Pashov Audit Group

Pashov Audit Group is a network of freelance security researchers led by Krum Pashov. It runs short, time-boxed smart-contract reviews, usually staffed by a small team drawn from competitive-audit winners. It fits EVM DeFi teams (lending, DEXs, stablecoins, yield) that want a fast start and a multi-researcher review, and it also has some Solana and Cairo work. The strongest evidence-backed signal is its public GitHub report repository, which held 259 team reports, 50 solo reports and 1 "agentic" report when re-counted on 2026-10-14 (255 team reports on 2026-09-24). Clients in that repository include Aave, Uniswap, Ethena, LayerZero, Pump and StarkWare's Starknet staking.

At a glance

Founded	Group founding year not stated by the firm. Krum Pashov's solo reports start in Q4 2022 (solo index).
Headquarters / jurisdiction	Not published
Engagement model	Solo-founder-led group of freelance researchers; time-boxed private reviews with a fix review (report example)
Core specialties	EVM DeFi: lending, DEXs, stablecoins, yield, RWAs (repo README)
Ecosystems / languages	EVM (Solidity) predominant; Solana (Rust) and Starknet (Cairo) evidenced in reports
Public report index	github.com/pashov/audits
Open-source tooling	pashov/skills: solidity-auditor (AI agents), fizz (fuzz-suite generator), x-ray (pre-audit recon)
Published pricing	Not published; custom quotes (homepage)

What they do

The homepage describes smart-contract security audits across DeFi protocols, bridges, NFTs, marketplaces and governance systems, done through manual review supported by tooling. It says engagements are staffed with four senior auditors and estimates durations from 3–5 days for single contracts to 2–4 weeks for complex protocols. The request page advertises "Start an audit in 24 hours". It asks only for an email, with optional project name and Telegram handle, and points to Telegram or email for direct contact.

Each published report lists the review commit hashes and separate fix-review commit hashes. The reports describe the group as freelance researchers, most of whom have earned public contest rewards (Pump report, October 2025). In September 2026 the firm published its auditor vetting process: government-ID and liveness checks, OFAC/EU/UN sanctions screening, payout-wallet screening, signed contractor and data-protection agreements, and continuous re-screening. The stated aim is to keep DPRK-linked operators out.

The homepage claims 400+ audits, 4,000+ vulnerabilities found, $100B+ TVL secured and 50+ researchers. These are self-reported figures. The older report header states "40+" researchers and "over 300" audits, which suggests the figures have been updated over time.

Specialties and ecosystem coverage

The repo README groups showcase clients under Lending, DEXs, Stablecoins, Yield, RWAs and Others. Named clients include Aave, HyperLend, HypurrFi, Uniswap, PancakeSwap, Sushi, Ethena, LayerZero, Pump, Resolv, Kinetiq, StakeDAO, Euler Earn, YieldBasis, Ostium and Dinari.

Language evidence from sampled reports:

• EVM/Solidity: the large majority of reports, e.g. BNB Chain BEP-677 contracts.
• Solana/Rust: Pump's bonding-curve and AMM programs (pump-contracts-solana, pump-amm-2) in the October 2025 Pump report.
• Starknet/Cairo: Starknet staking, July 2025, reviewing starkware-libs/starknet-staking.

Directory comparison:

• The EVM chains listed (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain, Avalanche) are consistent with Solidity work. This pass did not map individual reports to each L2.
• Solana and Starknet appear in reports but are not in the directory's chain list.
• Of the directory's notable audits, Aave, Uniswap, Ethena and LayerZero are confirmed in the repo. Pendle, EtherFi, Usual and Beefy were not found among the public PDF filenames.

Recent public work

Most recent dated reports in team/pdf (dates from file names):

• Team reports dated 2026-09-17, 2026-09-28 and 2026-10-01 were added by 2026-10-14, with the latest upload on 2026-10-12 (commit history); the README was also restructured in early October 2026 with per-client "Report 1, 2…" labels, a Launchpads row and Polymarket added
• Team reports dated 2026-09-17, 2026-09-28 and 2026-10-01 were added by 2026-10-14, with the latest upload on 2026-10-12 (commit history); the README was also restructured in early October 2026 with per-client "Report 1, 2…" labels, a Launchpads row and Polymarket added
• Ensemble, 2026-09-14
• K3, 2026-09-03
• Lodestar (agentic audit report), 2026-08-21
• Yuzu Money, 2026-07-07
• DefiApp, 2026-05-23
• Biconomy, 2026-05-14
• BNB Chain (BEP-677), 2026-04-30
• Reserve, 2026-02-27
• Aave, 2025-11-29
• Pump, 2025-10-08

Counting method: the file listing of team/pdf, solo/pdf and agentic/pdf on GitHub was parsed on 2026-09-24. team/pdf had 255 PDFs on 2026-09-24 (259 on 2026-10-14), 149 of them with a date in the filename (19 in 2024, 106 in 2025, 24 in 2026). The rest are undated. solo/pdf has 50 and agentic/pdf has 1.

