Guardian Audits

Guardian (formerly branded Guardian Audits, now at guardian.security) is a smart contract security firm co-founded by Owen Thurm and Daniel Gelfand. It pairs manual review with purpose-built invariant fuzzing suites and, since 2025–2026, self-funded post-audit bounty contests and an AI-assisted second audit team. It fits DeFi teams, especially perpetuals, stablecoin and cross-chain protocols, that expect repeated update reviews over a long relationship. The strongest evidence-backed signal is its public GitHub report archive: the GMX folder alone holds dated reports from October 2022 to April 2026, and recent LayerZero reports cover EVM, Solana, Stellar and Canton.

At a glance

Founded	not stated on the firm's own pages; the homepage says "for 5 years." (homepage); Crypto Briefing says 2022
Headquarters / jurisdiction	not verified
Engagement model	Private firm audit (plus "Vanguard" dual-team tier with a public contest)
Core specialties	DeFi audits with invariant fuzzing; perps, stablecoins/OFTs, cross-chain messaging; offchain pentests
Ecosystems / languages	EVM (Solidity), Solana, Stellar, Canton, Sui (per report file names in GitHub archive)
Public report index	github.com/GuardianAudits/Audits; the website's audits page is a service page, not a report list
Open-source tooling	Public fuzzing suites and PoC repos; forks of Echidna and hevm (repositories)
Published pricing	not published

What they do

The homepage lists five offerings: audits and pentests, managed security, risk monitoring and ratings, advisory, and Vanguard. The audits page describes the core smart contract engagement in three passes: design review before implementation hardens, an invariant suite "around solvency, accounting, rounding, edge states", then manual review with proof-of-concept exploits. Offchain options include infrastructure, web app, API, browser extension and SDK pentests. The page also offers reviews for launches, upgrades and incidents.

Two newer layers are worth noting:

• Guardian Defender (July 2025): 30-day post-audit bounty contests on the audited scope, "managed, funded, and adjudicated by Guardian" rather than by the client (blog).
• Vanguard (August 2026): two independent teams on the same scope. One does manual review and fuzzing; the other runs Guardian's AI auditor "Helix". It adds a $100,000 Defender contest, an evergreen bounty with up to $50,000 critical matching, and six months of update reviews. Guardian announced $1,000,000 in audit grants alongside it (blog; Crypto Briefing).

Specialties and ecosystem coverage

The GitHub archive lists about 90 client folders as of 2026-09-24 (as rendered on the repo page). They include GMX, Synthetix, Ethena, USDT0, LayerZero, Jupiter, Yuga Labs, Mysten Labs, MegaETH, Citrea, Paxos Labs and Story Protocol.

• EVM / Solidity: well evidenced. GMX has dated reports from 2022-10-24 to 2026-04-14 (GMX folder).
• Solana: LayerZero Solana OApp and Console reports (LayerZero folder); Jupiter reports (Jupiter folder).
• Stellar and Canton: LayerZero OneSig Stellar review and Canton OFT reports (LayerZero folder).
• Sui / Move: one suiUSDe review for Mysten Labs, dated 2025-12-29 (Mysten Labs folder).

The directory lists Ethereum, Polygon, Arbitrum, Optimism, Base and Avalanche. GMX's Arbitrum/Avalanche deployments fit that list, but this pass did not map reports to each chain. Solana, Stellar, Canton and Sui work is evidenced but not in the directory's list. The directory's "fuzzing" and "fuzzing-suite" tags are supported by the firm's service description and its public fuzzing repos.

Recent public work

From file names in the GitHub archive (dates are those in the file names), accessed 2026-09-24:

1. LayerZero Canton VER Updates — 2026-09-03 (LayerZero folder).
2. Jupiter Yield Store Review — 2026-08-12 (Jupiter folder).
3. Jupiter Offerbook — 2026-08-03 (Jupiter folder).
4. LayerZero Console EVM Updates — 2026-07-27 (LayerZero folder).
5. GMX Timelock Updates — 2026-04-14 (GMX folder).
6. LayerZero Canton OFT Review — 2026-02-05 (LayerZero folder).
7. Mysten Labs suiUSDe Review — 2025-12-29 (Mysten Labs folder).
8. GMX LayerZeroProvider Routing and GMX Open Interest Updates — 2025-12-29 (GMX folder).

