Sigma Prime

Sigma Prime is a Sydney-based blockchain security and engineering firm founded in 2016. It builds and maintains Lighthouse, a Rust Ethereum consensus client, and it runs fixed-scope audits, rolling commit reviews and embedded security-engineer engagements. It fits teams working on Ethereum core infrastructure, staking and restaking, clients, bridges, and Solidity protocols that sit close to consensus. The strongest evidence-backed signal is its public audit repository, which lists 154 released reviews from October 2017 to September 2026 (re-counted on 2026-10-14), including work for the Ethereum Foundation, EigenLayer, Lido, Rocket Pool and Reth.

At a glance

Founded	2016 (homepage); founders Mehdi Zerouali, Adrian Manning and Paul Hauner (About)
Headquarters / jurisdiction	Sydney, Australia (About, GitHub org)
Engagement model	Private firm audit (fixed scope, fixed fee), rolling commit reviews, integrated security engineers, training (methodology, contact)
Core specialties	Ethereum consensus and execution clients, staking/restaking, Solidity smart contracts, bridges, cryptographic libraries, infrastructure
Ecosystems / languages	EVM (Solidity), Rust and Go client/node code, ZK circuits, Filecoin (Go/Rust), Bitcoin L2 (public-audits README)
Public report index	github.com/sigp/public-audits
Open-source tooling	Lighthouse (Apache-2.0), Anchor (SSV in Rust), Siren, solidity-security-blog (GitHub org)
Published pricing	Not published; the firm states it uses fixed fees set at scoping (methodology)

What they do

The homepage lists these services:

• Security audits across infrastructure, protocols, smart contracts and applications
• Rolling commit reviews
• Integrated security-engineer placements
• Security training
• Blockchain infrastructure operations

The contact form also offers infrastructure review, operational security, and a waitlist for "Secstant", described as an AI security tool.

The methodology page sets out a six-stage fixed-scope process:

1. Scoping (1–3 days, ending in a written fixed-fee proposal)
2. Kickoff (1–2 days; the target commit is locked)
3. Manual review, which takes 60–80% of the engagement
4. Automated analysis run alongside the manual review, including AI-assisted workflows
5. Reporting, with internal QA
6. Remediation review (1–2 weeks after fixes)

Findings are shared continuously during the engagement, and proofs of concept are provided for material issues where feasible. Reports are private by default and are published only with client consent.

A July 2026 post, Collapsing the Security Review Cycle, explains the rolling-commit and embedded-engineer models. Both are aimed at teams shipping continuously rather than freezing code for one audit.

The homepage claims 400+ projects audited, 6,500+ findings (700+ high-risk) and $57B+ TVL protected (homepage). These figures are self-reported.

Specialties and ecosystem coverage

Evidence from the public-audits README:

• Ethereum core and staking: Strongly evidenced. Reports cover Ethereum Foundation Pectra system contracts (Jan 2025), C-KZG and Go-KZG (May 2023) and the KZG ceremony (Dec 2022). They also cover the Reth execution client (Jun 2024), CommitBoost (Dec 2024 and Jan 2026), a Lido on-chain BLS library (Jan 2026), multiple Rocket Pool reviews (2021–2024), Origin Protocol validator consolidations (Mar 2026), and Lighthouse itself as an in-house product.
• Restaking: EigenLayer and EigenDA appear repeatedly (2023–2026), including the Slashing Release (Feb 2025), Rewards v2 (Jan 2025) and EigenDA Secure Integration (Oct 2025).
• L2s and bridges: Optimism Bedrock (Oct 2022), Polygon LX/LY bridge (Feb 2024), the Aurora Rainbow bridge (Jun 2023), Omni Network bridge contracts (2025) and Chainway Labs' Citrea Bitcoin L2 and Clementine bridge (Jul 2025).
• Clients and nodes beyond Ethereum: Berachain's bera-reth and bera-geth (Sep 2025), RISE core node (Nov 2025), and Filecoin Lotus and proving subsystem (Jul 2020).
• ZK: RISC Zero "The Signal" Ethereum circuits (Jul 2025). The blog also has a March 2026 post on ZK vulnerabilities.
• Directory chains: Ethereum, Polygon and Optimism are confirmed. Arbitrum is named as a client on the homepage, but no Arbitrum report appears in the public index. The directory's "notable audits" (Lido, Ethereum Foundation, Synthetix 2020, Chainlink 2019 and 2025, Rocket Pool) are all confirmed in the README.

