Ackee Blockchain

Ackee Blockchain Security is a Prague-based audit firm that works across Solidity/EVM and Solana, and builds its own open-source testing frameworks for both: Wake (Python, Solidity) and Trident (Rust, Solana fuzzing). It fits teams that want manual review combined with fuzz testing, particularly on Solana, where Trident-based engagements such as Kamino Lend are published. Its GitHub reports repository held 97 PDF reports spanning 2021 to 2026 when counted on 2026-09-24.

At a glance

Founded	2021 per CEO Josef Gattermayer ("Founded Ackee Blockchain Security in 2021", Arbitrum forum, 2025-09-18); the firm's own pages state no year, and the homepage metrics are described as internal statistics starting 2021
Headquarters / jurisdiction	Prague, Czech Republic; company Ackee Blockchain a. s. (contact/impressum)
Engagement model	private firm audit, plus fuzz-testing engagements (homepage)
Core specialties	smart contract audits with manual review and fuzzing; security tooling; security education (homepage)
Ecosystems / languages	EVM (Solidity), Solana (Rust)
Public report index	public audits list; GitHub reports repo
Open-source tooling	Wake, Trident, Solidity and Solana VS Code extensions (GitHub)
Published pricing	not published

What they do

Ackee's homepage lists three service lines: smart contract auditing for Solana, Ethereum and EVM projects using manual code review and fuzz testing; security tooling development, which it says has received grants from Coinbase and the Solana Foundation; and blockchain security education, including teaching at Czech Technical University, the School of Solana and a Solana Auditors Bootcamp (homepage). The homepage also advertises Wake Arena and Trident Arena, which it describes as AI-assisted audit platforms (homepage).

The firm publishes self-reported metrics on its homepage: "269 criticals and highs in 104 audits" and, on the same page as of 2026-10-14, "across 220 audits ... over 2500 issues" (homepage). These are the firm's own figures, the two audit counts are not reconciled on the page, and neither was independently checked.

Published audit summaries show engagements sized in engineering days (9 engineering days for Omnipair) and pinned to specific commits, with a fix-review round (Omnipair summary, Kamino Lend summary).

Specialties and ecosystem coverage

Both ecosystems the firm names are visible in its public output. The GitHub reports repository includes Ethereum/EVM work for Lido, Safe, Axelar, LayerZero, Rhinestone, Aave (Umbrella) and CoW Protocol, and Solana work for Marinade, Kamino Lend and MetaDAO (reports repo). Recent blog summaries cover Solana protocols (Omnipair, Onre) and Ethereum ones (Everstake, Lido) (blog).

Against the directory's listing: Ethereum and Solana are confirmed. The repository includes a Lido stETH-on-Optimism report (reports repo); Polygon and Arbitrum coverage is not directly evidenced in report titles. Of the directory's notable audits, Lido, Safe, Aave and Kamino have public reports; no audit for the Solana Foundation itself was found, though the firm describes an education and grant relationship with it (homepage).

Recent public work

Pulled from the Ackee blog and the GitHub reports repo:

• Omnipair oracle-less lending (Solana), audited November 6-21, 2025, summary published March 3, 2026: 1 high, 1 medium, 3 warnings (summary)
• Onre tokenized (re)insurance pools (Solana), summary January 30, 2026 (blog)
• Everstake ETH2 batch deposit contract, summary January 20, 2026 (blog)
• Kamino Lend fuzz tests (Solana, Trident), rounds January and June-July 2025, summary January 14, 2026: 6 warnings, 1 informational (summary)
• Lido Triggerable Withdrawals, summary October 27, 2025 (blog)
• 2026 reports in the repository: Lido Vault Wrapper, MetaDAO, Zodial (reports repo)
• 2025 reports in the repository include Aave Umbrella, Lido CSM v2, Safe Smart Account, CoW flash loan router and Lombard Liquid Bitcoin (reports repo)

Research, tooling and methodology

Ackee maintains Wake, a Python-based Solidity development and fuzz testing framework with built-in vulnerability detectors, and Trident, a Rust framework for fuzzing Solana programs; both were updated in 2026 (GitHub). It also publishes VS Code extensions for Solidity and Solana (GitHub). Recent blog posts introduce Wake Arena and Trident Arena as multi-agent AI audit tools (blog).

The Kamino Lend summary describes a published fuzzing method: interface analysis, invariant definition, stateful testing and extended fuzz campaigns (Kamino Lend summary). Findings are rated on a two-axis impact and likelihood scheme, with a "Warning" tier below Low (Omnipair summary).

Track record and incidents

Zunami Protocol, an Ackee client, was exploited on August 13, 2023 for 1,204 WETH across its zETH and UZD products. Ackee's own post-mortem states it audited UZD version 1.0, that the exploited price-caching logic was extended in version 1.1, which "was launched without any audit", and that the attacked MIMCurveStakeDao strategy was added in a later commit (Ackee post-mortem). On the firm's account, the exploited code was outside the audited version. This pass relied on the firm's own write-up; an independent source confirming the scope was not loaded. No other post-audit incident naming Ackee was found.

Who should consider them — and who might look elsewhere

The strongest public evidence is in Solidity protocol work for staking and account-abstraction projects (Lido, Safe, Rhinestone) and in Solana programs where fuzz testing with the firm's own Trident framework is part of the engagement. Teams that want to keep using the same fuzzing harness after the audit may find the open-source tooling useful. There is little public evidence of Move, Cairo, ZK circuit, formal verification, or ongoing monitoring and incident-response services.

How to engage

Use the contact form at ackee.xyz/contact. The page does not list what to prepare; based on the published summaries, expect scoping to a fixed commit with external dependencies excluded, and a fix-review round (Omnipair summary).

Gaps and unverified claims

• Founding year is not stated on the firm's own pages. The directory lists 2021, from the CEO's statement on the Arbitrum forum (it previously listed 2017, which no source supports).
• Team size is not published; the homepage lists an executive team only.
• Pricing and turnaround are not published.
• Homepage metrics (104 audits and 220 audits on the same page, $180B+ TVL protected, 2,500+ issues) are self-reported.
• The public audits list page carries an original publication date of May 20, 2023 and is described as continuously updated; its entry count was not verified precisely.
• The 97 figure was counted via the GitHub API tree of public-audit-reports on 2026-09-24 (PDF files only).
• No audit for the Solana Foundation itself was found.

Sources

1. Ackee Blockchain homepage, accessed 2026-09-24
2. Contact and impressum, accessed 2026-09-24
3. List of public Ackee audits, accessed 2026-09-24
4. Ackee GitHub organization, accessed 2026-09-24
5. public-audit-reports repository, accessed 2026-09-24
6. Ackee blog index, accessed 2026-09-24
7. Omnipair audit summary, accessed 2026-09-24
8. Kamino Lend fuzz tests summary, accessed 2026-09-24
9. Zunami hack post-mortem, accessed 2026-09-24
10. Arbitrum forum: Josef Gattermayer, Security Council candidacy (founded 2021), accessed 2026-10-14