Pessimistic

Pessimistic (pessimistic.io) is a smart-contract audit firm that says it has done security audits since 2017. It mainly reviews Solidity DeFi, wallets, bridges and token contracts, and also offers retainers, vCISO and monitoring services. It fits EVM teams, especially those with small-to-mid-size codebases, who want a published report that includes a recheck of fixes and an up-front pricing formula. The strongest evidence is its GitHub portfolio of 182 public report PDFs, including 14 separate 1inch engagements, with new reports added as recently as August 2026.

At a glance

Founded	Not stated as an incorporation year. The homepage and audits README say "trusted security audits since 2017"; the directory lists 2017 on that basis (its earlier 2021 had no source; the GitHub org dates from October 2020).
Headquarters / jurisdiction	Not stated on the pages fetched (contacts page lists no address or legal entity)
Engagement model	Private firm audit; also consulting, retainer/subscription, vCISO and threat monitoring (homepage)
Core specialties	Solidity DeFi (DEX aggregators, lending, vaults, options), smart wallets and account abstraction, bridges, staking, DAO/governance, tokens and vesting
Ecosystems / languages	EVM (Solidity) across Ethereum, Arbitrum, Base, BNB Chain and Polygon; some Radix (Rust/Scrypto) work
Public report index	pessimistic-io/audits
Open-source tooling	Slitherin (custom Slither detectors), foundry-toolkit, audit-process guide (GitHub org)
Published pricing	Formula published: (lines of code ÷ 200) × 1.5 × daily team cost (audit service page). The daily rate itself is not published

What they do

The homepage lists consulting, auditing (manual plus automated) and retainer services. Named service pages cover vCISO, blockchain protocol audit, smart contract audit, dApp audit and threat monitoring. It also names Spotter, a monitoring system for exploit detection.

The protocol audit page gives an eight-step process:

1. Freeze and share the code.
2. Receive a quote.
3. The team is engaged.
4. Review.
5. Private report.
6. Client fixes.
7. Re-verification of the fixes.
8. Public report.

The smart contract audit page says the team reviews "around 200 lines of code daily", that audits take from one week to one month, that a priority track is available, and that estimates are usually within 10% of the final invoice.

Published reports follow the recheck model: they record findings from the initial audit and then from each "codebase update". For example, the Tangem Gasless Transactions report found three medium issues, and after the first update one was addressed and others were commented on (report).

Specialties and ecosystem coverage

Counted from the audits repository file tree on 2026-09-24: 182 PDF reports.

• EVM / Solidity DeFi: confirmed and dominant. The repo includes 14 1inch reports (aggregation routers v4–v6, limit orders, Fusion settlement, cross-chain atomic swaps), Morpho (Aave V2 optimizer, Vaults), Venus, Azuro (six reports), Mellow Protocol (two), Resolv, Paladin, Opium, Mean Finance, PowerPool (eleven) and Lido Stonks.
• Wallets and account abstraction: Tangem (including gasless transactions), Kirobo/Intentable FCT smart wallet (multiple parts), and Kinto (nine reports, including access registry and governance).
• Bridges: confirmed (Kinto Bridger v1/v2 and SuperBridge hooks, PowerPool CVP Bridge, Brydge).
• Staking: confirmed (StakeWise, CYBRO staking, IQ NFT staking, Cybro LidoVault).
• Governance: confirmed (Kinto Governance, Fluence DAO, xDao, Spiral DAO, Beam DAO).
• Chains: the Tangem Gasless report lists Ethereum, Arbitrum, Base, BSC and Polygon PoS as deployment targets (report). Optimism, which is listed in the directory entry, was not tied to a specific report in this pass.
• Non-EVM: two Radix projects, DefiPlaza Radix (November 2023) and Weft Finance (December 2023). The Weft report lists a "Rust syntax and language issues" finding (DefiPlaza Radix; Weft Finance). Radix is not in the directory entry.

Recent public work

Taken from the repository's commit history, which gives the date each file was added. Report dates are included where the PDF text states one. Some recent PDFs (Tangem, Liquorice, Kommodo) are image-only, and their scope could not be extracted.

1. Tangem security analysis, updated in the repo on 2026-08-28 (PDF).
2. Liquorice, added 2026-08-07 (PDF).
3. Kommodo, added 2026-06-15 (PDF).
4. Bloquo, added 2026-04-07. Ethereum deployment, 708 lines, two medium issues, no critical (PDF).
5. Tangem Gasless Transactions, report dated March 30, 2026. Multi-chain EVM deployment (PDF).
6. CYBRO Liquidity Manager, report dated February 12, 2026 (PDF).
7. Leea Labs, report dated November 11, 2025 (PDF).
8. Cybro LidoVault, added 2025-10-06 (PDF).

