Oxorio

Oxorio (legal name OXORIO-FZCO, Dubai Silicon Oasis) is a small smart-contract audit firm that mainly reviews Solidity DeFi, liquid staking and token contracts, and also builds zero-knowledge applications. It fits EVM teams who want a small, senior team and a published report with commit hashes and fix status for each finding. The strongest evidence is its public portfolio of 50 listed engagements from March 2022 to February 2026, including repeat work for Lido (twelve entries) and two Aave reports.

At a glance

Founded	Not stated. The site footer reads "© 2021-2026" (blog); the portfolio README claims "five years in smart contract auditing" (public_audits)
Headquarters / jurisdiction	OXORIO-FZCO, Dubai Silicon Oasis, United Arab Emirates (blog footer)
Engagement model	Private firm audit; also code review, pre-audit, and subscription audits (audits page)
Core specialties	Solidity DeFi, lending, liquid staking/restaking, token standards (including tokenized-asset standards), cross-chain governance bridges, ZK application development
Ecosystems / languages	EVM (Solidity; Vyper listed); Cairo and Rust listed; Circom and Noir in its own open-source work
Public report index	oxor-io/public_audits (PDFs) and audits.oxor.io (web reports)
Open-source tooling	No security tooling found; GitHub org holds workshops, Circom circuits and the SAMM contracts
Published pricing	Not published

What they do

The audits page lists four services:

• Code review: a quick quality assessment.
• Pre-audit: a 3-day review that highlights major vulnerabilities.
• Smart contract audit: a full review lasting 1–6 weeks.
• Subscription audit: periodic reviews on an ongoing basis.

It lists Solidity, Cairo, Rust and Vyper, with a focus on L2s, ZK and EVM protocols. The page states each audit uses at least three specialists with at least five years' experience. It describes a preliminary report, then time for the client to fix, then a final published report in an interactive tracking system. The homepage also lists penetration testing, incident response reports and formal verification, and states a minimum of two reviewers per audit, bi-weekly progress reports and a pace of 500–1,000 lines per week. The two pages differ on reviewer count (two versus three).

The published reports follow this model. Each records the audited commit, and the Privacy Pools core report lists both an initial and a final commit. Every finding carries a status (New, Fixed, Acknowledged, No Issue), and severities are Critical, Major, Warning and Info (Privacy Pools core report; Lido Earn report). The portfolio notes that all reports are published with client consent (public_audits).

Specialties and ecosystem coverage

From the 50 rows in the portfolio README (counted 2026-09-24; 46 have a PDF or web link):

• Ethereum / Solidity DeFi: confirmed. The portfolio includes Lido (v2 on-chain and off-chain, EasyTrack, Lido Earn, L2 and governance cross-chain bridges), Aave (v3.3.0, Liquid eModes), 1inch Fusion v1 and v2, Fathom, Zunami, Rho, Altitude, InceptionLRT and LTV.
• Polygon: confirmed through Lido on Polygon reports (2022–2023).
• BNB Chain: evidenced by "Lido wstETH on BNB Deployment Verification" and the WorldShards BEP-20 review. BNB is not in the directory entry's chain list.
• Arbitrum, Optimism, Base: not identifiable as distinct targets from report titles. Lido L2 and cross-chain bridge work touch L2s generally.
• Cross-chain: confirmed (Lido governance cross-chain bridges, WorldShards LayerZero bridge).
• Tokenized assets / compliance tokens: five WisdomTree Digital token-standard reports, August 2024.
• ZK: the firm built the Safe Anonymous Mail Module (SAMM) with Noir circuits under an Aztec Foundation grant, and third parties audited it (SAMM post). The GitHub org also has Circom circuit repos (GitHub). Privacy Pools reports appear in the audit portfolio.
• Cairo, Rust, Vyper: listed as audit languages and covered in blog posts (for example, Cairo security flaws, August 2024 — blog), but no Cairo, Rust or Vyper audit report was identified in the portfolio.