Research, tooling and methodology

• AI-assisted auditing tools. pashov/skills (MIT licence) packages three agent "skills" for AI coding assistants. solidity-auditor is a 12-agent vulnerability finder, fizz generates Echidna/Medusa fuzzing suites, and x-ray does pre-audit threat modelling and entry-point mapping.
• Benchmarks. The firm's v4 write-up (September 23, 2026) reports 84.6% recall on High-severity findings on one past contest codebase (Ammplify), up from 38.5% for v3. This is a single-benchmark, self-reported result. The Fizz post (June 28, 2026) describes the fuzzing tool.
• Agentic reports. The repository now has a separate agentic/ folder with one report. The firm does not publicly describe how agentic reports differ in staffing or assurance level from team reviews; buyers should ask.
• Report format. Reports name the researchers, list the in-scope files, and include both review and fix-review commit hashes (example).

Track record and incidents

Reputable write-ups naming Pashov Audit Group as an auditor:

• Arcadia Finance (Base), July 2025, about $3.6M. Per rekt.news, Pashov's Q3 2024 audit scope included the Rebalancer, RebalanceLogic and SwapLogic, so the exploited SwapLogic._swapViaRouter() path was in scope. A Pashov team member told rekt that the team logged the attack vector internally but closed it after failing to build an exploit, and that it likely never reached the client. rekt also notes the other auditors (Trust Security, Sherlock, Renascence Labs) did not review the Rebalancer. The public reports are in the repo.
• Veil Cash. rekt.news states that Pashov had audited Veil Cash and that the exploited verifier contract was out of scope for that engagement (report).
• Bunni, September 2025, about $8.4M. rekt.news lists a Pashov review from August–September 2024 (45 issues, 6 critical) among several audits. It notes the code kept changing afterward and does not say whether the exploited rounding logic was in Pashov's reviewed commit.
• Ostium, July 2026, about $23.75M. rekt.news lists Pashov audits in January 2025, April 2025 and January 2026. It describes the exploited price-keeper component as outside the zone auditors were contracted to examine.

An exploit after an audit is not by itself proof of a missed finding. Arcadia is the one case in this set where a source ties an in-scope issue to the firm's internal triage.

Who should consider them — and who might look elsewhere

The strongest public evidence is in EVM DeFi: lending markets, DEXs, stablecoins and yield vaults, with many repeat engagements (e.g. multiple Ethena, BOB, Hyperlend and Ostium reviews). The model suits teams that want a quick start and a short, time-boxed review with a fix pass. There is real but smaller evidence for Solana and Cairo. Teams needing formal verification, cryptography or ZK circuit review, L1/client-level work, or a published pricing schedule will not find much public evidence for those here. Teams considering an "agentic" report should ask how it differs from a staffed team review.

How to engage

Use the request form, which needs an email and optionally a project name and Telegram handle. The page also offers Telegram and email. Prepare a frozen commit, the list of in-scope files, documentation of trust assumptions and off-chain components, and your timeline. Given the incidents above, confirm in writing which contracts, libraries and integrations are in and out of scope, and ask how internally dismissed issues are communicated.

Gaps and unverified claims

• The founding year of the group is not stated by the firm. The directory's 2023 is consistent with the repo history (solo work from Q4 2022, dated team reports from 2024) but is not confirmed.
• Headquarters and legal entity are not published.
• Homepage figures (400+ audits, 50+ researchers, $100B+ TVL) are self-reported. The public repo held 310 PDFs across team, solo and agentic folders on 2026-10-14 (306 on 2026-09-24), and some engagements may be private.
• Pendle, EtherFi, Usual and Beefy (directory notable audits) were not found in public report filenames.
• The directory's socials.github points to the reports repo rather than a GitHub org or user; the tooling lives at pashov/skills.
• Arcadia Finance's own post-mortem on Medium returned HTTP 403 and could not be read in this pass.

Sources

1. Pashov Audit Group homepage, accessed 2026-09-24
2. Request an audit, accessed 2026-09-24
3. Blog: How we vet our auditors, accessed 2026-09-24
4. Blog: solidity-auditor v4, accessed 2026-09-24
5. Blog: Fizz, accessed 2026-09-24
6. pashov/audits repository, accessed 2026-09-24
7. pashov/audits README (raw), accessed 2026-09-24
8. Solo audits index (raw), accessed 2026-09-24
9. team/pdf folder listing, accessed 2026-09-24
10. pashov/skills, accessed 2026-09-24
11. Report (md): Pump, 2025-10-08, accessed 2026-09-24
12. Report: Pump, 2025-10-08, accessed 2026-09-24
13. Report: Starknet staking, 2025-07-31, accessed 2026-09-24
14. Report: BNB Chain, 2026-04-30, accessed 2026-09-24
15. Report: Ensemble, 2026-09-14, accessed 2026-09-24
16. Report: K3, 2026-09-03, accessed 2026-09-24
17. Agentic report: Lodestar, 2026-08-21, accessed 2026-09-24
18. Report: Yuzu Money, 2026-07-07, accessed 2026-09-24
19. Report: DefiApp, 2026-05-23, accessed 2026-09-24
20. Report: Biconomy, 2026-05-14, accessed 2026-09-24
21. Report: Reserve, 2026-02-27, accessed 2026-09-24
22. Report: Aave, 2025-11-29, accessed 2026-09-24
23. Report: Arcadia, accessed 2026-09-24
24. Report: Veil Cash, 2025-02-12, accessed 2026-09-24
25. rekt.news: ArcadiaFi, accessed 2026-09-24
26. rekt.news: Bunni, accessed 2026-09-24
27. rekt.news: Ostium, accessed 2026-09-24
28. rekt.news: Default Settings (Veil Cash), accessed 2026-09-24