Sec3

Sec3, formerly known as Soteria, is a security firm focused on Solana. It offers manual audits, formal verification, the open-source X-Ray static analyzer and free on-chain monitoring. It fits teams shipping Solana (Rust/Anchor) programs who want a reviewer with a long Solana-specific track record. The strongest evidence-backed signal is its GitHub audit list, which names 136 engagements from 2021 to August 2026 (table rows counted on 2026-09-24), most of them on Solana, including repeat and incremental work for Kamino, Helium, Monaco Protocol and Huma.

At a glance

Founded	Not verified; the homepage says the firm has been active since 2021
Headquarters / jurisdiction	Not stated on the homepage or contact page
Engagement model	Private firm audit, with formal verification and post-deployment support options (Audits)
Core specialties	Solana program audits, static analysis, formal verification, Solana ecosystem research
Ecosystems / languages	Solana (Rust/Anchor) predominantly; also Solidity/EVM, Sei, Radix Scrypto and some Web2 front/back-end reviews (reports README)
Public report index	sec3.dev/audits and github.com/sec3-service/reports
Open-source tooling	X-Ray (AGPL-3.0), IDL Guesser, Owl-LM (org repos)
Published pricing	Not published

What they do

The homepage lists the following services:

• Security audits (manual code review)
• Formal verification of protocol invariants
• Free monitoring of nonce staging and multisig configuration changes
• "SecLaunch", an end-to-end service running from protocol design through post-deployment operational security

The audits page describes a researcher-led review built on five components: program logic review, dependency and cross-program-invocation risk review, upgrade-authority and operational-security review, post-deployment monitoring support, and reporting with remediation and re-audit guidance.

The homepage claims 200+ protocols secured, 40+ research articles and team members who are 8-time DEF CON CTF finalists (homepage). These figures are self-reported.

On publication policy, the reports README states that reports are published "once our clients decide to publish them" (README). Many listed engagements therefore have no public PDF.

Specialties and ecosystem coverage

• Solana: Strongly evidenced. Most entries in the README are Solana programs. Examples include Kamino (lending, vaults, limit orders, Scope), Jupiter (Perpetual Exchange, Locker), Metaplex, Helium, Wormhole (Swap Layer, Fast Transfer), Pyth Express Relay, Meteora DLMM, Marginfi v2, Marinade and Pump AMM.
• EVM / Solidity: Present but secondary. The README lists LayerZero READ (Nov 2024), Mayan MCTP and Swift, Symphony Aggregator V1 (Dec 2025) and several smaller Solidity engagements. The directory lists Solana only.
• Other: Sei chain and cryptography-library work (2024), Radix Scrypto (CaviarNine, Surge), and some Web2 front-end and back-end reviews.
• Runtime monitoring: The current homepage describes free nonce and multisig monitoring. The older WatchTower product appears only in 2022 blog posts (blog), so the scope of any current paid runtime-monitoring offering is unclear.
• Directory notable audits: Marinade is confirmed (Nov 2023 in the README). Raydium is named as a client on the homepage, but no Raydium report appears in the public index. No Sec3 audit of Mango Markets was found in the index; Sec3's blog lists an analysis of the Mango exploit, which is not the same thing as an audit.

Recent public work

From the GitHub README and /audits:

1. Magpie v4 (Aug 2026, Solana): PDF listed in repo
2. Huma Permissionless incremental reviews (May, Jun and Aug 2026, Solana)
3. Huma Vault and incrementals (Jan and Aug 2026, Solana)
4. Symphony Aggregator V1 (Dec 2025, Solidity)
5. DeFi Tuna (2025, Solana), listed on /audits
6. Keel Solana PSM and Keel SVM ALM Controller (2025, Solana), listed on /audits
7. Kamino Lending Program and Kamino Lending Vault (Feb 2025, Solana)
8. Kamino Limit Orders (Jan 2025, Solana)
9. Kamino Scope (Dec 2024, Solana)
10. LayerZero READ (Nov 2024, Solidity; no public PDF)

A count of the repository tree via the GitHub API on 2026-09-24 found 37 PDF reports. The README table lists 136 engagement rows (counted on 2026-09-24: 1 in 2021, 29 in 2022, 36 in 2023, 59 in 2024, 4 in 2025, 7 in 2026), most without a linked PDF. The 2025 rows in the README are fewer than those shown on /audits, so the README may not be fully current.

