ConsenSys Diligence

Consensys Diligence is an Ethereum-focused smart contract audit team, launched inside Consensys in June 2017, that now describes itself as operating independently while remaining part of the Consensys family and continuing to secure MetaMask and Linea. It fits teams building on Ethereum and its rollups, especially wallet, staking and ZK infrastructure, that want a small senior team rather than a large bench. The strongest evidence-backed signal is its public archive of 146 audit reports going back to 2019, alongside a long record of open-source tooling (Mythril, Scribble, Surya) and published ZK fuzzing research.

At a glance

Founded	June 2017, launched by Consensys (About)
Headquarters / jurisdiction	not verified
Engagement model	Private firm audit; self-described "boutique" that declines some engagements (About)
Core specialties	Ethereum smart contract audits, MetaMask Snaps / delegation, rollup (Linea) and ZK systems, fuzzing
Ecosystems / languages	EVM (Solidity); ZK circuits/DSLs (Circom, gnark, Noir) per homepage and ZK fuzzing post
Public report index	diligence.security/audits
Open-source tooling	Mythril, Scribble, Surya, Solidity Visual Auditor, SWC Registry, smart-contract-best-practices (GitHub); MythX and Diligence Fuzzing marked archived (homepage)
Published pricing	not published

What they do

The homepage lists smart contract testing and audits, incident response planning, pre-audit security assessments, MetaMask Snap security reviews, and fuzzing for complex systems. It also markets three AI-assisted tiers built on an in-house agent called "Chonky": an agentic scan before audit, an expert audit supported by the agent, and continuous agentic scans. The About page says auditors "orchestrate AI agents through custom workflows" and verify every finding by hand, and that they deliberately do not audit every chain: "We're not chain-agnostic."

Reports follow a consistent template: executive summary, scope pinned to a commit hash, system overview, security specification (actors, trust model), findings with fix status, and a list of files in scope. Fix reviews are appended as dated updates. For example, the April 2026 cETH report records fix reviews on 20 and 26 May 2026 and confirms the reviewed code matches deployed addresses (cETH report). Reports are downloadable as JSON, CSV and (on some) PDF.

In a March 2026 post the firm said that "while now operating independently, we remain an integral part of the @Consensys family" (Fresh Paint, Deep Roots). The legal structure of that independence is not described.

Specialties and ecosystem coverage

Counting links on the public audits page on 2026-09-24 (extracting every link of the form /audits/YYYY/) gives 146 distinct reports: 2019 (12), 2020 (37), 2021 (25), 2022 (9), 2023 (25), 2024 (20), 2025 (13), 2026 (5). Recent work is concentrated on Linea (rollup, token, burn, yield manager, Poseidon2), MetaMask (delegation framework, permissions Snap, USD token) and Ethereum DeFi/staking (Lido V3, Intuition).

ZK work is visible in reports titled Linea Poseidon2, ZK Email Noir and Linea PLONK verifier, and in the fuzzing research below. The directory's "formal-verification" tag is only partly evidenced: the firm describes "fuzzing and formal methods" and maintains Scribble (runtime specification checking), but no formal verification engagements were identified in this pass.

The directory lists Polygon, Arbitrum, Optimism and Base. The firm's own framing is Ethereum and its L2s, and one 2026 report covers a system operating "across several blockchains, such as Ethereum Mainnet and its L2s" (NMT report), but no report was mapped specifically to each of those four chains.

Recent public work

From the public audits page, newest first, accessed 2026-09-24:

1. New Market Trading contracts — June 2026; Safe-based delegated DeFi execution, reviewed 1–16 June 2026, fixes reviewed 24 June (report).
2. cETH — April 2026; Ethereum-side bridge contracts for ETH on the Canton Network, 2 auditors x 4 days; one Medium and several Minor findings (report).
3. Linea Forced Transactions — February 2026 (index).
4. Linea Rollup Update — February 2026 (index).
5. Linea Poseidon2 — January 2026 (index).
6. Linea Yield Manager — December 2025 (index).
7. MetaMask Delegator Safe Module — November 2025 (index).
8. Intuition MultiVault v2 and Intuition TRUST token — September 2025 (index).
9. Lido V3 — August 2025 (index).

Older entries matching the directory's notable audits are also on the index: Aave Protocol V2 (2020), 1inch (2020–2024), EigenLayer (March 2023).

