Nethermind Security

Nethermind Security is the audit and formal-verification arm of Nethermind, the Ethereum infrastructure company behind the Nethermind execution client and the Juno Starknet client. It fits teams building EVM, Starknet/Cairo or ZK systems who want a reviewer that also has in-house protocol and formal-methods engineers. The strongest evidence is a public GitHub repository of about 204 report PDFs (re-counted 2026-10-14; 189 on 2026-09-24), still receiving new reports as of October 2026, plus a formal-verification practice with named zkVM and verifier engagements.

At a glance

Founded	Parent company Nethermind "bootstrapped in 2017" (nethermind.io); no start date is published for the security practice itself, which cites figures "since 2022" (audits page)
Headquarters / jurisdiction	Not stated on fetched pages; the company describes a distributed team across 66+ countries (nethermind.io)
Engagement model	Private firm audit and formal verification, inside a larger engineering company
Core specialties	Solidity/EVM audits, Cairo/Starknet audits, ZK circuit and protocol review, formal verification in Lean, AI-assisted pre-audit tooling
Ecosystems / languages	EVM (Solidity, Yul), Starknet (Cairo), Rust, Noir, Circom, Halo2, Plonky3
Public report index	NethermindEth/PublicAuditReports
Open-source tooling	Horus (Cairo formal verification, archived), Surveyor (R1CS-to-Lean, archived), plus Lean verification projects listed on the formal verification page
Published pricing	Audits: not published (audits page). The AuditAgent tool publishes per-line pricing (AuditAgent)

What they do

Per the Nethermind Security page, services are smart contract audits (Solidity, Cairo, Rust, Noir), ZK audits (circuits and cryptographic protocols; Noir, Circom, Cairo DSLs and zkVM frameworks), formal verification, architecture assessments, and ongoing security help during development. The page claims "400+ security audits" and "200+ audits completed during 2025". The firm reports these figures itself; they were not independently verified.

The smart contract audits page describes an agile process: regular sync calls, partial reports delivered during the engagement, and working with the client's engineers on fixes. Pricing depends on code complexity, size and urgency, and is quoted individually. Published reports show a staged fix-review model. The XDC Prime Stake report, for example, separates "Stage 1" findings from findings raised after the client's changes (XDC report).

The formal verification page describes machine-checked proofs, mainly in Lean, covering ZK protocols, Halo2 and Plonky3 circuits, protocol logic and EVM/Yul semantics. It names engagements or collaborations with zkSync, Succinct, Axiom, Brevis, RISC Zero, INTMAX, Aptos and the Ethereum Foundation.

AuditAgent is a paid AI scanning tool (Solidity, Cairo, Rust). On 2026-10-14 its site listed a single "Full-Depth Scan" tier at $0.05 per billable line (shown as "50% off, for everyone"), with $50 of sign-up credit and a cap of 100 contracts or 20,000 billable lines per scan (AuditAgent); the earlier Developer ($0.02) and Auditor ($0.10) tiers are no longer listed.

Specialties and ecosystem coverage

Evidence from the public reports repository, checked 2026-09-24:

• EVM / Solidity: confirmed, and the bulk of recent reports (ENS, Suno, Null Solutions, Vistapex, Royco, Panoptic).
• Starknet / Cairo: confirmed. The repo includes Starknet ID, the Starknet token distributor, AVNU, zkLend and Argent on Starknet, and a June 2026 Karnot Arcx review of 5,230 lines of Cairo (report). Nethermind also maintains the Juno Starknet client (nethermind.io).
• ZK / formal verification: confirmed by the formal verification page and a Lido accounting ZK-oracle report in the repo. The directory's "zk-circuit" and "formal-verification" audit types are supported.
• Rust: confirmed for infrastructure code. A World report covers Rollup Boost, 2,634 lines of Rust (report).
• Solana: offered on the audits page, which names the Skate report (NM0565) as a Solana engagement (audits page); no report filename in the public repo refers to Solana.
• Chains in the directory entry (Ethereum, Polygon, Arbitrum, Optimism, Starknet, Base): Ethereum, Starknet and Polygon (Polygon ID reports) are evidenced in filenames. Arbitrum, Optimism and Base appear as named partners or clients on the security page, not as distinct reports found in this pass.

Recent public work

Pulled from the PublicAuditReports repository (newest report numbers). Dates come from each report's own text.

1. Suno Protocol (Solidity, 2,472 lines, 1 high finding). The report is dated August–September 2026 (report).
2. Null Solutions (Solidity, 1,220 lines), August 25, 2026 (report).
3. Vistapex (Solidity, 484 lines), August 21, 2026 (report).
4. ENS Diamonds (Solidity, 597 lines, no findings), August 20, 2026 (report).
5. Karnot Arcx (Cairo plus Solidity, 2 high findings), June 2026 (report).
6. PrimeNumbers Labs PrimeStakedXDC V3, March–May 2026, including a critical double-counting finding (report).
7. Royco Makina strategy (Solidity), March 2026 (report).
8. Panoptic V2 (Solidity), December 2025–January 2026 (report).
9. World – Rollup Boost (Rust), 2025 (report).

