QuillAudits

QuillAudits (QuillAudits LLC) is a high-volume smart-contract audit firm, established as QuillAudits in 2019. Alongside audits it offers pentests of Web2 and dApp front ends, AI-assisted scanning, multisig/OpSec reviews and compliance readiness. It fits token launches and early-stage DeFi, RWA and dApp teams that want quick, broad chain coverage and a report they can publish. The strongest evidence is a public GitHub repository of about 906 report PDFs (re-counted 2026-10-14; 893 on 2026-09-24) that receives new reports weekly, including September 2026 audits in Solidity, Rust (Solana) and Move.

At a glance

Founded	2019 as QuillAudits, following earlier QuillHash ventures from 2017 (about page)
Headquarters / jurisdiction	QuillAudits LLC (contact page footer); GitHub org lists the United States; city not stated
Engagement model	Private firm audit with a second-pass researcher group ("Vigilant Squad"); also pentest, vCISO, monitoring, compliance readiness (homepage)
Core specialties	Token and DeFi contract audits, RWA/tokenized-fund contracts, dApp/Web2 pentests, launch-stage reviews
Ecosystems / languages	EVM (Solidity), Solana (Rust, SPL tokens), Move (Sui, Movement); smaller numbers on TON and Starknet
Public report index	Quillhash/QuillAudit_smart_contract_audit_Reports
Open-source tooling	multisig-inspector plus educational repos (auditor roadmap, Solidity and DeFi attack vectors, Web3 security tools list)
Published pricing	Not published (audit page)

What they do

The homepage lists:

• Smart contract audits
• Design security (vCISO, threat modeling)
• AI-powered detection (QuillShield)
• Operational security and multisig audits
• Real-time monitoring and incident response
• Compliance readiness (VARA, SOC 2, ISO/IEC 27001, NIS2)

It names products including QuillShield, AEGIS, QuillMonitor, QuillGuard, Multisig Inspector and an RWA Security Score.

The smart contract audit page describes a senior-led manual review, independent validation by a "Vigilant Squad" of researchers, fuzzing with Echidna, Medusa, Foundry and Chimera, and a separate lead-auditor review. The homepage says 10–12 researchers are involved per audit. Duration and pricing are not published; the page asks you to request a quote.

Published reports show a two-round model. Each report lists "Review 1" dates, "Review 2" (the fix review) dates and a "Fixed In" commit, plus the language, chain and methods used. For example, the Zynk Solana V3 report shows Review 1 from August 27 to September 9, 2026, Review 2 from September 12 to 14, and fixes at commit e966d5f (report). Some reports record no fix round ("Review 2: NA"), as in the TBC Token report (report).

The leaderboard is a public listing of audited projects with a security-score model (effective November 18, 2025) and an optional KYC-based "QuillAudits Verified" status. It is not a contest platform.

Specialties and ecosystem coverage

From the reports repository file tree on 2026-09-24: 893 PDFs at the top level (902 on 2026-10-14, after 15 further commits), plus folders for audit certificates, audit forensics, "Lite Technical Due Diligence", case studies and community audits. Most filenames do not name a chain, so the counts below are keyword matches on filenames and understate true coverage.

• EVM / Solidity: dominant. Recent examples are Tajir chain (Ethereum), SL Labs (BNB), GigaBlocks V2 and BXCT (tokenized fund registers with LayerZero mint/burn).
• Solana: confirmed. There are three Zynk Solana reports and eight "SPL Token" reports; Zynk V3 lists Rust on Solana.
• Move: confirmed. Filenames include Move reports (Alkimi, Kanalabs, Swaye) and Sui reports (Swarm Sui, Sui Inpact). The September 2026 Zvault report lists Move on Movement Chain (report).
• Pentest / dApp: 41 filenames contain "Pentest". The directory's "penetration-test" and "dapp" audit types are supported.
• Other: Starknet (a Lido Starknet governance forwarder report); Metis (two reports); Taiko (one report).
• Directory chains: Arbitrum, Base, Optimism, Polygon and Avalanche are listed as supported on the firm's pages, but none appears in a report filename, so per-chain evidence was not established. Cosmos, which is in the directory entry, was not found in filenames or on the pages reviewed.

Recent public work

Taken from the repository's commit history, newest first. Dates come from the report text where stated.

