Neodyme

Neodyme is a security research company, trading as Neodyme AG, whose blockchain practice grew out of Solana bug hunting in 2020–2021 and which also does penetration testing, hardware and Windows research. It fits teams building Solana programs or Solana core/validator code who want a reviewer with deep SVM runtime knowledge. The strongest evidence is its public report index: 35 dated reports from 2021 to January 2026, almost all Solana, including Firedancer, Token-2022, P-Token, SPL Stake Pool and Metaplex Token Metadata.

At a glance

Founded	2021, per the firm's about page (which also says its founders were active in Solana security from 2020)
Headquarters / jurisdiction	Neodyme AG per the website footer; the GitHub org lists Germany. City not verified
Engagement model	Private firm audit (plus a free automated Solana fuzzing service, Riverguard)
Core specialties	Solana program audits, Solana core/validator audits, Rust implementation review, cryptography implementations, protocol design review
Ecosystems / languages	Solana (Rust, Anchor, raw Rust), Solana validator clients (Firedancer), Rust cryptography; Ethereum and Move offered but not evidenced in public reports
Public report index	neodyme.io/en/reports
Open-source tooling	neodyme-labs on GitHub: solana-security-txt, solana-poc-framework, solana-ctf, github-secrets, SolDragon
Published pricing	Not published; quotes on request (blockchain page)

What they do

Neodyme's blockchain services page lists three audit categories: smart contract audits (DeFi, NFT platforms, liquid staking, cross-chain protocols), core blockchain audits (cryptography, validator code, ecosystem-level issues) and protocol design reviews (whitepaper/yellowpaper assessments, code-quality reviews for investors, security architecture). The same page lists Solana, Ethereum and Move contract audits, and claims "100+" core blockchain bugs reported and "$10B+" TVL protected; these are the firm's own figures and were not independently verified.

Outside blockchain, the homepage lists penetration tests, security trainings and consulting. The firm's advisories page shows a "90+30" disclosure policy (90 days to patch, disclosure 30 days after a fix).

The services page does not describe scoping, fix review or report publication policy. Published reports show the pattern in practice: the Sendit report says fixes made during the audit were reviewed and verified by the auditors (Sendit report), and reports mark each finding with a resolution status.

Riverguard is a free service, "maintained by Neodyme, with support from the Solana Foundation", that simulates mutated transactions against registered Solana programs and reports triaged findings to the program owners (Riverguard).

Specialties and ecosystem coverage

Counting the unique PDF links on the reports page on 2026-09-24 gives 35 reports dated August 2021 to January 2026. By title and page labels, all but one concern Solana programs or Solana core code; the exception is a Rust cryptography review for Quantus Network (Dilithium signatures and an HD wallet), whose report says both in-scope components are written in Rust (Quantus report).

Against the directory entry:

• Solana / Rust: confirmed, heavily. The index includes on-chain programs (Drift, Squads, Marinade, Orca Whirlpools, Mango v3, Jito, Sanctum, Streamflow), SPL programs (Token-2022, SPL Stake Pool, P-Token) and validator code (Firedancer v0.1 and v0.4).
• Cryptography: confirmed by the Quantus Dilithium review and by the "core blockchain audits" service description.
• Ethereum: offered on the services page, but no Ethereum-contract report appears in the public index. The Wormhole v2 review (see below) covered Ethereum bridge contracts alongside Solana and Terra, per Wormhole's copy of the report (Wormhole audit PDF).
• Education: confirmed through the blog (for example, Solana common pitfalls, August 2021), the solana-ctf and Breakpoint workshop repos on GitHub, and the Riverguard blog series.
• Move: offered, not evidenced in public reports.

Recent public work

From the firm's reports page, newest first:

1. Quantus Network Dilithium and HD wallet (Rust cryptography), January 19, 2026 (report). The report counts 1 critical, 2 high, 5 medium, 5 low and 2 informational findings.
2. Sendit lending protocol (Solana, raw Rust), December 8, 2025 (report). 1 critical, 2 medium, 5 low, 3 informational.
3. Fogo stake pool, October 24, 2025 (report).
4. Metaplex Token Metadata, July 1, 2025 (report).
5. P-Token, June 12, 2025 (report).
6. Pye Fi liquid staking bonds (Solana, Anchor), June 5, 2025 (report). The report notes the code had two prior audits and Neodyme still found 8 security-relevant issues (1 high, 4 medium, 3 low).
7. Firedancer v0.4, April 1, 2025 (report).
8. Marinade Validator Bonds (second review), February 4, 2025 (report).
9. Squads v4, December 10, 2024 (report).

