Hashlock

Hashlock is an Australian blockchain security firm that runs private, manually led smart contract audits along with penetration testing, compliance and advisory work. It suits teams that want a traditional firm engagement across many chains: its public portfolio covers EVM, Solana, Cosmos, Polkadot/Substrate and several newer L1s. The strongest evidence-backed signal is its public GitHub portfolio, whose machine-readable index listed 280 client engagements on 2026-09-24 (254 with public PDFs, 26 under NDA), each public entry naming the audited commit.

At a glance

Founded	not verified (the firm's company page names co-founders Jock Haslam and Fletcher Roberts but gives no year)
Headquarters / jurisdiction	Australia (GitHub portfolio README, company page); city not stated
Engagement model	private firm audit, with auditors also entering public competitions
Core specialties	smart contract audits, L1/chain audits, dApp penetration testing, compliance (VARA, DORA, CCSS), bug bounty management
Ecosystems / languages	EVM (Solidity), Solana (Rust), Cosmos (Go), Polkadot/Substrate (Rust), GalaChain (TypeScript); Move and Cairo listed on the homepage
Public report index	hashlock.com/audits and GitHub portfolio
Open-source tooling	none found; a hosted AI Audit Tool was offline for upgrades on 2026-09-24
Published pricing	not published (quotes on request; the site mentions an audit cost calculator)

What they do

Hashlock's services page lists smart contract audits (Solidity, Rust, Move, Cairo), blockchain and L1 audits, dApp and bridge audits, and specialist reviews for zero-knowledge, Bitcoin, stablecoin and RWA projects. It also lists formal verification, on-chain monitoring, incident response and penetration testing. On the compliance side it offers VARA and DORA compliance, CCSS certification audits, virtual CISO services, proof of reserves and tokenomics analysis. The homepage also mentions bug bounty program management.

The firm publishes its process in its audit-process document. It runs in eight phases: pre-engagement and scoping (2–5 business days), kickoff, manual audit (1–4 weeks), initial report, client remediation (1–2 weeks), fix review (2–5 business days), final report, and optional public release on its site and GitHub. The total timeline it states is 3 to 8 weeks. Its severity definitions require High-severity findings to be resolved before a report is published. Public client pages also show a rating label ("Secure" or "Hashlocked").

Specialties and ecosystem coverage

The directory lists EVM chains only (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain). The published reports show a wider spread. Examples from client pages in the GitHub portfolio:

• EVM / Solidity: Rocket Pool, Celo, Vana
• Solana / Rust: Spicenet
• Cosmos SDK / Go: Manifest
• Polkadot / Substrate Rust: Energy Web
• TypeScript chain SDK: Gala

The DeFi specialty is confirmed by these reports. This pass found no public report evidence for Move or Cairo, which the homepage lists. The directory's "ai-auditing" specialty rests only on the hosted AI Audit Tool, which was offline at time of research. The firm's methodology document does not mention AI tooling.

Recent public work

These are drawn from the "Featured Audits" list in the GitHub portfolio README and the audits page. Dates are as stated on each client page.

1. Celo: CeloSuperchainConfig (Mar 2026), OP Stack / Superchain contracts (Feb 2026), StakedCelo (Oct 2025) — client page
2. Rocket Pool: Solidity protocol audit covering megapool, deposits, node, DAO and rewards modules (Jan 2026), with commit hash published — client page
3. Energy Web: Substrate parachain staking and Ethereum-bridge pallets (Aug 2025, with engagements through Jan 2026) — client page
4. Gala: GalaChain SDK (Nov 2025) — client page
5. Spicenet: Solana/Rust rollup, prover and wallet crates (Sep 2025) — client page
6. Vana: data-registry and DLP contracts (Sep 2024, re-audits through 2025) — client page
7. EigenLayer: one Hashlock auditor took part in EigenLayer's Cantina competition (Mar 2025). This was not a private Hashlock audit — client page
8. Manifest: Cosmos SDK chain and CosmWasm integration (Dec 2024 / Feb 2025) — client page

Hashlock also announced on 2026-08-03 that it is audit partner to LitVM, an EVM rollup on Litecoin. The portfolio README marks 1inch, SushiSwap and P2P, all featured on the audits page, as NDA engagements with no public report.