1. BXCT (BetterX tokenised fund registers and AUDX settlement token), Solidity, dated September 16, 2026 (report).
2. Zynk Labs Solana V3, Rust on Solana, reviewed August 27 to September 14, 2026 (report).
3. Zoth ZVault, Move on Movement Chain, reviewed August 6–17 with a fix review on September 4, 2026; 1 high finding (report).
4. Tajir chain, Solidity/Ethereum, July–August 2026 (report).
5. Seasons SPL Token (Solana), added September 4, 2026 (report).
6. TBC Token, Solidity/EVM, August 27, 2026 (report).
7. Jurat pentest, added September 1, 2026; 6 high-severity findings, covering a platform that handles on-chain fund movement and probate data (report).
8. SL Labs, Solidity/BNB, July 31, 2026 (report).
9. GigaBlocks Smart Contract V2, Solidity, July 9, 2026 (report).

Research, tooling and methodology

• Methods in reports: manual analysis, functional testing and automated testing, with threat modelling on some engagements. Findings are rated Critical, High, Medium, Low or Informational (Zvault report; Zynk report).
• Open source and education (GitHub org): an auditor roadmap (637 stars), Solidity attack vectors, DeFi attack vectors, a curated Web3 security tools list, an RWA developer handbook, and multisig-inspector (a Gnosis Safe scanner).
• Hack research: the firm maintains a Web3 hacks database and publishes exploit breakdowns and an annual hack report (for example, the 2025 Web3 hack report).
• Team: the about page names co-founders Preetam (CEO) and Rajat (CSO), Akshay (Head of Audits) and Akshat (CTO). Team size is not published.
• Self-reported figures: "1,500+" audits and projects, "$3B+" TVL secured, and "1M+" lines reviewed (homepage; about page). The vulnerability counts differ between pages: "10,000+ issues" on the homepage and "5000+" on the leaderboard. None were independently verified.

Track record and incidents

No reputable post-audit incident naming QuillAudits as the auditor of exploited code was found in this pass.

Who should consider them — and who might look elsewhere

• Consider for token contracts, launch-stage DeFi, RWA/tokenized-fund contracts and dApps that need both a contract audit and a Web2/API pentest from one vendor. The public repo has deep volume in these areas.
• Consider if you need Solana SPL/Anchor or Move (Sui, Movement) coverage alongside EVM from the same firm.
• Look for other evidence for complex protocol-level or infrastructure work (L1/L2 clients, ZK circuits, formal verification). None was found among the reviewed reports.
• Report volume is high, and some reports record no fix-review round. If a fix review matters to you, confirm that a second review round is in scope.

How to engage

Use the quote form on the contact page, which asks for the project name, links, service type, preferred contact platform and whether the request is urgent. The page also offers a free consultation booking and contact by Telegram, Discord, X or email. Prepare the repository and commit, the chains you will deploy to, lines in scope, launch date, and whether you also want a pentest or multisig/OpSec review.

Gaps and unverified claims

• The directory's founding year is 2019, matching the firm's about page (QuillAudits since 2019). Earlier QuillHash ventures from 2017 are not the founding year.
• The directory's team size "38+" is not published by the firm.
• The directory's public-reports link (/smart-contract-audit) is a services page; the index is the GitHub repository.
• Directory notable audits: Taiko and Metis are confirmed by report filenames. Polygon, Manta and Covalent were not found in filenames; this is not proof they are absent, because older files may be named differently.
• Cosmos (directory chain) is not evidenced. Move/Sui/Movement are evidenced but missing from the directory.
• The repository commit history shows frequent same-day delete-and-re-upload of reports, so the file set changes often.

Sources

1. QuillAudits homepage, accessed 2026-09-24
2. Smart contract audit page, accessed 2026-09-24
3. About page, accessed 2026-09-24
4. Contact page, accessed 2026-09-24
5. Leaderboard, accessed 2026-09-24
6. Web3 hacks database, accessed 2026-09-24
7. 2025 Web3 hack report, accessed 2026-09-24
8. Quillhash GitHub organization, accessed 2026-09-24
9. Audit reports repository, accessed 2026-09-24
10. Reports repository commit history, accessed 2026-09-24
11. BXCT report, accessed 2026-09-24
12. Zynk Labs Solana V3 report, accessed 2026-09-24
13. Zvault report, accessed 2026-09-24
14. Tajir chain report, accessed 2026-09-24
15. Seasons SPL Token report, accessed 2026-09-24
16. TBC Token report, accessed 2026-09-24
17. Jurat pentest report, accessed 2026-09-24
18. SL Labs report, accessed 2026-09-24
19. GigaBlocks V2 report, accessed 2026-09-24