Research, tooling and methodology

• X-Ray: An open-source static analyzer for Solana Rust programs. It lowers source through AST to LLVM-IR and ships built-in rules for issues such as integer overflow, type confusion and insecure account handling. AGPL-3.0 (repo).
• IDL Guesser: Recovers instruction layouts from closed-source Solana programs. It is the most-starred repo in the sec3-service org and was introduced on the blog in April 2025.
• Owl-LM: A 2023 open-source LLM for Web3, now inactive (last pushed May 2023 per the org listing).
• Research: The 2025 Solana Security Ecosystem Review analyses 163 security reviews and 1,669 recorded vulnerabilities. It reports that business logic, input validation and access control make up 82.5% of all findings. The blog includes a July 2026 post on Firedancer conformance, a Wormhole bridge case-study series and incident analyses. The README also lists bug-bounty findings for Firedancer, Jet Protocol and the TON compiler/VM (README).
• Blog cadence: Between April 2025 and July 2026 the blog lists only two posts, so long-form research output has slowed compared with 2022–2023.

Track record and incidents

• Loopscale (26 April 2025, about $5.8M, funds later fully recovered): Loopscale's own post-mortem states that the exploited RateX collateral-pricing path "had not yet undergone a formal third-party audit". It also states that its ongoing engagement with Sec3 covered the full program library and that Sec3 and two other auditors reviewed the patch. The Block likewise reported a Sec3 audit as in progress. On the protocol's own account, the exploited code was outside any completed Sec3 audit.

No other reputable post-audit incident naming the firm as auditor of exploited code was found in this pass.

Who should consider them, and who might look elsewhere

• Good fit: Solana teams building lending, perps, AMMs, vaults, governance or bridge programs. The public index shows repeated engagements in all of these categories, and many clients return for incremental reviews. Teams that want a Solana static analyzer in CI can use X-Ray alongside an audit.
• Might look elsewhere: EVM-first teams with complex Solidity systems will find a comparatively small Solidity record here. Teams that need a published, detailed formal-verification track record should ask for examples, because the public index does not separate formal-verification reports. Teams that want a report published by default should note that publication is at the client's discretion.

How to engage

Use the contact form, which asks for name, email, company or protocol, service (Audit, Formal Verification, Security Review, Post-Deployment Support, Free Tool Question, Other), project stage and a message. The same page lists contact@sec3.dev. Before you submit, have ready: repo and commit, program list and lines of code, any cross-program dependencies, upgrade-authority setup and target launch date.

Gaps and unverified claims

• Founding year, headquarters and team size are not published on the pages reviewed.
• The directory's report link is the live /audits index (the older sec3.dev/reports path returns HTTP 404); the GitHub repo holds the same list. The name "Soteria" appears only in 2022 material; the current analyzer is X-Ray.
• Most engagements listed in the README have no public PDF, so the findings and scope for those engagements cannot be reviewed.
• Mango Markets is not evidenced as a Sec3 audit client, and Raydium is named as a client without a public report.
• The directory lists Solana only, but public work also covers Solidity, Sei and Radix Scrypto.
• DefiTuna was exploited on 16 July 2026 (CertiK analysis), and Sec3's index lists a 2025 DeFi Tuna audit. No reputable source found in this pass establishes whether the exploited code was within the audited commit or scope, so it is not treated as a post-audit incident here.
• Pricing and turnaround are not published.

Sources

1. Sec3 homepage, accessed 2026-09-24
2. Sec3 Audits page, accessed 2026-09-24
3. sec3-service/reports GitHub repository, accessed 2026-09-24
4. sec3-service/reports README (raw), accessed 2026-09-24
5. sec3-service/reports tree (GitHub API, used for PDF count), accessed 2026-09-24
6. sec3-service org repository listing (GitHub API), accessed 2026-09-24
7. X-Ray repository, accessed 2026-09-24
8. Sec3 contact page, accessed 2026-09-24
9. Sec3 blog, accessed 2026-09-24
10. Sec3 2025 Solana Security Ecosystem Review, accessed 2026-09-24
11. Loopscale post-mortem, accessed 2026-09-24
12. The Block: Loopscale exploit, accessed 2026-09-24
13. CertiK: DefiTuna incident analysis, accessed 2026-09-24