The commit history shows roughly one to two public reports a month over the past year. The firm claims "400+" audits delivered (homepage), so the public repo appears to be a subset.

Research, tooling and methodology

• Slitherin: 24 custom Slither detectors, AGPL-3.0, tuned for higher sensitivity (with more false positives), including protocol-specific checks for Aave, Balancer and Uniswap integrations (GitHub). The org lists the repo as last updated June 2024 (org page).
• Automated tools in reports: recent reports name Slither, the firm's Slitherin plugin, and the AI scanners AuditAgent and Savant Chat, with automated results manually verified (Bloquo report).
• Other repos: audit-process (a guide to developer–auditor interaction), foundry-toolkit (fuzzing helpers), internship tasks, and a separate "scans" repo of lighter security-scan reports (org page).
• Severity scheme: reports group findings as Critical, High (in older reports), Medium and Low, and include test-pass and coverage figures (Bloquo report; Weft Finance report).
• Blog: blog.pessimistic.io returned 403 to automated fetch, so its recent posts were not reviewed.
• Team: the homepage names Alexander Seleznev (CEO) and Evgeny Marchenko (CTO) and refers to 15 experts. It claims 250,000+ lines audited and 2,600+ issues found; these figures are self-reported.

Track record and incidents

No reputable post-audit incident naming Pessimistic as the auditor of exploited code was found in this pass. Kinto, a repeat Pessimistic client, suffered a July 2025 token exploit through a proxy-initialization backdoor, but the rekt.news write-up does not name Pessimistic or any auditor (rekt.news). It is therefore not treated as an audit incident here.

Who should consider them — and who might look elsewhere

• Consider for Solidity DeFi components (routers, limit-order and settlement logic, vaults, lending adapters), smart-wallet and account-abstraction contracts, and token, vesting or governance modules. The repeat 1inch, PowerPool, Kinto and Azuro work is in these areas.
• Consider if budget predictability matters. The published sizing formula and the "200 lines a day" pace let you estimate effort before asking for a quote.
• Look for other evidence for Solana, Move, Cairo or ZK-circuit work: none was found in the public portfolio. Radix work exists but is limited to two 2023 reports.
• Formal verification: none is advertised.

How to engage

Use the quote form on the contacts page, which asks for your name, email, Telegram handle, codebase link and notes. The page also publishes hello@pessimistic.io and a Telegram contact. Per the protocol audit page, freeze the code first and share a commit and your documentation. Have your lines-of-code count ready, since pricing is calculated from it.

Gaps and unverified claims

• The directory founding year is 2017, taken from the homepage and audits README wording "trusted security audits since 2017"; the firm does not publish an incorporation year.
• The directory's team size is "15 experts", matching the homepage.
• Directory notable audits: Lido (Lido Stonks), 1inch and Mellow Protocol are in the repo. Symbiosis was not found among report filenames.
• Optimism (directory chain) is not tied to a specific public report. Radix, which is evidenced, is missing from the directory.
• Headquarters, legal entity and daily rate are not published on the pages fetched.
• The blog could not be reviewed (403).
• Recent image-only PDFs (Tangem, Liquorice, Kommodo) could not be text-checked for scope or date.

Sources

1. Pessimistic homepage, accessed 2026-09-24
2. Smart contract audit service page, accessed 2026-09-24
3. Blockchain protocol audit page, accessed 2026-09-24
4. Contacts page, accessed 2026-09-24
5. Pessimistic blog (403 on fetch), accessed 2026-09-24
6. pessimistic-io GitHub organization, accessed 2026-09-24
7. pessimistic-io/audits repository, accessed 2026-09-24
8. audits commit history, accessed 2026-09-24
9. Slitherin repository, accessed 2026-09-24
10. Tangem Gasless Transactions report, accessed 2026-09-24
11. Tangem report, accessed 2026-09-24
12. Liquorice report, accessed 2026-09-24
13. Kommodo report, accessed 2026-09-24
14. Bloquo report, accessed 2026-09-24
15. CYBRO Liquidity Manager report, accessed 2026-09-24
16. Leea Labs report, accessed 2026-09-24
17. Cybro LidoVault report, accessed 2026-09-24
18. DefiPlaza Radix report, accessed 2026-09-24
19. Weft Finance report, accessed 2026-09-24
20. rekt.news: Kinto ("Just Bad Luck?"), accessed 2026-09-24