The commit history shows a bulk upload on 14 Sep 2026 ("Add 78 more audit reports…", "Add 43 audit reports…"). It also shows an update setting "confidence to 3/5" on several reports, and the removal of one consultation report.

Research, tooling and methodology

• Fuzzing. The firm builds invariant harnesses as part of the standard engagement (audits page). Its GitHub has public fuzzing suites (e.g. perps-v3-fuzzing-minimal, abracadabra fuzz tests), customised Echidna and hevm forks, and PoC repos for DN404, Dolomite and others (repositories). The org has 28 public repositories (count shown on org page, 2026-09-24).
• Disclosures and writing. The blog includes disclosure write-ups for Baseline Markets and DN404 (June 2024) and an Echidna invariant-testing guide (May 2025).
• Team. The directory team size is 15+. The team page lists 19 people (the team page's roster), with co-founders Owen Thurm (CEO) and Daniel Gelfand (CTO), and describes members with contest wins and prior roles at other audit firms.
• Firm-stated metrics (not independently verified): "300+ critical vulnerabilities reported", "$45 Billion assessed", "150+ teams", "25+ global security competition wins" (audits page). The case studies cite 80+ GMX engagements over four years, 50+ for USDT0 and 20 for LayerZero.
• No published severity definitions were found. Defender defines a Critical finding for contest payouts as a loss of 20%+ of funds (blog).

Track record and incidents

No reputable post-audit incident naming Guardian as auditor of the exploited code was found in this pass. The July 2025 GMX V1 exploit write-up on rekt.news discusses ABDK and Quantstamp audits and does not mention Guardian, whose public GMX reports are for GMX V2 (Synthetics) and later updates.

Who should consider them — and who might look elsewhere

The strongest public evidence is long-running update-review relationships with EVM perps and DeFi protocols (GMX), and cross-chain/stablecoin infrastructure across several runtimes (LayerZero, USDT0, Jupiter). Teams that want a reusable fuzzing suite handed over, or a funded post-audit contest without running their own, will find both offered. Teams on Move, Cairo or ZK circuits have little public evidence to compare against: one Sui report and no circuit reports were found. Buyers who want a public report index with severity summaries will need to open individual PDFs on GitHub.

How to engage

Use the Work with us form. It asks for your website, primary need (audit, Vanguard, pentest, SDK audit, managed security, monitoring, advisory) and context. The firm also publishes audits@guardianaudits.com and a Telegram/LinkedIn contact option there. Engagements are "scoped from your repository and commit" (audits page), so have a frozen commit and design documents ready. The design-review pass is most useful before code is final.

Gaps and unverified claims

• The firm's own pages do not state a founding year. Only secondary sources say 2022.
• Headquarters and legal entity are not published.
• The directory's notable audits: GMX is confirmed. Level Finance and Gains Network have no folders in the GitHub archive.
• The directory's publicReports link points to the GitHub archive. The firm's own guardianaudits.com/audits redirects to guardian.security/audits, a service page with no report list.
• The directory's team size is 15+. The team page's roster lists 19 people. Its turnaround (3–6 weeks) is not published by the firm.
• Arbitrum and PayPal appear as client logos on the homepage but have no GitHub folders. This may reflect private engagements.

Sources

1. Guardian homepage — accessed 2026-09-24
2. Audits & Pentests page — accessed 2026-09-24
3. Case studies — accessed 2026-09-24
4. Team page — accessed 2026-09-24
5. Work with us — accessed 2026-09-24
6. Blog index — accessed 2026-09-24
7. Blog: Guardian Announces Vanguard (Aug 2026) — accessed 2026-09-24
8. Blog: Introducing Guardian Defender (Jul 2025) — accessed 2026-09-24
9. GuardianAudits GitHub org — accessed 2026-09-24
10. GuardianAudits repositories list — accessed 2026-09-24
11. Audits repo — accessed 2026-09-24
12. Audits repo commit history — accessed 2026-09-24
13. GMX folder — accessed 2026-09-24
14. LayerZero folder — accessed 2026-09-24
15. Jupiter folder — accessed 2026-09-24
16. Mysten Labs folder — accessed 2026-09-24
17. Crypto Briefing: Vanguard and $1M fund (Aug 2026) — accessed 2026-09-24
18. rekt.news: GMX — accessed 2026-09-24