MixBytes

MixBytes is a smart contract security firm that has operated since 2017. It offers early-stage security reviews, pre-launch audits with re-audit and deployed-bytecode verification, and ongoing security support. It suits EVM DeFi teams, especially in liquid staking, lending and DEX/stablecoin work, that want a small fixed senior team and a published report. The strongest evidence-backed signal is its public GitHub report archive. On 2026-09-24 the archive's index listed 255 dated reports from 2017 to September 2026, 47 of them dated in 2026. Among them are 46 Lido engagements and recent work for Aave, 1inch, Gearbox and Instadapp/Fluid.

At a glance

Founded	2017 (about page)
Headquarters / jurisdiction	not published on the pages reviewed
Engagement model	private firm audit; a "fixed team of senior researchers per engagement" (audit service page)
Core specialties	EVM DeFi audits: liquid staking, lending, DEX/AMM, stablecoins/CDP, RWA integrations; post-audit security support
Ecosystems / languages	EVM (Solidity; some Vyper, e.g. Curve and Yearn); one public Solana report (Jupiter Lend Vaults, Oct 2025)
Public report index	github.com/mixbytes/audits_public and mixbytes.io/reports
Open-source tooling	limited: research and zk-proof experiments on GitHub; no maintained standalone audit tool found
Published pricing	not published

What they do

The homepage lists three services: Security Review (protocol design and architecture for early-stage projects), Smart-contract Audit (pre-mainnet) and Security Support (ongoing work for live protocols, upgrades and incident response).

The audit service page describes two stages:

1. Interim audit: architecture review, adversarial code review, systematic vulnerability analysis against DeFi attack patterns, and report consolidation.
2. Re-audit and deployment: a re-audit of the fixes, then "mainnet verification", which checks that the deployed bytecode and initialization match the audited commit before the final report is published.

The Security Support service adds diff audits, operational reviews, AI-assisted scans and priority incident response. The about page says the firm has "developed proprietary AI tooling", but no tool is named publicly.

Specialties and ecosystem coverage

The public archive (README index) is overwhelmingly EVM DeFi:

• Liquid staking: Lido (46 entries, including Lido v3.0.2, Oracle, Easy Track and L2 Direct Staking), P2P.org, Stader, Swell, KelpDAO, Mantle mETH.
• Lending: Aave, Gearbox, Euler (EVK periphery and reward streams), Instadapp/Fluid.
• DEX and stablecoins: Curve (crvUSD, StableSwap-NG, Curve Lending), 1inch, Velodrome, Yield Basis.
• Bridges: EYWA/CrossCurve.

Directory entries confirmed: The directory's EVM chains and its DeFi, smart-contract and staking specialties are well supported. So are its notable audits: Lido, Curve, Yearn (21 entries, 2020–2023), 1inch and SushiSwap (a BentoBox report from Feb 2021).

Directory entries not evidenced: The directory also lists Substrate/Polkadot and Cosmos. The public repo contains no Substrate, Polkadot or Cosmos audit reports. The Polkadot evidence is research and development work rather than published audits: a Substrate pallet audit guide (blog), and a Lido-for-Polkadot/Kusama staking repo (lido-dot-ksm) on the org's GitHub. Non-EVM public evidence beyond that is one Solana report (Instadapp Jupiter Lend Vaults, 2025-10-24) and a June 2026 blog post on Solana program security.

Recent public work

These are from the README index of audits_public, retrieved 2026-09-24. PDFs are in the repo.

1. DIA: Oracle V3 — 2026-09-11
2. Lido: Execution Delegation Framework — 2026-09-11
3. Lido: L2 Direct Staking — 2026-09-03
4. Resolv: Vault Street (RWA) — 2026-08-31
5. Gearbox Protocol: integrations-v3 (Securitize RWA) — 2026-08-24
6. Shift: USDT0 Bridge & Strategies — 2026-07-31
7. EYWA / CrossCurve: CDP — 2026-05-06
8. Aave: Aave v3.7 — 2026-03-30
9. 1inch: Aqua & Swap-VM — 2026-03-27
10. Instadapp: Fluid Liquidity Layer — 2025-12-10

How the count was made: dated rows in the README table were counted on 2026-09-24, giving 255 in total. By year: 2017: 1, 2018: 5, 2019: 6, 2020: 15, 2021: 52, 2022: 14, 2023: 24, 2024: 37, 2025: 54, 2026: 47. The website portfolio groups reports by client (for example, it shows 41 Lido reports), so its per-client counts differ slightly from the README.

Research, tooling and methodology

• Blog: The blog publishes protocol deep-dives and risk write-ups. Examples include RWA and Web2-perimeter attack surfaces (Aug 2026), Solana program exploits (Jun 2026), DeFi curator risk (Apr 2026), Curve StableSwap-NG oracle risks (Sep 2025) and Lido validator-deposit risks (Apr 2025).
• Methodology: The published process includes a re-audit and deployed-bytecode verification against the audited commit and compiler settings (audit service page).
• Open source: The GitHub org has 57 repositories, mostly the reports archive, protocol code (lido-dot-ksm), zkLLVM storage-proof experiments and a fork of DeFiHackLabs. This pass found no maintained, standalone open-source audit tool.
• Disclosures: No CVEs or named vulnerability disclosures by MixBytes were found in this pass.

Track record and incidents

This pass found no reputable post-audit incident report naming MixBytes as the auditor of the exploited code. CrossCurve (formerly EYWA) was exploited in February 2026 through its ReceiverAxelar contract (Halborn explainer). MixBytes has published EYWA/CrossCurve audits of other components (CLP, DAO and CDP) in its archive. The incident write-up reviewed here does not say who audited the exploited contract, if anyone, so this pass does not attribute the incident to MixBytes.

Who should consider them — and who might look elsewhere

The strongest public evidence is in Ethereum DeFi: liquid staking (Lido in particular), lending, AMMs/stablecoins, and upgrade or diff audits for established protocols. The published process includes deployment verification and ongoing support. Teams that need Substrate/Polkadot, Cosmos, Move or Solana audits found little public report evidence in this pass (one Solana report). They should ask for sample reports before engaging.

How to engage

Use the contact page. The protocol inquiry form asks for protocol name, GitHub repository, service type (Security Review, Smart-contract Audit or Security Support) and a message. The page also lists a general contact email. Before contacting them, have the repo at a fixed commit, docs and the intended deployment chains ready. Also plan time for the re-audit and mainnet verification stage.

Gaps and unverified claims

• Headquarters and team size: neither is published on the pages reviewed. The directory's "30+" is not verified.
• Substrate/Polkadot and Cosmos: listed in the directory but not evidenced by public audit reports.
• Firm-published claims: "300+ audits" (homepage) is not verified independently. The public index holds 255 dated reports.
• Pricing: not published.

Sources

1. MixBytes homepage — accessed 2026-09-24
2. About page — accessed 2026-09-24
3. Smart-contract audit service page — accessed 2026-09-24
4. Reports portfolio — accessed 2026-09-24
5. Blog index — accessed 2026-09-24
6. Blog: Audit of Substrate pallets — accessed 2026-09-24
7. Contact page — accessed 2026-09-24
8. GitHub: audits_public repo — accessed 2026-09-24
9. audits_public README index (raw) — accessed 2026-09-24
10. audits_public repository archive (tarball, used to list report files) — accessed 2026-09-24
11. GitHub: mixbytes org — accessed 2026-09-24
12. GitHub: lido-dot-ksm — accessed 2026-09-24
13. Halborn: Explained, the CrossCurve hack (Feb 2026) — accessed 2026-09-24