Zellic

Zellic is a US-based security research firm, founded by members of the "perfect blue" competitive hacking (CTF) team. It audits EVM, Solana, Move, Cosmos and TON code, and also reviews ZK circuits, applied cryptography, TEEs and web applications. It fits teams with high-stakes infrastructure: cross-chain messaging, L1/L2 clients, ZK systems and privacy protocols. The strongest evidence-backed signal is its public report repository, which held 412 report PDFs on 2026-10-14 (404 on 2026-09-24). New releases land roughly weekly, including Zcash, Pyth, Plasma and Multiliquid reports in July–September 2026. Its research blog also publishes disclosed bugs.

At a glance

Founded	2021 per Circle's partner directory ("Zellic was founded in 2021", Circle); not stated on Zellic's own pages
Headquarters / jurisdiction	United States (per the GitHub org profile)
Engagement model	Private firm audit. From 2024 it also offered "Audits+" combined with Code4rena contests (Zellic blog); Code4rena announced a wind-down in May 2026 (The Block)
Core specialties	Smart contract audits, L1/L2 and bridge security, ZK circuits (Circom, Halo2), applied cryptography, TEEs, formal verification and fuzzing, web app security (services)
Ecosystems / languages	EVM (Solidity), Solana (Rust), Move (Aptos/Sui), Cosmos, TON, Starknet, Stellar, Bitcoin, per the publications repo
Public report index	github.com/zellic/publications (also reports.zellic.io)
Open-source tooling	EVM-trackooor, Masamune, solidity-parser, WETH Z3 verification, Move Prover examples, Forky
Published pricing	Not published

What they do

The services page lists these areas:

• EVM smart contracts
• ZK circuits (Circom and Halo2, for zkEVMs and privacy protocols)
• web application security (Go/Rust backends, React/Electron frontends)
• applied cryptography (wallets, MPC, secret sharing, account abstraction)
• secure enclaves and TEEs
• formal verification and fuzzing
• L1/L2/rollups
• operational security (multisig and key management)
• DeFi primitives
• Move (Aptos/Sui)
• Cosmos
• Solana

The homepage reports its own 2025 figures: 338 assessments, 45% of which had critical or high findings. The contact form offers long-term engagements, comprehensive assessments and contract/file reviews. A work page showcases selected engagements. The site does not publish a methodology document, turnaround or pricing.

In August 2024 Zellic acquired Code4rena (The Block coverage) and launched "Audits+", which paired a consultative audit with a competitive contest. In June 2025 Zellic announced that Code4rena would run contests for free. On 13 May 2026, The Block reported that Code4rena would wind down and that Immunefi would take over its bug bounty customers. That article includes no Zellic statement. Buyers should confirm with Zellic whether any contest component is still offered.

Specialties and ecosystem coverage

Evidence comes from report filenames in the publications repo. On 2026-09-24 we listed the repo tree and counted 404 PDF files; a re-count on 2026-10-14 found 412, after batches on 2026-10-05 and 2026-10-06 that included Cosmos work.

• Cross-chain messaging and bridges: This is the densest client series. It includes more than 20 LayerZero reports from 2022 onward, covering Endpoint V2, DVNs, OFT, Stargate, and Solana, TON and Starknet endpoints.
• ZK: Examples are Scroll zkEVM (parts 1 and 2), Scroll bridge reports (2023) and a Polyhedra zk light client. The blog adds ZK research, such as formal verification of a Plonky2 gate and the Polocolo hash function.
• Solana: Examples are LayerZero Solana Endpoint, Pyth Lazer Solana, Chainflip Solana, Anza Solana BPF and Multiliquid SVM. The sBPF JIT research post also covers Solana.
• Move: Examples are a "Move and Sui Security Assessment", GotSui and PancakeSwap Aptos.
• Other chains: Pyth reports cover CosmWasm and Stellar, LayerZero reports cover TON, and there is Hyperliquid work and a Zcash series (librustzcash, Sapling, Ironwood, Zakura).

Compared with the directory:

• The specialties (smart contracts, ZK, bridges, protocol design, Move) are confirmed.
• Chains Ethereum, Solana, Aptos and Sui are confirmed by reports. Polygon, Arbitrum and Optimism were not isolated as targets in this pass.
• Of the listed notable audits, LayerZero, Pyth and Sui/Move are evidenced. No Worldcoin or dYdX report was found in the public repo.

Recent public work

These come from the repo's commit history, with release dates as of 2026-09-24. All are in the publications repo.

