0xMacro

Macro (0xMacro) is a deliberately small smart contract audit team that describes its specialty as long-term, recurring security coverage for the same clients rather than one-off engagements. Its public library links to 175 distinct public audit report pages (counted from the library page on 2026-09-24), many of them numbered repeat engagements with the same protocol (for example 20 thirdweb reports and 11 Superstate reports), which is the clearest evidence of the recurring-partner model it advertises. It fits EVM teams that ship frequent upgrades and want the same reviewers each time; it has also recently published reports covering Solana programs.

At a glance

Founded	not verified (not stated on the firm's own pages)
Headquarters / jurisdiction	not published
Engagement model	private firm audit, with emphasis on recurring partnerships (homepage)
Core specialties	smart contract and Solana program audits, architecture review, protocol design, gas optimization (homepage)
Ecosystems / languages	EVM (Solidity); Solana (Rust) in recent reports (Stablecoin.xyz A-2)
Public report index	0xmacro.com/library
Open-source tooling	awesome-solana-security resource list, trim EVM language experiment (GitHub)
Published pricing	not published (homepage says only that pricing is "competitive")

What they do

Macro's homepage lists smart contract and Solana program audits, early-stage architecture review, protocol design consultation, gas optimization audits and stablecoin protocol development (homepage). The firm says it welcomes one-off audits but that its specialty is long-term partnerships with recurring clients, and it describes keeping headcount small on purpose to hold quality (homepage).

Reports follow a consistent structure: an initial and final commit hash, a timeline that separates the audit window from the fix-review window, and a stated scope limitation. The Stablecoin.xyz A-2 report, for example, ran August 4-11, 2026 with fix review through August 29, and explicitly excludes deployment scripts and infrastructure configuration from scope (Stablecoin.xyz A-2). Some engagements are listed in the library but marked as private reports (library).

Specialties and ecosystem coverage

The public library is dominated by Solidity/EVM work: thirdweb, Maple Finance, Superstate and Polynomial each appear as multi-report series (library). Solana coverage is visible in recent work, including the Stablecoin.xyz A-2 audit, which covered Solidity contracts on Base and Rust programs on Solana plus off-chain solver and attestor components (Stablecoin.xyz A-2), and library descriptions mentioning a Solana version of a Boring Vault and a Solana program running on Eclipse (library). The firm also maintains a public Solana security resource list on GitHub (GitHub).

The directory lists Ethereum, Polygon, Arbitrum, Optimism and Base. EVM and Base are evidenced; individual reports frequently do not name a deployment chain (e.g. KatanaPerps A-1, Maple A-6), so per-L2 coverage is not directly confirmed. Solana is evidenced but not in the directory's chain list.

Recent public work

Pulled from the 0xMacro library, newest first, public reports only:

• Stablecoin.xyz A-2, presented September 6, 2026: cross-chain intents system on Base and Solana; 2 critical, 3 high, 5 medium, 7 low findings, all addressed (report)
• Silicon A-4, March 12, 2026 (library)
• KatanaPerps A-1, dated March 11, 2026 (review windows January 19-26 and February 11-16, 2026): Solidity perpetuals contracts; 8 low and 1 informational finding (report)
• Sapience A-1, February 26, 2026 (library)
• Superstate A-11, February 25, 2026 (library)
• Polynomial A-9, February 4, 2026 (library)
• Fleek A-2, December 2, 2025 (library)
• Superstate A-10, November 11, 2025 (library)
• Maple Finance A-6, September 15-18, 2025: GovernorTimelock contracts; 1 low finding, addressed (report)

There is a gap in listed public reports between March and September 2026.

Research, tooling and methodology

Macro publishes a five-tier severity scheme in its reports: Critical, High, Medium, Low and Code Quality, each with a written definition tied to fund loss or spec violation (Stablecoin.xyz A-2).

Its GitHub organization holds 60+ repositories, including awesome-solana-security (a maintained resource list), trim (an opcode-oriented language compiling to the EVM), a fork of the Soufflé Datalog engine, and the source for the public library itself (GitHub). The blog contains security write-ups such as a Synthetix staking rewards issue found during an audit, an Echidna fuzzing guide and a guide to preparing for an audit, but the most recent post found is from March 2023 (blog).

Track record and incidents

No reputable post-audit incident naming Macro as the auditor of exploited code was found in this pass.

Who should consider them — and who might look elsewhere

The strongest public evidence is repeat Solidity work for the same clients over many releases, which matches the firm's stated preference for recurring partnerships. Teams that ship frequent upgrades and want continuity of reviewers are the clearest fit. Solana and cross-chain work is present but more recent and less extensive in the public record. Teams needing formal verification, ZK circuit review, Move or Cairo audits, or monitoring/incident response services will find no public evidence of those here.

How to engage

The homepage offers an audit inquiry form and lists a Telegram contact for audit requests (homepage). Based on how its reports are structured, be ready to provide a repository and fixed commit hash, a clear in-scope file list, and time for a fix-review window after the initial audit (Stablecoin.xyz A-2).

Gaps and unverified claims

• Founding year, headquarters and team size are not published on the firm's own pages.
• Pricing is not published.
• The directory lists Superfluid as a notable audit; no Superfluid report was found in the public library as of 2026-09-24.
• Several library entries are marked as private reports, so the public list understates total engagements.
• The blog has no posts after March 2023 found in this pass.
• The 175 figure was counted by extracting distinct /library/audits/ links from the library page on 2026-09-24; it excludes private-report entries.

Sources

1. 0xMacro homepage, accessed 2026-09-24
2. 0xMacro library (public audit index), accessed 2026-09-24
3. Stablecoin.xyz A-2 audit report, accessed 2026-09-24
4. KatanaPerps A-1 audit report, accessed 2026-09-24
5. Maple Finance A-6 audit report, accessed 2026-09-24
6. 0xMacro GitHub organization, accessed 2026-09-24
7. 0xMacro blog, accessed 2026-09-24