Quantstamp

Quantstamp is a Web3 security firm founded in 2017 that offers smart-contract and infrastructure audits, alongside monitoring, incident response, vCISO and insurance-related services. It fits teams that want one vendor able to cover Solidity plus less common stacks, such as Daml on Canton, Cadence on Flow, FunC on TON and Rust on Solana. The strongest evidence is a searchable public certificate index of 400 reports from October 2018 to October 5, 2026 (re-counted 2026-10-14; 398 on 2026-09-24), 34 of them published in the trailing 12 months.

At a glance

Founded	2017 (homepage); CEO and founder Richard Ma (team page)
Headquarters / jurisdiction	Not stated on fetched pages; the /about URL returned 404
Engagement model	Private firm audit; plus economic-exploit analysis, infrastructure/pentest, OpSec review, monitoring, incident response, vCISO (homepage)
Core specialties	Solidity DeFi (vaults, stablecoins, prediction markets), smart-contract wallets/account abstraction, L1/L2 infrastructure, non-EVM ledgers (Daml/Canton, Cadence/Flow, FunC/TON)
Ecosystems / languages	Solidity (315 of 400 public reports on 2026-10-14), Rust (28), JavaScript/TypeScript, FunC (13), Go, Move, Vyper, Daml, Cadence, Circom; tagged chains include Ethereum, Arbitrum, Polygon, Solana, BSC, TON, Optimism, Base
Public report index	certificate.quantstamp.com
Open-source tooling	halo2-analyzer, l2-security-framework, erc4337-checker, flashsyn (GitHub org)
Published pricing	Not published (audits page; request form)

What they do

The homepage lists these services:

• Smart contract audits
• Economic exploit analysis
• Penetration testing and infrastructure audits
• OpSec reviews
• Continuous monitoring
• Incident response
• vCISO
• Security certification
• Links to Chainproof (insurance) and a "communication firewall" product

The economic exploits page describes automated detection of flash-loan attack vectors for deployed or pre-launch DeFi protocols.

The audits page describes the audit flow: request and scoping, kickoff, audit, initial report, client remediation, then a final report that reviews the fixes. It says clients choose whether to list reports publicly. It claims "20+ languages" and "55+ ecosystems". Cost and duration are quoted per project.

Older reports show a fix-review record for each finding. The Teku report lists auditors, timeline, languages and methods, and gives each QSP-numbered finding a High/Medium/Low/Informational/Undetermined risk rating and a Fixed/Acknowledged/Unresolved status (Teku report).

Specialties and ecosystem coverage

Counted from the certificate index API (API) on 2026-09-24, by paging through all 398 entries and tallying their tags (a 2026-10-14 re-count of 400 entries moved Solidity to 315, Ethereum to 265 and Polygon to 23; the other tallies are the September figures):

• Languages: Solidity 313, JavaScript 46, Rust 28, TypeScript 13, FunC 13, Go 6, Move 4, Vyper 4, Daml 4, Cadence 3, Circom 2, plus single-digit Scala, Rell, Michelson, Scilla and Bitcoin Script.
• Chains: Ethereum 264, Arbitrum 26, Polygon 22, Solana 19, BSC 16 (plus 6 tagged "BNB chain"), TON 14, Optimism 10, Base 8, TAC 8, Flow 4, Canton Network 4, Sui 3, Avalanche 2, and others.
• Last 12 months (35 reports on 2026-09-24; 34 on 2026-10-14): Solidity 21, Solana/Rust 4, Canton/Daml 3, Base 3, Arbitrum 3, Sui/Move 2, and one each for Flow/Cadence, Tron, TON and Circom.

Against the directory entry:

• Ethereum, Arbitrum, Polygon, Optimism, BNB Chain and Solana are confirmed by tagged reports.
• Avalanche has only 2 tagged reports.
• L2 work is supported: Arbitrum and Optimism tags, the published l2-security-framework, and Zircuit engagements.
• Staking and NFT categories exist in the index's tag taxonomy.

Recent public work

Nine of the ten most recent entries in the certificate index. Dates and tags come from the index API.

1. Newer on 2026-10-14: Polymarket Protocol V2 (2026-10-05, Quantstamp was one of six auditors) and OnRe EVM (index). Newer on 2026-10-14: Polymarket Protocol V2 (2026-10-05, Quantstamp was one of six auditors) and OnRe EVM (index).

2. Hinkal Protocol – 2, 2026-09-15. Solidity and Circom, smart-contract wallet, Ethereum (report).

3. Zircuit Finance – Merkle Distributor, 2026-09-07. Solidity, Ethereum and Base (report).

4. Strata Markets update – Isolated and Saturn strategies, 2026-08-26. Solidity yield aggregator (report).

5. Canton Coin – 2026 audit, 2026-08-12. Daml and Scala, Canton Network L1 (report).

6. tapir protocol, 2026-08-07. Solidity stablecoin (report).

