Launching a Protocol? Don't Get Hacked.
Get matched with the right auditor, find the tools your team needs, and learn from $2B+ in exploit postmortems — curated by practitioners since 2017.
One sponsor slot on this page. Labeled, never mixed into our rankings.
Sponsor this page →Featured Resources
Curated picks from our directory
Top Security Tools*
- Slither
Static analysis framework for Solidity smart contracts. Detects vulnerabilities, optimizes gas usage, and suggests code improvements.
- Echidna
Echidna is a Haskell fuzzer for Ethereum smart contracts that builds ABI call sequences to falsify invariants, Solidity assertions, or Foundry-style tests. Use it when you can name a property — an echidna_ function, an assert, or a Foundry test — and want a minimized call sequence if the campaign breaks it.
- Forta
Forta is an onchain risk platform: Forta Risk maps and monitors dependencies behind assets, and Forta Firewall screens transactions at the sequencer. Use Forta Risk for ongoing exposure alerts, or Firewall when undesired transactions should be stopped before execution.
- Mythril
Symbolic execution tool for EVM bytecode analysis. Detects security vulnerabilities in Ethereum smart contracts.
- Hypernative
Real-time Web3 threat detection and prevention platform using proprietary ML models. Detects cyber, economic, governance, and community threats before they have impact.
- Blockaid
Blockaid screens transactions, dApps, and tokens in real time for scams, fraud, exploits, and compliance risk. Wallets use it for end-user protection; protocol and wallet operators use onchain monitoring and Cosigner when they need programmatic policy checks.
- Flashbots Protect
Flashbots Protect submits transactions to a private mempool so they are hidden from frontrunning and sandwich bots, and it can refund MEV or priority fees. Point eth_sendRawTransaction at rpc.flashbots.net/fast when a transaction should stay out of the public mempool; reverted transactions are not included and are not charged.
- GoPlus Security
GoPlus Security APIs return token, address, approval, NFT, dApp, and phishing-URL risk data, and can simulate a transaction on EVM chains and Solana. Call the token or address API before a transfer or an approval; the Token Security API for Solana is marked Beta in the docs.
- AuditAgent
AuditAgent is Nethermind's AI scanner for Solidity, Cairo, and Solana Rust. Run it on a repository, a deployed contract, in CI, or from an MCP client when you want a vulnerability report and suggested invariants before a manual audit.
- Arkham Intelligence
Arkham is a blockchain explorer that groups addresses into labeled entities and lets you graph and trace fund flows across chains. Use its alerts, token-holder views, or the Intel Exchange when you need the entity behind an address rather than a raw transaction list.
Featured Auditors*
- Trail of Bits
Rating: 4.9/5 · Est. 2012
- OpenZeppelin
Rating: 4.8/5 · Est. 2015
- Cyfrin
Rating: 4.7/5 · Est. 2022
- Spearbit
Rating: 4.8/5 · Est. 2021
- OtterSec
Rating: 4.7/5 · Est. 2021
- NCC Group
Rating: 4.5/5 · Est. 1999
- Pashov Audit Group
Rating: 4.7/5 · Est. 2023
- Cantina
Rating: 4.6/5 · Est. 2023
Security Feed
- UnverifiedCysic suspends bridge after attacker mints tokens and moves $727,000 to Ethereum
t.me/unfolded_defi
- Unverifiedupbit hacker bypassed railgun “ZK proof of innocence” (last year) - link
t.me/Web3privacyy
- UnverifiedTrezor cuts resellers after supply-chain incidents, stresses no device compromise
t.me/unfolded
- UnverifiedDWF Labs-linked firms sue BitGo for $141mn over alleged token lock-up breach
t.me/unfolded_defi
- ConfirmedKelpDAO LayerZero — Compromised RPC infrastructure feeding data into a single verifier setup
Arbitrum · $292M
- Confirmed
Drift Protocol — Social engineering + oracle manipulation
Solana · $285M
- Confirmed
Venus — On-chain + off-chain exploit
BNB Chain · $2.18M
Confirmed incidents are cited and verified. Unverified items are public community reports, shown for awareness only — follow the link before acting on one.
* How we rank: Tools are scored on community adoption (GitHub stars, downloads), active maintenance, detection accuracy, and practitioner recommendations. Auditors are evaluated on public audit track record, severity of findings in audited protocols, post-audit exploit rate, transparency (public reports), and reputation among security researchers. No firm pays for ranking — sponsored placements are labeled as such, appear only in designated slots, and never affect a listing's position or score. See our full methodology.
Sponsored
Partners we have relationships with that can improve your security posture
Become a sponsorThe Founder's Path to Secure Launch
Three steps between your code and a safe deployment
Are You Rekt Test Ready?
The Rekt Test is the industry-standard security checklist every protocol should pass before launch. Answer a few quick questions to see where you stand.
Why Trust Us
Built on experience, maintained with integrity
Since 2017
Deep expertise in digital asset custody and smart contract auditing. We've navigated every market cycle and seen every attack vector.
No Conflicts
Independent advisory through Savy Advisors LLC. We don't sell audits or run a security firm — our recommendations are unbiased.
AI-Curated
Automated monitoring keeps our directory current. Tools, auditors, and threat data are continuously verified and updated.
Community
Connect with security researchers and practitioners
Secureum
Premier smart contract security bootcamp and community. Offers structured learning paths from Solidity basics to advanced auditing techniques.
Immunefi
Largest Web3 bug bounty platform. Connects security researchers with protocols offering bounties for vulnerability discoveries.
Spearbit
Distributed network of expert security researchers providing peer-reviewed smart contract audits through a decentralized guild model.