassifikatioun, d’Whitepaper-Notifikatioun iwwer CSSF eDesk an déi technesch Beweiser.
- [DeFi in Belgien: FSMA, NBB und CASP-Verfahren | DeFiSec](https://defisec.info/de/regulation/belgium): Bestimmen Sie die Zuständigkeit von FSMA oder NBB. Trennen Sie CASP-Zulassung und Anzeige und verbinden Sie das Verfahren mit Kunden- und Techniknachweisen.
- [DeFi i Finland: Finansinspektionens AML-underlag | DeFiSec](https://defisec.info/sv/regulation/finland): Förbered finska CASP-underlag: separata risker, sanktioner, ansvarig personal, kontroller och effektivitetsgranskning enligt antagna EU-standarder.
- [Smart contract static analysis: compare source analyzers | DeFiSec](https://defisec.info/tools/static-analysis): Compare Slither, Aderyn and Semgrep rules by build input and review output. Use detector confidence separately from impact when triaging a finding.
- [Smart contract fuzzing tools: choose a harness and campaign | DeFiSec](https://defisec.info/tools/fuzzing): Compare Echidna, Medusa and Foundry for invariant testing. Work through a published Echidna fixture and define the evidence a failing sequence must retain.
- [Formal verification tools: specifications and proof boundaries | DeFiSec](https://defisec.info/tools/formal-verification): Compare Certora Prover, Solidity SMTChecker and Kani. Distinguish a counterexample from an unknown result and record the assumptions behind each property.
- [Solana security tools: instruction tests, fuzzing and builds | DeFiSec](https://defisec.info/tools/solana): Compare Mollusk, Trident and solana-verify. Separate account-state checks from binary correspondence with a walkthrough of a published Mollusk example.
- [Transaction simulation tools: preserve state and inspect effects | DeFiSec](https://defisec.info/tools/transaction-simulation): Compare Tenderly, Phalcon Explorer and Sentio. Record transaction inputs and state overrides so a simulation can be reviewed against its exact context.
- [On-chain monitoring tools: detection rules and delivery checks | DeFiSec](https://defisec.info/tools/monitoring): Compare OpenZeppelin Monitor, Forta and Hypernative. Define alert ownership, RPC recovery and notification evidence before relying on a monitoring rule.
- [Web3 incident response tools: evidence and containment preparation | DeFiSec](https://defisec.info/tools/incident-response): Compare transaction evidence, alerts and multisig batch preparation. Separate investigation artifacts from authorized containment and recovery claims.
- [Wallet security tools: approvals and transaction inspection | DeFiSec](https://defisec.info/tools/wallet-security): Compare Revoke.cash, Rabby and Pocket Universe. Inspect an address before connecting a wallet and distinguish approval revocation from transaction preview.
- [Web3 security tools: page 2 | DeFiSec](https://defisec.info/tools/page/2): Browse the Web3 security tools directory by task, ecosystem, format and source status.
- [Web3 security tools: page 3 | DeFiSec](https://defisec.info/tools/page/3): Browse the Web3 security tools directory by task, ecosystem, format and source status.
- [Web3 security tools: page 4 | DeFiSec](https://defisec.info/tools/page/4): Browse the Web3 security tools directory by task, ecosystem, format and source status.
- [Web3 security tools: page 5 | DeFiSec](https://defisec.info/tools/page/5): Browse the Web3 security tools directory by task, ecosystem, format and source status.
- [Web3 security tools: page 6 | DeFiSec](https://defisec.info/tools/page/6): Browse the Web3 security tools directory by task, ecosystem, format and source status.
- [Web3 security tools: page 7 | DeFiSec](https://defisec.info/tools/page/7): Browse the Web3 security tools directory by task, ecosystem, format and source status.