7. Bitsafe – Dec Manager, 2026-06-16. Daml, Canton (report).

8. Polymarket CTF Exchange v2, 2026-04-21. Solidity, Polygon (report).

9. OnRe – mmbot, 2026-04-10. Rust/Anchor, Solana (report).

10. Flow Core Contract, 2026-02-25. Cadence, Flow (report).

Research, tooling and methodology

• Open source (GitHub org):
  • halo2-analyzer, which finds unused gates, unconstrained cells and unused columns in Halo2 ZK circuits and is described as an SMT 2023 submission.
  • l2-security-framework, for assessing L2 security (last updated 2023).
  • erc4337-checker, for account-abstraction rules (updated March 2026).
  • flashsyn, for price-manipulation analysis (updated September 2026).
• Blog: monthly "Security Beat" incident roundups through August 2026, plus technical posts on EIP-7702 impact (April 2025) and Solidity contract families (April 2025) (blog).
• Severity scheme: High / Medium / Low / Informational / Undetermined risk, with each finding tracked as Fixed, Acknowledged or Unresolved (Teku report).
• Team: the team page names CEO and founder Richard Ma, mentions multiple PhD holders, and lists staff with backgrounds at Microsoft, Amazon and others. The homepage says staff come from the Ethereum Foundation, Google, Meta and others.
• Self-reported figures: the homepage claims "1,300+ audits" and "$500B+" in assets secured, while the audits page says "750+ projects across 40+ ecosystems". These figures are inconsistent with each other and larger than the 400 public reports; they were not verified.

Track record and incidents

• Nomad Bridge (August 2, 2022, about $190M). rekt.news reports that Nomad completed a Quantstamp audit in June 2022. The exploited condition, a Replica contract initialized with 0x00 as a trusted root, was introduced in a later upgrade. rekt.news notes that the audit's finding QSP-19 foreshadowed a similar issue, and quotes the auditor's remark that the team had "misunderstood the issue" (rekt.news). On this account, the exploited change came after the audit.
• Cork Protocol (May 28, 2025, about $12M). Quantstamp was one of four audit providers. rekt.news notes that Quantstamp published its report with commit hashes and scope (rekt.news). Dedaub's analysis says three of the four providers did not audit the vulnerable hook contracts; it names Cantina/Spearbit as likely having the hook in scope and does not place it in Quantstamp's scope (Dedaub). No source found in this pass puts the exploited code in Quantstamp's audited scope.

An exploit after an audit is not, by itself, proof of a missed finding. No other reputable post-audit incident naming Quantstamp was reviewed in this pass.

Who should consider them — and who might look elsewhere

• Consider for Solidity DeFi and wallet/account-abstraction work, where the public record is deepest.
• Consider for non-EVM stacks that few firms publicly cover, such as Daml/Canton, Cadence/Flow and FunC/TON, each with recent public reports.
• Consider if you want audit plus adjacent services (monitoring, incident response, OpSec, vCISO) from one vendor.
• Look for other evidence for Cairo/Starknet (no tagged reports) and for formal-verification-heavy engagements (none advertised as a service on the pages reviewed).
• About 35 public reports a year suggests many engagements stay private. Ask for private samples in your stack.

How to engage

Use the audit request form, which asks for your name, Telegram, email, project name or URL, project type, timeline and a brief description. The team then follows up with scope, timeline and next steps. Quantstamp also publishes an audit readiness guide. Prepare the repository and commit, documentation, lines in scope, your deployment chains, and whether you want the report listed publicly.

Gaps and unverified claims

• Headquarters is not stated; /about returns 404 although it is linked from the site. Blitz, the firm's two-day AI-accelerated review, lives at blitz.quantstamp.com (quantstamp.com/blitz returns 404).
• The directory's team size is "18 named", the team page roster. That page states no headcount.
• Directory notable audits: MakerDAO (Liquidations 2.0, 2021) and Curve (Curve Finance diff, 2020) are in the index. Lido appears only as a Zircuit/Lido proposal (2024). No index entry is named Polygon or Solana Foundation, though both are shown as clients on the homepage.
• The directory's public-reports link (quantstamp.com/audits) is a services page; the index is certificate.quantstamp.com.
• The directory's turnaround "4–8 weeks" is not published by the firm.
• Recent reports are JavaScript-rendered pages, so finding counts for 2026 reports were not extracted.

Sources

1. Quantstamp homepage, accessed 2026-09-24
2. Quantstamp audits page, accessed 2026-09-24
3. Quantstamp team page, accessed 2026-09-24
4. Economic exploit analysis page, accessed 2026-09-24
5. Audit request form, accessed 2026-09-24
6. Audit readiness guide, accessed 2026-09-24
7. Quantstamp blog, accessed 2026-09-24
8. Certificate index, accessed 2026-09-24
9. Certificate index API (sorted newest first), accessed 2026-09-24
10. Teku report, accessed 2026-09-24
11. Hinkal Protocol – 2 report, accessed 2026-09-24
12. Zircuit Finance Merkle Distributor report, accessed 2026-09-24
13. Strata Markets update report, accessed 2026-09-24
14. Canton Coin 2026 report, accessed 2026-09-24
15. tapir protocol report, accessed 2026-09-24
16. Bitsafe Dec Manager report, accessed 2026-09-24
17. Polymarket CTF Exchange v2 report, accessed 2026-09-24
18. OnRe mmbot report, accessed 2026-09-24
19. Flow Core Contract report, accessed 2026-09-24
20. Quantstamp GitHub organization, accessed 2026-09-24
21. halo2-analyzer repository, accessed 2026-09-24
22. rekt.news: Nomad Bridge, accessed 2026-09-24
23. rekt.news: After the Post-Mortem (Cork), accessed 2026-09-24
24. Dedaub: Cork Protocol hack analysis, accessed 2026-09-24