Recent public work

From the public_audits README, newest first:

1. Triumph Games – Triumph Token, 2026-02-11 (PDF). No critical or major findings.
2. Lido – Lido Earn, 2026-01-15 (PDF). No critical or major findings; all issues fixed or acknowledged.
3. LTV – LTV Smart Contracts and LTV Vault Craft, 2025-11-04 (PDF).
4. WorldShards – ERC-20 LayerZero bridge (2025-08-01) and BEP-20 token scope review (2025-07-29).
5. Privacy Pools – Precommitment PR, 2025-05-20.
6. Altitude v2, 2025-05-09.
7. Privacy Pools – core contracts, 2025-03-18 (PDF). 2 major findings: 1 fixed, 1 acknowledged.
8. InceptionLRT Symbiotic Vault, 2025-03-07.
9. Aave v3.3.0, 2025-01-29 (PDF).

The GitHub org shows the portfolio repo last updated March 25, 2026 (GitHub). No public report dated after February 11, 2026 was found.

Research, tooling and methodology

• Blog: mostly vulnerability-class explainers (reentrancy, integer overflow, access control, DoS, unchecked return values), Cairo- and Solana-focused posts, and case studies of its Zunami and Rho audits. The most recent post found is the SAMM project write-up from June 30, 2025 (blog index).
• Annual report: the 2023 security report says the firm analysed more than 15 audits covering 46,764 lines, found an average of 11 vulnerabilities per 1,000 lines, and that clients fixed only about one-third of reported issues; it gives about 4 weeks as the average audit length (2023 report).
• Severity scheme: Critical / Major / Warning / Info, with a per-finding status table in each report (Lido Earn report).
• Team (self-published on the homepage): two co-founders, Alexander Avdonin and Petr Korolev, described as Ethereum and Web3 Foundation grant recipients, plus "6+" Solidity auditors and developers and security researchers.
• Self-reported figures: the homepage claims 103,416 lines audited and 1,174 vulnerabilities found; the audits page says "30+ projects" and "90K+ lines". The two pages give different figures, and none were independently verified.

Track record and incidents

No reputable post-audit incident naming Oxorio as the auditor of exploited code was found in this pass. The firm's statement that none of its audited projects has been hacked (homepage; 2023 report) is its own claim and was not independently verified.

Who should consider them — and who might look elsewhere

• Consider for Solidity lending, vaults, liquid staking and restaking, and token contracts, including tokenized-asset token standards. Most public reports fall here, including repeat Lido work.
• Consider for small-to-mid-size codebases where a pre-audit or code-review tier is useful, or where you want ongoing subscription reviews.
• Look for other evidence, or ask for private samples, for Cairo, Rust/Solana or Vyper audits: they are listed as services but not shown in the public portfolio.
• The team is small by its own account, so confirm scheduling and who will staff the engagement.

How to engage

The portfolio README says to request an audit through the form at oxor.io. The homepage and audits page also publish ping@oxor.io and a Telegram contact. Prepare the repository and commit, lines in scope, documentation, prior audits, target dates, and which tier you want (code review, pre-audit, full audit, subscription).

Gaps and unverified claims

• The founding year is not stated as such. The site footer reads "© 2021–2026" and the homepage cites a track record since 2021 (oxor.io); Clutch also lists 2021 (Clutch). The directory lists 2021 on that basis; its earlier 2018 had no source.
• Four portfolio rows (1inch Fusion v2, Fathom Stablecoin 2023, Securrency, Rarible) have no linked report.
• Arbitrum, Optimism and Base (directory chains) could not be tied to specific public reports.
• Team size ("15+" in the directory) is not published as a number.
• No public reports have been added since February 2026.

Sources

1. Oxorio homepage, accessed 2026-09-24
2. Oxorio audits/services page, accessed 2026-09-24
3. Oxorio blog index, accessed 2026-09-24
4. Blog: Building SAMM with Aztec, accessed 2026-09-24
5. Blog: Oxorio 2023 Security Report, accessed 2026-09-24
6. oxor-io/public_audits repository, accessed 2026-09-24
7. oxor-io GitHub organization, accessed 2026-09-24
8. Oxorio web audit reports, accessed 2026-09-24
9. Triumph Token report, accessed 2026-09-24
10. Lido Earn report, accessed 2026-09-24
11. LTV Smart Contracts report, accessed 2026-09-24
12. Privacy Pools core report, accessed 2026-09-24
13. Aave v3.3.0 report, accessed 2026-09-24
14. Clutch: Oxorio profile (founded 2021), accessed 2026-10-14