Cyfrin

Cyfrin is a remote-first blockchain security company that runs private audits and the CodeHawks competitive-audit platform. It also maintains the Aderyn static analyzer, the Solodit vulnerability database and the Updraft education platform. It fits EVM DeFi, RWA and tokenization teams that want a private review, and teams that may later want a public contest or developer training from the same vendor. The strongest evidence-backed signal is its public report repository: when read on 2026-09-24, it listed a steady run of dated engagements through mid-September 2026, many of them for Securitize.

At a glance

Founded	Not verified; the firm's about page does not state a year
Headquarters / jurisdiction	Not published; the firm describes itself as "a remote, culture-first company" (about)
Engagement model	Private firm audit, plus the CodeHawks competitive-audit platform (CodeHawks)
Core specialties	EVM DeFi, RWA and tokenization, cross-chain; also formal verification, penetration testing, incident response and advisory (homepage)
Ecosystems / languages	Solidity and Vyper confirmed in published reports; Solana/SVM confirmed (a dedicated report section); the firm's pages list 17–18 chains
Public report index	cyfrin.io/audit-reports and github.com/Cyfrin/cyfrin-audit-reports
Open-source tooling	Aderyn (Solidity static analyzer); Moccasin (Vyper testing framework); Solodit (vulnerability database)
Published pricing	Not published

What they do

The audit services page describes four phases:

1. Setup and onboarding, including scoping and timeline estimation.
2. Security review.
3. A preliminary report, then mitigation by the client.
4. A final report, after researchers verify and update each issue following fixes.

Reports include proof-of-concept code and mitigation recommendations, and public reports are posted to the report portal. The homepage also lists incident response, formal verification, penetration testing, security advisory, enterprise training and certifications. Competitive audits run on CodeHawks, which on 2026-09-24 showed public, private and invite-only contests, including Starknet Staking, ZKsync Era and Curve Storage Proofs.

Specialties and ecosystem coverage

• EVM / Solidity: Heavily evidenced in the report repo.
• Vyper: Evidenced. Beanstalk and Ondo bridge reports are tagged Vyper on the report index, and the firm maintains the Moccasin Vyper framework (about).
• Solana / SVM: The report repo has a Solana/SVM section, and recent work includes "Securitize SVM Vault Registrar SPL ACL" (September 2026). Solana is not in the directory's chain list.
• RWA / tokenization: A large share of 2026 reports are Securitize engagements (DSToken, async vaults, bridge ACL, deny lists). A February 2026 blog post describes RWA as a focus area.
• Cross-chain: Several Wormhole reports from 2024–2026 and Chainlink CCIP-related work (e.g. Syntetika CCIP-CCT) appear in the repo.
• Other chains: The report index filter lists ZKsync, Arbitrum, Avalanche, BNB, Base, Optimism, Polygon, Solana, Aztec, Monad, Abstract, TON, Sui, Tron, Aptos and Starknet. Filters show which categories exist but do not prove depth. This pass did not confirm Move, Cairo, TON or Noir reports in the GitHub repo.
• NFT: Listed as a specialty in the directory. The repo tags some reports NFT/real-estate tokenization, but this pass found little NFT-specific public work.

Recent public work

From the cyfrin-audit-reports README table, read on 2026-09-24:

1. Securitize SVM Vault Registrar SPL ACL (2026-09-17)
2. Securitize Global Deny List (2026-09-11)
3. Securitize BUIDL-I Deploy Diff (2026-09-09)
4. GreekFi Core and GreekFi Oracle (2026-09-08)
5. Securitize Tempo TIP-20 (2026-08-28)
6. Securitize EVM Async Vault and Linea Yield Manager (2026-08-20)
7. Securitize ZKSync Exit Bridge (June 2026)
8. Syntetika CCIP-CCT (April 2026)
9. Sablier Bob Escrow (February 2026)
10. Suzaku Validator (October 2025)

Several recent entries in the same table are listed as "REDACTED", with the client name withheld. The table also records severity counts (C/H/M/L/I/G) for each report.

Research, tooling and methodology

• Aderyn: A Rust-based Solidity static analyzer, GPL-3.0 licensed, with about 800 GitHub stars on 2026-09-24. It integrates with VS Code, Foundry and Hardhat (repo).
• Solodit, Moccasin, Updraft: A vulnerability database, a Vyper testing framework and a developer education platform respectively (about).
• Recent writing: The blog covers ZK virtual machines (April 2026), analysis of the Drift Protocol hack (April 2026), clear-signing and blind-signing risk (May 2026), and a root-cause analysis of the Cetus exploit on Sui (December 2025).
• Leadership: Mark Scrine is listed as CEO and Alex Roan as CTO. Dacian is listed as Head of Security Research, and Patrick Collins as an advisor (about).

Track record and incidents

No reputable post-audit incident report naming Cyfrin as the auditor of the exploited code was found in this pass.

Who should consider them — and who might look elsewhere

The public evidence is strongest for Solidity DeFi, RWA and tokenization (especially Securitize-style permissioned assets), and cross-chain messaging. There is also a growing Solana/SVM track record. Cyfrin fits teams that want a private review now with a CodeHawks contest or developer training available later. Teams needing Move, Cairo, TON or ZK-circuit audits should ask for recent public examples, because this pass did not confirm reports in those areas in the GitHub repo. Anyone needing a published price will not find one.

How to engage

Use "Book a consultation" on the homepage, which links to cyfrin.io/get-an-audit. Competitive audits are arranged through CodeHawks. The process starts with scoping and timeline estimation (audit services), so have a frozen commit, documentation and a test suite ready.

Gaps and unverified claims

• The founding year is not stated on the firm's pages, so the directory's 2022 is unverified.
• Team size is not published. The directory's "50+" is unverified.
• Pricing and turnaround are not published.
• Of the directory's notable audits, Beanstalk, Sudoswap (sudoAMM v2, 2023), Sablier, Syntetika and Suzaku are confirmed in the report repo. Raft was not found in the repo in this pass.
• Many recent reports are client-redacted, which limits what outsiders can verify.
• The report index page rendered only a handful of older entries to our fetcher. The GitHub repo was used as the primary list.
• The report count was approximate: roughly 261 entries in the README table, read with a tool on 2026-09-24.

Sources

1. Cyfrin — About us, accessed 2026-09-24
2. Cyfrin — Audit reports index, accessed 2026-09-24
3. Cyfrin/cyfrin-audit-reports (GitHub), accessed 2026-09-24
4. Cyfrin — Audit services, accessed 2026-09-24
5. Cyfrin — Homepage, accessed 2026-09-24
6. Cyfrin/aderyn (GitHub), accessed 2026-09-24
7. CodeHawks, accessed 2026-09-24
8. Cyfrin — Blog, accessed 2026-09-24