Skip to main content

​
Comprehensive Security Solutions by Spearbit and Cantina

Smart contract security audits are the cornerstone of secure onchain development. Whether you’re building decentralized protocols, financial applications, or ecosystem infrastructure, our expert networks provide tailored security assessments to uncover vulnerabilities before they become exploits. Spearbit delivers bespoke audits led by elite, hand-selected researchers who specialize in deep, manual security analysis. With 282 audits completed, 4500+ vulnerabilities found, and 119 projects secured, Spearbit focuses on high-end security audits with team sizes typically of 4-5 security researchers for complex, high-value deployments. Cantina offers flexible smart contract security audits through modular teams of solo security researchers, competitive formats, and collaborative audits. Cantina provides scalable audit formats that match your workflow and risk profile, from individual expert audits to structured competitive assessments. Both approaches ensure transparent, expert-led security audits that go beyond surface-level checks to uncover architectural weaknesses, specific edge cases, and logic flaws that typical audits miss.

​
Process Overview

An overview of how our team conducts comprehensive security audits of your smart contracts. This process aims to uncover vulnerabilities, evaluate the security of your code, and provide actionable insights to strengthen your system’s integrity.

​
Scoping and Information Gathering

In this stage, we focus on understanding your project’s unique needs. Our team will collect the necessary documentation, such as technical specifications, source code, and architecture details, to accurately scope the audit. This helps ensure that the audit addresses all critical areas of concern.

​
Statement of Work (SOW)

The Statement of Work (SOW) outlines the scope, deliverables, timelines, and responsibilities associated with the security audit. It serves as a contract between your organization and our team, ensuring transparency and mutual understanding throughout the process.

​
Kickoff

The kickoff phase happens after scoping, information gathering and signed SOW, where our team coordinates with your organization to finalize scope details and set expectations. During this phase, we’ll schedule meetings, clarify project goals, and align on deliverables before the security audit begins. For engagements longer than one week, we’ll also schedule a mid-audit sync to provide progress updates and address any emerging questions.

​
Security Audit Period

Once the audit is kicked off, the security researchers dive deep into your smart contracts, conducting a detailed examination for vulnerabilities, bugs, and potential exploits. This phase includes manual analysis, automated testing, and in-depth exploration of the codebase.

​
Communication Channels

Clear communication is essential throughout the audit process. We establish regular touchpoints of your preference with your organization, addressing questions, and providing status updates.

​
Fix Period

After the initial audit, our team provides feedback on any vulnerabilities discovered. Your development team then has a set period to address and patch these issues. During this period, we offer guidance and clarification to ensure fixes are properly implemented.

​
Findings Call

Once all issues have been addressed, we schedule a findings call. This session provides an opportunity for your team to discuss the audit findings, ask questions, and gain a deeper understanding of the identified vulnerabilities and how they were mitigated.

​
Final Report Delivery

Following the findings call, our team delivers a comprehensive final report summarizing all findings, remediation actions taken, and security recommendations. This report is designed to be clear, actionable, and useful for your team’s future security efforts.

​
Closeout Call

After report delivery, we conduct a closeout call focused on engagement feedback and quarterly business audit (QBR). This session allows us to gather feedback on the overall engagement experience and discuss your organization’s broader security strategy and future needs.