Research, tooling and methodology

• Methodology: The firm's methodology document describes line-by-line manual review supported by static analysis (Slither, Mythril, Aderyn, Semgrep), fuzzing (Echidna, Foundry invariants), symbolic execution (Manticore, KEVM) and selective formal verification. The document states that auditors have competitive-audit backgrounds (Cantina, Code4rena, Sherlock, Immunefi) but names no individuals.
• Severity scheme: High, Medium, Low, Gas Optimisation and QA. Each finding is marked Resolved, Acknowledged or Unresolved (severity definitions).
• Tooling: No open-source security tools were found. The GitHub org's profile showed 5 repositories, with the repository list not visible without login. The hosted AI Audit Tool was offline for "scheduled upgrades".
• Blog: The blog posts regularly (most recent 2026-08-29). The recent posts are mostly explainers, such as prediction-market attack vectors, AI-agent payment security and MiCAR. They are not vulnerability disclosures. This pass found no CVEs or original vulnerability write-ups.

Track record and incidents

This pass found no reputable post-audit incident report naming Hashlock as the auditor of exploited code.

Who should consider them — and who might look elsewhere

The strongest public evidence is in multi-chain firm audits for mid-sized DeFi, L1/appchain and infrastructure projects. Public reports cover Solidity, Solana Rust, Substrate, Cosmos Go and a TypeScript chain SDK, and each lists commit hashes. Teams that want compliance-adjacent services (VARA, DORA, CCSS) alongside an audit will find these listed on the services page. Buyers who put weight on open-source security tooling, published vulnerability research, or formal-verification case studies found little public evidence in this pass. Buyers who want Move or Cairo work should ask for sample reports.

How to engage

Use the request-an-audit form. It asks for project name, code language, estimated lines of code, expected start date, repository link and region, and says a quote follows within 24–48 hours. The homepage says "less than 3 hours". Before contacting them, have the repository at a frozen commit, a line-of-code count, architecture docs and a target launch date ready. Also decide whether the report will be public or NDA, since the firm offers both.

Gaps and unverified claims

• Founding year: not published on the firm's pages. The directory's 2020 is not verified.
• Audit counts differ across the firm's own pages: the homepage and audits page say "500+ audits" and ">$4B secured". The LitVM announcement (Aug 2026) says "over 200 audits" and about $1.3B. The GitHub audits.json contained 280 entries (254 "public PDF", 26 "NDA") when counted by parsing the file on 2026-09-24. The repo's last push was dated 2026-10-12 when re-checked on 2026-10-14 (GitHub API).
• NDA engagements: 1inch, SushiSwap and P2P are marked NDA, so there is no public report to review.
• Team size: not published. The company page names co-founders and some staff but no headcount.
• AI tooling: the AI Audit Tool could not be evaluated because it was offline.

Sources

1. Hashlock homepage — accessed 2026-09-24
2. Hashlock audits page — accessed 2026-09-24
3. Hashlock company page — accessed 2026-09-24
4. Hashlock services page — accessed 2026-09-24
5. Hashlock blog index — accessed 2026-09-24
6. Hashlock request-an-audit form — accessed 2026-09-24
7. LitVM audit partner announcement — accessed 2026-09-24
8. Hashlock AI Audit Tool — accessed 2026-09-24
9. GitHub portfolio repo — accessed 2026-09-24
10. GitHub portfolio README (raw) — accessed 2026-09-24
11. audits.json index (raw) — accessed 2026-09-24
12. Repo latest commit (GitHub API) — accessed 2026-09-24
13. Audit process doc — accessed 2026-09-24
14. Severity definitions doc — accessed 2026-09-24
15. Methodology doc — accessed 2026-09-24
16. Hashlock-Auditing GitHub org — accessed 2026-09-24
17. Client page: Rocket Pool — accessed 2026-09-24
18. Client page: Gala — accessed 2026-09-24
19. Client page: Vana — accessed 2026-09-24
20. Client page: Energy Web — accessed 2026-09-24
21. Client page: Manifest — accessed 2026-09-24
22. Client page: Spicenet — accessed 2026-09-24
23. Client page: EigenLayer competition — accessed 2026-09-24
24. Client page: Celo — accessed 2026-09-24