Recent public work

From the public-audits README (most recent first):

1. Dohrnii, DHN token review (September 2026)
2. Term Finance, latest updates (August 2026)
3. Brava Labs, core auth changes (July 2026)
4. Term Finance v2 smart contracts (May 2026)
5. Catalysis, core and coverage contracts (May 2026)
6. Serenita Vero (April 2026)
7. Origin Protocol, validator consolidations (March 2026)
8. EigenLayer, Sidecar Rewards v2.2, round 2 (February 2026)
9. Lido, on-chain BLS library (January 2026)
10. CommitBoost, multiplexer and signer (January 2026)

Count note: the README table had 154 review rows on 2026-10-14, dated 2017–2026: 2 in 2017, 8 in 2018 (Skrilla, Horizon State, Havven, Fantom, Status, Chainlink and AdEx among them), 3 in 2019, 9 in 2020, 10 in 2021, 30 in 2022, 18 in 2023, 26 in 2024, 28 in 2025 and 14 in 2026. The 2026-09-24 count of 138 missed the 2017–2018 rows; no rows were added between the two counts. Each row lists the target commit, which helps buyers check what exact code was reviewed.

Research, tooling and methodology

• Lighthouse: An open-source Ethereum consensus client in Rust, maintained by Sigma Prime; Apache-2.0, about 3.5k GitHub stars (repo). Regular client updates appear on the blog, for example Lighthouse Update #43 in August 2026.
• Other open source: Anchor (a Rust SSV implementation), Siren (a Lighthouse UI), and solidity-security-blog, a widely starred list of Solidity attack vectors (GitHub org).
• Severity scheme: Critical, High, Medium, Low and Informational, based on realistic impact rather than a fixed matrix (methodology).
• Recent research posts: A Go-for-auditors series (June–July 2026), defensive protocol design, AI as a force multiplier for security engineers, and signature handling from wallet to consensus (blog).
• Team: The About page shows 40+ team members.

Track record and incidents

No reputable post-audit incident naming the firm as auditor of exploited code was found in this pass.

Who should consider them, and who might look elsewhere

• Good fit: Teams building Ethereum clients, validator and staking infrastructure, restaking, consensus-adjacent contracts, bridges, or Rust/Go node software. The public record here is deep and specific, and the firm runs production consensus software itself. Teams shipping continuously may also want the rolling-commit or embedded-engineer models.
• Might look elsewhere: Teams on Solana, Move or Cosmos-SDK chains will find little public evidence in this index. Teams that want a competitive-contest format or published price points are also better served elsewhere, because pricing is fixed-fee but not published.
• Note: Reports are private by default, so the public index reflects only engagements that clients agreed to release.

How to engage

Use the contact form. It asks for project name, contact details (email or Telegram), service category (security audit, rolling commit reviews, infrastructure review, operational security, integrated security engineer, training) and additional information. The page also lists contact@sigmaprime.io and asks that time-sensitive requests carry "Urgent" in the subject line. Before you submit, have ready: the target repo and commit, an architecture overview and threat model, prior audits and your release timeline. Scoping ends in a written fixed-fee proposal (methodology).

Gaps and unverified claims

• Pricing amounts are not published.
• The directory's turnaround ("6–12 weeks") is not published by the firm. The methodology gives stage durations but not a total.
• Arbitrum appears in the directory's chain list and on the homepage client wall, but no Arbitrum report is in the public index.
• The self-reported metrics (400+ projects, 6,500+ findings, $57B+ TVL) were not independently verified.
• Because reports are private by default, the public index understates total engagement volume.

Sources

1. Sigma Prime homepage, accessed 2026-09-24
2. Sigma Prime About, accessed 2026-09-24
3. Sigma Prime contact page, accessed 2026-09-24
4. Sigma Prime audit methodology, accessed 2026-09-24
5. Sigma Prime blog, accessed 2026-09-24
6. Blog: Collapsing the Security Review Cycle, accessed 2026-09-24
7. sigp/public-audits repository, accessed 2026-09-24
8. sigp/public-audits README (raw, used for row count), accessed 2026-09-24
9. Sigma Prime GitHub org, accessed 2026-09-24
10. Lighthouse repository, accessed 2026-09-24