SigIntZero

SigIntZero is a small Australian Web3 security firm, operating as SigIntZero Pty Limited in NSW. It offers manual smart-contract and Rust audits, an AI-assisted scanning product (Sentinel) and a monitoring service (Tripwire, open source when self-hosted). Unlike most firms in this directory, it publishes its prices, which may suit smaller teams that want fixed-price quotes. The strongest public evidence is a frequent 2026 blog of incident analyses and published pricing. No named public clients or public audit reports were found, so buyers cannot yet check its audit work against published reports.

At a glance

Founded	Not published by the firm. The directory uses 2026: the registered company SIGINTZERO PTY LIMITED has an ABN active from 20 Feb 2026, and nothing public predates February 2026
Headquarters / jurisdiction	Australia: NSW 2016 per the Australian Business Register; Sydney dateline on the firm's Feb 2026 press release
Engagement model	Private firm audit with a fully remote team (jobs), plus self-serve AI scans and a monitoring subscription
Core specialties	Solidity and Rust audits, DeFi, bridges, L1 reviews, penetration testing, incident response, monitoring (services)
Ecosystems / languages	Claimed: EVM (Ethereum, Arbitrum, Base, Polygon, Optimism, Avalanche) and Rust (Solana, NEAR, CosmWasm, Substrate) (services). Not evidenced by public reports
Public report index	None found
Open-source tooling	None security-specific found; the sigint-zero GitHub org hosts Solana trading-infrastructure repos and forks
Published pricing	Yes: Sentinel scans from $100; manual audits from $5,000; Tripwire free when self-hosted (open source), hosted deployments quoted individually (Sentinel, services, Tripwire)

What they do

The services page lists:

• Solidity audits
• Rust audits (Solana Anchor/native, NEAR, CosmWasm, Substrate)
• DeFi security audits
• Bridge audits
• Formal verification
• L1 chain audits
• dApp (full-stack) audits
• Penetration testing
• Incident response and fund tracing

Engagement process. The published process is a free scoping call, audit execution on a timeline confirmed in advance, a remediation re-audit at no extra cost, and delivery of a severity-rated report. Pricing is a fixed quote after scoping. Timelines range from "a few days to a few weeks", with longer lead times for L1s, bridges and ZK systems (services).

Sentinel is described as an AI-powered analysis engine with per-scan pricing by codebase size: $100 up to 499 LOC, $250, $1,000 and $2,500 tiers, and custom pricing above 50,000 LOC. The firm says full audits add senior human-led review, custom invariant testing and economic modelling on top (Sentinel). The page does not say whether Sentinel is open source.

Tripwire is a monitoring product. As of 2026-10-14 the product page says the self-hosted version is free and open source, and hosted deployments are "quoted per deployment"; the earlier "$2,500/month" figure is no longer shown. It alerts through Slack, Telegram, email and PagerDuty, and supports pre-approved automated responses such as pauses (Tripwire). No customers are named.

Specialties and ecosystem coverage

All ecosystem claims come from the firm's own marketing pages. None of the listed chains could be confirmed through published audit reports, because no reports were found. The org's public code is Solana-focused Rust: a self-hosted swap API and router (flow-trades-solana README). This shows Rust and Solana engineering ability, but it is not audit evidence.

The directory's "ai-auditing" specialty matches the Sentinel product. The "l1-l2" and "infrastructure" specialties match service-page claims but are not evidenced by public engagements.

Recent public work

No public audit reports or named audit engagements were found. The firm's publications repository contains only an empty README. The blog is the main public output. On 2026-09-24 it listed 50+ posts dated February to September 2026, mostly analyses of third-party incidents. Recent examples:

• Neutron governance takeover (24 Sep 2026)
• rsETH Safe drain (17 Sep 2026)
• Notional Finance exploit (10 Sep 2026)
• A DefiTuna lending-exploit analysis (20 Jul 2026, post)

None of these describe SigIntZero's own client work.

Research, tooling and methodology

• Report format: Findings are severity-rated with remediation guidance, and a fix re-audit is included (services).
• Positioning: The firm says it puts architecture review and threat modelling before code review, covering economic design, governance and operational risk (audit-effectiveness post). That post includes the firm's own comparison of itself with other audit firms.
• Data report: A February 2026 release analysed the 100 largest breaches from 2014 to 2024, using Halborn's Top 100 DeFi Hacks data. It reported that audited applications accounted for 10.8% of losses (press release).
• Team: The homepage names three co-founders (Alex Rybalko, CEO; Aron Turner, CTO; Dmitry Serdyuk, CDO) and a head of business development (Kolin Cunningham). The jobs page lists five remote roles, including Solidity and Rust auditors, and memberships of the Digital Economy Council of Australia and Superteam Australia.
• Tooling: No disclosed CVEs, and no open-source security tools found.

Track record and incidents

No reputable post-audit incident naming the firm was found in this pass. With no public client list, this cannot be read as evidence either way.

Who should consider them, and who might look elsewhere

• Might fit: Early-stage or budget-constrained teams that value transparent, published pricing and a fixed quote. Teams wanting a low-cost automated pre-scan before a manual review. Australian teams wanting a local provider.
• Might look elsewhere: Teams whose investors, exchanges or partners expect an auditor with a public record of published reports, or who need several past engagements on their chain or protocol type to check. That evidence is not currently public for this firm.
• Before hiring: Ask for sample redacted reports, named references, the CVs of the auditors who would be assigned, and a written description of how Sentinel output is validated by humans.

How to engage

Use the contact form (name, organisation, email, description, phone or Telegram, and services required) or email contact@sigintzero.com, both published on that page. The firm offers a free scoping call (services). Before the call, have ready: repo and commit, LOC count (which drives Sentinel pricing), chains, deployment plan and any prior audits.

Gaps and unverified claims

• No named public clients or public audit reports were found. The directory's "notable audits" entry is generic ("Various DeFi and L1 protocols") and could not be substantiated.
• The directory's founding year (2026) follows the company's ABN, active from 20 February 2026 (ABR); the earliest post shown on the blog index is dated 25 February 2026. The directory previously listed 2022, for which no source was found.
• The directory's team size is "4 named". The site names four people and lists five open roles.
• Formal verification, L1 audit and penetration-testing capabilities are claimed but not evidenced by public work.

Sources

1. SigIntZero homepage, accessed 2026-09-24
2. SigIntZero services, accessed 2026-09-24
3. Sentinel product page, accessed 2026-09-24
4. Tripwire product page, accessed 2026-09-24
5. SigIntZero contact page, accessed 2026-09-24
6. SigIntZero jobs page, accessed 2026-09-24
7. SigIntZero blog index, accessed 2026-09-24
8. Blog: audit effectiveness analysis, accessed 2026-09-24
9. Blog: DefiTuna lending exploit, accessed 2026-09-24
10. PRWeb: 2026 Software Security Report release, accessed 2026-09-24
11. Australian Business Register: ABN 78 694 634 716, accessed 2026-09-24
12. sigint-zero GitHub org, accessed 2026-09-24
13. sigint-zero/publications repository, accessed 2026-09-24
14. flow-trades-solana README, accessed 2026-09-24
15. github.com/nicenomad (HTTP 404), accessed 2026-09-24
16. github.com/sigintzero (no public repos), accessed 2026-09-24