Research, tooling and methodology

• Open source (GitHub): solana-security-txt (a security.txt convention for Solana programs, the org's most-starred repo), solana-poc-framework (for writing exploit proofs of concept), solana-ctf, SolDragon (Ghidra tooling for Solana) and github-secrets (finds secrets in dangling commits).
• Riverguard: automated mutation-based testing of deployed Solana programs; the May 2025 post describes seven "fuzzcases" and says most produced "dozens or even hundreds of hits" across deployed contracts (blog).
• Blog: recent posts are mostly non-blockchain (Pwn2Own entries, Windows COM hijacking, BitLocker, Lenovo, drones). The most recent Solana post in the listing is "Solana Consensus – From Forks to Finality", December 2024 (blog index).
• Disclosed CVEs: the advisories page lists 2026 CVEs in Vaultwarden, Gitea, Acronis, HP, Canon and others; none are blockchain-related.
• Severity scheme: reports use a Critical/High/Medium/Low/Informational rating, defined in an appendix; for example, critical means likely loss of funds that is easy to trigger and hard to undo (Pye Fi report).
• Team credentials (self-published on the about page): 25 people, a CTF-competition background, Pwn2Own results in 2022 and 2024, and the statement that the Solana Foundation contracted the firm for code audits in 2021.

Track record and incidents

Wormhole (February 2022). Wormhole's own audit archive lists a Neodyme report dated January 10, 2022, and a 2024 Neodyme Solana NTT report (wormhole-audits); Wormhole's docs list Neodyme among its auditors (Wormhole security docs). The 2022 report says the review ran July–September 2021 before the v2 launch and that /solana/bridge/ was in scope; it also says Neodyme was doing another audit and had been contracted for ongoing reviews (report PDF). On February 3, 2022, an attacker exploited signature verification in the Solana bridge (rekt.news). Whether the specific vulnerable code path existed in the commits Neodyme reviewed is not established by any source found in this pass. The rekt.news write-up does not name any auditor, and no public Neodyme response was found. An exploit after an audit is not, by itself, proof of a missed finding.

No other reputable post-audit incident naming Neodyme as auditor of the exploited code was found in this pass.

Who should consider them — and who might look elsewhere

• Consider for Solana on-chain programs, especially staking, stake pools, multisigs, AMMs and lending, and for Solana core, validator or SPL-level code. Most of the public reports fall in these areas.
• Consider for Rust cryptography implementation reviews; there is one recent public example.
• Look elsewhere, or ask for private samples, if your code is Solidity/EVM or Move. Both are offered, but there is no public report evidence for either.
• The public index adds reports at a modest rate (about 7 in the last 12 months). If you need a large team or a quick start, confirm capacity and timing directly.

How to engage

The blockchain services page directs enquiries to the contact address published there and on the homepage (contact@neodyme.io), or to the site's contact form. Before a quote, prepare the repository and commit, scope (programs and lines of code), whether economic/design review is wanted, prior audits, and your target launch date.

Gaps and unverified claims

• The headquarters city was not verified. The imprint URL tried (/en/imprint) returned 404; the GitHub org says Germany.
• No turnaround times or pricing are published. The directory's "4–8 weeks" could not be confirmed, though recent reports show engagements lasting from about 6 weeks (Sendit, Quantus) to about 2 months (Pye Fi).
• The directory team size is 25, matching the 25 people stated on the about page.
• The directory's public-reports link points to the blog; the report index is at /en/reports.
• Ethereum (listed in the directory) and Move are not evidenced in public reports.
• The TVL-protected and bug-count figures are self-reported.
• No public Neodyme statement on the Wormhole exploit was found.

Sources

1. Neodyme homepage, accessed 2026-09-24
2. Neodyme about page, accessed 2026-09-24
3. Neodyme blockchain services, accessed 2026-09-24
4. Neodyme reports index, accessed 2026-09-24
5. Neodyme blog index, accessed 2026-09-24
6. Neodyme advisories, accessed 2026-09-24
7. Riverguard, accessed 2026-09-24
8. Riverguard: Mutation Rules blog post, accessed 2026-09-24
9. Solana Smart Contracts: Common Pitfalls, accessed 2026-09-24
10. neodyme-labs GitHub org, accessed 2026-09-24
11. Quantus Dilithium/HDWallet report, accessed 2026-09-24
12. Sendit report, accessed 2026-09-24
13. Fogo stake pool report, accessed 2026-09-24
14. Metaplex Token Metadata report, accessed 2026-09-24
15. P-Token report, accessed 2026-09-24
16. Pye Fi report, accessed 2026-09-24
17. Firedancer v0.4 report, accessed 2026-09-24
18. Marinade Validator Bonds report (2025), accessed 2026-09-24
19. Squads v4 report, accessed 2026-09-24
20. Wormhole security docs, accessed 2026-09-24
21. wormhole-audits repository, accessed 2026-09-24
22. Neodyme Wormhole v2 audit report (Wormhole copy), accessed 2026-09-24
23. rekt.news: Wormhole rekt, accessed 2026-09-24