OtterSec

OtterSec is a blockchain security firm that audits Layer 1 code, DeFi protocols, bridges and wallets, with its heaviest public footprint in Solana and the Move ecosystems (Sui, Aptos). It fits teams building on Solana, Sui, Aptos or cross-chain messaging who want a firm with low-level security research depth. The strongest evidence-backed signal is its public audit index, which listed 395 dated engagements from March 2022 to September 2026 when re-checked on 2026-10-14 (14 of them dated 2026), about a third of them tagged Solana.

At a glance

Founded	Not stated on the firm's site. Earliest report on its audit index is dated March 25, 2022; its GitHub org was created February 2022.
Headquarters / jurisdiction	Not published. Careers lists researcher roles across AMER/EMEA/APAC and one New York City role.
Engagement model	Private firm audit (quote-based)
Core specialties	Protocol and L1 code review, DeFi, bridges, wallets, pentesting, fuzzing, formal verification (services)
Ecosystems / languages	Solana (Rust), Sui and Aptos (Move), EVM (Solidity), Cosmos, NEAR, Stellar/Soroban, TON, Fogo, ZK systems (audit index)
Public report index	osec.io/audits
Open-source tooling	Anchor (Solana framework), bn-ebpf-solana, solana-verify / otter-verify, rCTF, CTF frameworks, vyper-fuzz (GitHub)
Published pricing	Not published; quotes are custom (services)

What they do

OtterSec's services page lists five offerings: protocol code auditing, ecosystem auditing (DeFi, bridges, wallets, backends, compilers, ZK systems and incident response), white-box and black-box pentesting aimed at Web2 attack surfaces in Web3 apps, formal verification, and fuzzing (differential compiler, transactional, JIT and bytecode fuzzers).

The published process has five stages: initial discussion, information gathering (under an MNDA, reviewing in-scope repositories), a quote based on duration and complexity, kickoff with ongoing sharing of findings, and report delivery with remediation suggestions (services). The page does not describe fix-review terms, retainers or a report publication policy. The homepage mentions post-audit support and lists self-reported figures ($36.82B+ TVL secured, 120+ projects audited); these are the firm's own claims and were not independently verified.

Specialties and ecosystem coverage

A count of chain tags on the audit index (parsed from the page HTML on 2026-09-24, 395 dated rows) gives: Solana 139, EVM 76 (plus 3 "ETH", 2 Arbitrum, 1 Polygon), Aptos 47, Sui 40, Cosmos 22, Crosschain 9, Multichain 8, NEAR 8, Stellar 6, Soroban 6, Movement 5, ZK 4, Web2 4, Fogo 3, and one or two each for TON, Fuel, Injective, Stacks, Berachain, Algorand and Cryptography.

Directory comparison:

• Solana, Ethereum/EVM, Aptos and Sui are well evidenced.
• Polygon and Arbitrum are listed in the directory but have only one and two tagged reports respectively; EVM work is generally tagged "EVM" rather than by L2.
• Cosmos (22 reports), NEAR, Stellar/Soroban and TON appear in the index but are not in the directory's chain list.
• "Move" as a specialty is well supported by Sui, Aptos and Movement reports. "NFT" is not clearly evidenced as a focus in this pass.

Recent public work

Pulled from the audit index, newest first (each link redirects to a PDF):

• Solana Keychain (Solana), September 22, 2026 — the newest entry on the index on 2026-10-14; 2026 entries added since September also include OnreApp, Rango, Ember Vaults, Matrixdock Gold and Onrail
• Solana Keychain (Solana), September 22, 2026 — the newest entry on the index on 2026-10-14; 2026 entries added since September also include OnreApp, Rango, Ember Vaults, Matrixdock Gold and Onrail
• Multi Host Tenant (Solana), August 18, 2026
• Ember Atomic Liquidity Vault (EVM), August 7, 2026
• Mercury Labs Sollpay (Stellar), July 27, 2026
• Doppler (Solana), March 27, 2026
• MetaDAO (Solana), February 12, 2026
• Sui Sentinel (Sui), January 21, 2026
• Tempest SPL Stake Pool (Fogo), January 11, 2026
• Wormhole NTT Solana (Solana), May 5, 2025
• Mysten DeepBook V3 (Sui), April 15, 2025
• LayerZero Router DVN (EVM), March 26, 2025
• Jito Restaking (Solana), October 10, 2024

Publication cadence has slowed on the index: 130 reports are dated 2024, 80 in 2025 and 13 so far in 2026 (same count as above). This may reflect fewer published reports rather than fewer engagements; the firm does not say.