Research, tooling and methodology

• Tools. The GitHub org had 98 public repositories on 2026-09-24 (count shown on the org page). The most-starred are smart-contract-best-practices, Mythril (symbolic execution for EVM bytecode, updated April 2026), Surya, the VS Code Solidity auditor extension, Scribble and solidity-metrics. The homepage marks MythX and Diligence Fuzzing as archived.
• ZK fuzzing. The firm says co-founder Valentin Wüstholz's fuzzers have found more than 30 critical bugs in ZK compilers and zkVMs, covering Circom, gnark, Noir and Corset (blog, April 2026). The homepage lists academic papers with Prof. Maria Christakis's group, including a USENIX Security 2026 paper on zkVM testing and a CCS 2025 paper on fuzzing ZK circuit pipelines (homepage).
• Severity scheme. Reports label findings by severity (e.g. Medium, Minor, and unrated informational items) with fix status (Fixed/Acknowledged), as seen in the cETH report. Reports also reference the firm's Smart Contract Best Practices and the SWC Registry.
• Team. The About page lists 11 named people: CEO Tobias Vogel, a business development lead, an advisor, a platform engineer, a security researcher and six security engineers.

Track record and incidents

• Hedgey Finance (19 April 2024, about $45M notional). Hedgey's post-mortem says the exploited contract, ClaimCampaigns.sol, "was fully audited by Consensys Diligence". The root cause was that createLockedCampaign accepted an arbitrary locker address and raised its token allowance, and cancelCampaign never reduced it. Diligence's June–July 2023 report lists contracts/Periphery/ClaimCampaigns.sol among the files in scope at commit 6a5ff58c. This pass did not confirm whether the deployed contract matched the audited commit. rekt.news also covers the incident and names the audit. No public response from Diligence was found.
• Gamma Strategies. rekt.news notes a 2022 Diligence audit but says the bug came from per-pool price-change tolerance settings and "is likely out of scope."

An exploit after an audit is not by itself proof of a missed finding. In the Hedgey case, though, the exploited file appears in the audit's file list.

Who should consider them — and who might look elsewhere

The strongest public evidence is Ethereum mainnet and Linea work, MetaMask Snaps and delegation, staking (Lido V3) and ZK circuit/zkVM testing. Teams in those areas can check directly comparable reports on the index. The firm says it is not chain-agnostic, and no Solana, Move or Cairo reports were found, so non-EVM projects should look elsewhere. With 11 named team members and a stated practice of declining engagements, capacity may be limited. Buyers should confirm scheduling early and ask how the AI-assisted workflow is used on their engagement.

How to engage

Use the Request an Audit form. The About page says engagements are scoped "by complexity, not arbitrary timelines." Be ready to give a repository and commit, documentation, a threat model, and your deployment targets. The reports' trust-model and actor sections show what the team will ask about.

Gaps and unverified claims

• Headquarters, legal entity and the terms of independence from Consensys are not published.
• The directory's team size is "11 named", the About page roster. The listed team may not be complete.
• The directory's turnaround (6–12 weeks) is not published by the firm. Recent reports show engagements from 4 days (cETH) to 4 weeks (Hedgey).
• Polygon, Arbitrum, Optimism and Base coverage is not individually evidenced. Formal verification as a standalone service is not evidenced.
• The site returned HTTP 403 to automated fetchers and only loaded in a browser. The directory's publicReports URL works.
• The directory's Twitter handle matches the site's footer link (x.com/ConsensysAudits).

Sources

1. Consensys Diligence homepage — accessed 2026-09-24
2. About page — accessed 2026-09-24
3. Public audits index — accessed 2026-09-24
4. Request an Audit — accessed 2026-09-24
5. Blog: Fresh Paint, Deep Roots (Mar 2026) — accessed 2026-09-24
6. Blog: ZK Fuzzing (Apr 2026) — accessed 2026-09-24
7. cETH report (Apr 2026) — accessed 2026-09-24
8. New Market Trading report (Jun 2026) — accessed 2026-09-24
9. Hedgey Token Lockup and Vesting Plans report (Jun 2023) — accessed 2026-09-24
10. ConsenSysDiligence GitHub org — accessed 2026-09-24
11. Hedgey exploit post-mortem — accessed 2026-09-24
12. rekt.news: Hedgey Finance — accessed 2026-09-24
13. rekt.news: Gamma Strategies — accessed 2026-09-24