On 2026-09-24 the repository listed 189 PDF files, counted from the GitHub file tree; a re-count on 2026-10-14 found about 204. Its commit history shows additions on September 29 and October 7, 8 and 13, 2026 (including Infrared, Voice, Mellow, Tori and SocialFi Panda reports). Report numbers go above 1,000, so the public set appears to be a subset of all engagements; the firm does not say what share it publishes.

Research, tooling and methodology

• Severity scheme: reports rate findings by Likelihood × Impact following OWASP principles, with Critical/High/Medium/Low/Undetermined/Informational/Best Practices categories (ENS Diamonds report). Reports combine manual analysis with automated tools and include a test-suite evaluation section.
• AI-assisted review: an October 2025 post reports that, across 29 audits used as a second pass after manual review, AuditAgent found about 30% of auditor findings and a valid issue in 62% of projects (blog).
• Formal verification tooling: the formal verification page lists CLAP, CertiPlonk, Halva, Surveyor, ArkLib and Bluebell, and claims a Lean formalization of EVM/Yul (Cancun). Two older open-source tools, Horus (Cairo 0 formal verification) and Surveyor (R1CS to Lean), were archived on September 9, 2026.
• Team credentials: the audits page states that 40% of the team holds PhDs (audits page). Individual names were not reviewed.

Track record and incidents

• zkLend (Starknet, February 2025, about $9.6M). rekt.news reports that zkLend was audited twice by Nethermind: Cairo 0 contracts in May 2022 and Cairo 1 in September 2023. The exploit used a rounding and precision issue in the lending accumulator. rekt.news also says it is unclear whether the issue existed at audit time or came in through later changes (rekt.news). Both zkLend reports are in the public repo. No Nethermind statement was found. An exploit after an audit is not, by itself, proof of a missed finding.
• USPD (drained December 2025, about $1M). rekt.news reports that the attacker front-ran proxy initialization during the September 16, 2025 deployment, inserting a malicious proxy that never existed in the audited codebase. USPD's own response said the flaw was not in its contract logic (rekt.news). On that account, the exploited vector was outside the audited code.

No other reputable post-audit incident naming Nethermind Security as auditor of exploited code was found in this pass.

Who should consider them — and who might look elsewhere

• Consider for Solidity DeFi and infrastructure, Starknet/Cairo contracts, and ZK systems where formal verification of circuits or verifiers is in scope. The public evidence is strongest in these three areas.
• Consider if you want a reviewer close to Ethereum client and L2 engineering (execution client, Starknet client, OP-stack components such as Rollup Boost).
• Look for other evidence, or ask for private samples, for Solana programs or Move. Rust is evidenced mainly in infrastructure, not in Solana on-chain programs.
• Small codebases are regularly published (several recent reports are under 1,000 lines), so the practice does take small engagements.

How to engage

Use the contact form, which asks for your role, Telegram handle, client type, project and a description. The page also publishes hello@nethermind.io. Prepare the repository and commit, lines of code in scope, target dates, prior audits, and whether you need formal verification or ZK review in addition to a code audit. AuditAgent can be run before an audit to clean up easy issues (AuditAgent).

Gaps and unverified claims

• Security practice founding date not published. The directory's "2020" could not be confirmed; the parent company dates to 2017.
• The directory team size is "50+". It is not published for the security unit. The parent company claims about 200 staff (the parent company's figure) (nethermind.io).
• The directory's public-reports link is the marketing page; the report index is the GitHub repo.
• Directory notable audits: World, Starknet, Lido and Polygon are evidenced in report filenames; zkSync is named on the formal verification page. Optimism and EtherFi were not found as report filenames in this pass.
• The /audit-slots promotion page referenced on the security page returned 404.
• The audit counts, lines-of-code figures and "92% of remedies implemented" are self-reported.
• No Nethermind response to the zkLend incident was found; zkLend's own Medium post-mortem returned 403 and was not read.

Sources

1. Nethermind Security page, accessed 2026-09-24
2. Nethermind homepage, accessed 2026-09-24
3. Smart contract audits page, accessed 2026-09-24
4. Formal verification page, accessed 2026-09-24
5. Contact page, accessed 2026-09-24
6. PublicAuditReports repository, accessed 2026-09-24
7. PublicAuditReports commit history, accessed 2026-09-24
8. AuditAgent, accessed 2026-09-24
9. Blog: How Nethermind Security uses AuditAgent, accessed 2026-09-24
10. Horus repository, accessed 2026-09-24
11. Surveyor repository, accessed 2026-09-24
12. Null Solutions report, accessed 2026-09-24
13. ENS Diamonds report, accessed 2026-09-24
14. Suno report, accessed 2026-09-24
15. Vistapex report, accessed 2026-09-24
16. Karnot Arcx report, accessed 2026-09-24
17. XDC Prime Stake report, accessed 2026-09-24
18. Royco Makina strategy report, accessed 2026-09-24
19. Panoptic V2 report, accessed 2026-09-24
20. World Rollup Boost report, accessed 2026-09-24
21. rekt.news: zkLend, accessed 2026-09-24
22. rekt.news: USPD, accessed 2026-09-24