Research, tooling and methodology

• Anchor. The canonical Anchor repository now lives at otter-sec/anchor; the former solana-foundation/anchor URL returned an HTTP 301 redirect there when checked on 2026-09-24. The repo is not a fork and is actively maintained in the OtterSec org. No formal stewardship announcement was located in this pass.
• Program verification. The GitHub org hosts solana-verify, otter-verify (on-chain verification of Solana programs) and a solana-verified-programs-api.
• Reverse engineering and fuzzing. bn-ebpf-solana (a Binary Ninja plugin for Solana eBPF), vyper-fuzz (a Vyper compiler fuzzer) and block-sdk-fuzzer (repo list via GitHub API).
• Disclosed research. Recent blog posts include a Fiat-Shamir soundness bug class found across six zkVMs (Jolt, Nexus, Cairo-M, Ceno, Expander, Binius64), which the firm says were all patched between October 2025 and March 2026. Other posts cover a PLONK verification gap in Dusk, insecure WebView integrations in 20+ wallets, a QEMU hypervisor escape, and an analysis of Hyperliquid's risk engine.
• CTF and community. The firm maintains rCTF (a CTF hosting platform) and Solana, Sui, Aptos and TON CTF frameworks. In July 2026 it announced a $100,000 Save CTFs Fund (blog).
• Team background. In a 2023 Sui Foundation interview, founder Robert Chen said the whole team comes from Web2 security.
• No public severity scheme or methodology document was found apart from the process summary on the services page.

Track record and incidents

• Cetus (Sui), May 2025, about $223M. Dedaub's analysis says OtterSec's early-2023 audit of the Aptos version found a similar overflow issue, and that audits of the Sui version by OtterSec and MoveBit did not find the exploited flaw. The flaw was in a flawed overflow check in a shared math library. Dedaub notes the library code may have been out of scope. The scope question is unresolved in the sources found, and no public OtterSec response was located.
• Makina Finance, January 20, 2026, about $4.13M. rekt.news lists OtterSec among six audits of Makina. It states that the vulnerability was not in the audited code but in an integration deployed after the audits finished. Based on that source, the exploited code was outside OtterSec's reviewed scope.

An exploit after an audit is not by itself proof of a missed finding.

Who should consider them — and who might look elsewhere

The strongest public evidence is in Solana programs, Sui and Aptos Move code, and cross-chain messaging (Wormhole, LayerZero). The firm also shows depth in low-level work such as compilers, zkVMs, eBPF tooling and kernel/hypervisor research. Teams whose code sits in those areas will find directly comparable reports in the index. EVM teams will also find a substantial body of work (about 80 reports), though the L2-specific tagging is thin. Teams that need a published price, a public fix-review policy or a published methodology document will not find those on the site and should ask during scoping.

How to engage

Use the contact form. It asks for name, email, company, optional budget and timeline, and a message describing what you are building, where the highest-risk parts are, and when you need coverage. Before a quote, expect an MNDA and a repository scope review (services). Prepare a frozen commit, scope list, architecture notes and your target launch date.

Gaps and unverified claims

• Founding year is not stated by the firm. The directory's 2021 is plausible but unverified; the earliest public report and the GitHub org date from 2022.
• Headquarters is not published. The site footer read "© Otter Audits LLC 2026" on 2026-10-14 (homepage), which names the legal entity but not its jurisdiction.
• Team size ("40+" in the directory) is not published by the firm.
• Homepage statistics (TVL secured, "120+ projects audited") are self-reported. The index lists more reports than that because many clients have several reports.
• "Solana Foundation" as a named client (directory) did not appear as an entry title on the audit index in this pass. Wormhole, Jito, LayerZero and Mysten Labs (Sui) are confirmed there.
• No formal announcement of the Anchor stewardship transfer was located; the claim rests on the repository location and redirect.
• No OtterSec public statement on the Cetus or Makina incidents was found.

Sources

1. OtterSec homepage, accessed 2026-09-24
2. OtterSec audit index, accessed 2026-09-24
3. OtterSec services, accessed 2026-09-24
4. OtterSec blog index, accessed 2026-09-24
5. Unfaithful claims: breaking 6 zkVMs, accessed 2026-09-24
6. OtterSec contact, accessed 2026-09-24
7. OtterSec careers, accessed 2026-09-24
8. OtterSec GitHub org, accessed 2026-09-24
9. GitHub API: otter-sec org, accessed 2026-09-24
10. GitHub API: otter-sec repos, accessed 2026-09-24
11. otter-sec/anchor, accessed 2026-09-24
12. solana-foundation/anchor (redirect), accessed 2026-09-24
13. Sui Foundation: OtterSec's Robert Chen interview, accessed 2026-09-24
14. Dedaub: Cetus AMM hack analysis, accessed 2026-09-24
15. rekt.news: Makina, accessed 2026-09-24
16. Report: Multi Host Tenant, accessed 2026-09-24
17. Report: Ember Atomic Liquidity Vault, accessed 2026-09-24
18. Report: Mercury Labs Sollpay, accessed 2026-09-24
19. Report: Doppler, accessed 2026-09-24
20. Report: MetaDAO, accessed 2026-09-24
21. Report: Sui Sentinel, accessed 2026-09-24
22. Report: Tempest SPL Stake Pool, accessed 2026-09-24
23. Report: Wormhole NTT Solana, accessed 2026-09-24
24. Report: Mysten DeepBook V3, accessed 2026-09-24
25. Report: LayerZero Router DVN, accessed 2026-09-24
26. Report: Jito Restaking, accessed 2026-09-24