1. Multiliquid EVM and Multiliquid SVM: released 16 September 2026.
2. EVM DepositWithdraw Bridge, Tydro Multiply and Tydro Payload/Economic Review: released 3 September 2026.
3. Plasma: released 19 August 2026.
4. Pyth Pro Stellar Contracts: released 19 August 2026.
5. Bulk Trade: released 17 August 2026.
6. Zcash Sapling (14 August 2026), then Zcash Ironwood Upgrade, Zakura and librustzcash (25 July 2026), and zecd (23 July 2026).
7. Lighter EVM Migration: released 9 July 2026.
8. Superstate, Relay Settlement Protocol Contracts and Relay Protocol Oracle: released late June 2026.

Research, tooling and methodology

• Disclosed vulnerabilities: "Eight Bytes to Burn a Bridge" (27 August 2026) describes a critical legacy Bitcoin sighash issue in Relay Protocol's deposit sweep. Zellic found it during a March 2026 audit, and it was fixed by migrating to SegWit (BIP-143) signing. "Fuzzing to Zero-Day" (30 March 2026) describes a V8 TurboFan type confusion (CVE-2025-2135) exploited for V8CTF.
• Data research: Enumerating all 69,788,231 Ethereum contracts (May 2025).
• Open-source tools: The GitHub org includes EVM-trackooor (EVM monitoring and alerts), Masamune (smart contract security search), solidity-parser, WETH9 formal verification with Z3 and a Move Prover guide. The site also links Forky.
• Team: The team page names co-founders Luna Tong (CEO) and Jasraj Bedi (CTO). It says both founded perfect blue, which it describes as the top-ranked CTF team in 2020, 2021 and 2023. The directory team size is 30+. The team page lists 45 people, 22 with security-researcher titles.
• Methodology / severity scheme: No standalone methodology page was found. Severity definitions appear inside the individual reports.

Track record and incidents

This pass found no reputable post-audit incident write-up that names Zellic as auditor of the exploited code and establishes that the exploited code was in scope.

Who should consider them — and who might look elsewhere

• Consider them if you are building cross-chain messaging, bridges, L1/L2 or client code, ZK circuits or zkVM components, or cryptographic protocols. Zellic's public reports and disclosed research are concentrated there, across EVM, Solana, Move, Cosmos, TON and Bitcoin. They are also an option if you need web, TEE or OpSec review next to the on-chain audit.
• Look elsewhere, or confirm availability, if you specifically want a bundled competitive-audit contest. The Code4rena pairing marketed in 2024 was affected by Code4rena's 2026 wind-down. Also ask for comparable samples if your work is a small, standard token or NFT contract, since most of the public reports are infrastructure-scale.

How to engage

Use the contact page. The form asks for your name, company, email, a Telegram or X handle, the service type, a project description, repository links and an ideal start date. The page also lists general and sales email routes and a Telegram handle. Prepare a frozen commit, a scope list with line counts, architecture docs and your target launch date.

Gaps and unverified claims

• Zellic's own pages do not state a founding year; the directory's 2021 comes from Circle's partner page (it previously listed 2022, which no source supported).
• reports.zellic.io returned HTTP 403 to automated fetching. The GitHub repo, which says its reports mirror that site, was used instead.
• The directory lists Worldcoin and dYdX as notable audits. Neither appears in the public report repo.
• Headquarters city is not published. "United States" comes from the GitHub org profile.
• Team size of 30+ is consistent with about 45 people listed on the team page (counted from the page on 2026-09-24).
• Pricing and turnaround (the directory says 4–8 weeks) are not published by the firm.
• Code4rena's status after the May 2026 wind-down announcement, and how it affects Zellic's offering, was not confirmed from a Zellic source.

Sources

1. Zellic homepage — https://www.zellic.io — accessed 2026-09-24
2. Services — https://www.zellic.io/services — accessed 2026-09-24
3. Team — https://www.zellic.io/team — accessed 2026-09-24
4. Contact — https://www.zellic.io/contact — accessed 2026-09-24
5. Our work — https://www.zellic.io/our-work — accessed 2026-09-24
6. Blog: Why we acquired Code4rena — https://www.zellic.io/blog/why-code4rena/ — accessed 2026-09-24
7. Blog: Code4rena will run audit contests for free — https://www.zellic.io/blog/code4rena-free-contests — accessed 2026-09-24
8. Blog: Eight Bytes to Burn a Bridge (Relay sighash bug) — https://www.zellic.io/blog/signing-blind — accessed 2026-09-24
9. Blog: Fuzzing to Zero-Day (V8CTF, CVE-2025-2135) — https://www.zellic.io/blog/pwning-v8ctf — accessed 2026-09-24
10. Blog: Formal verification of a Plonky2 gate — https://www.zellic.io/blog/formal-verification-plonky-gate — accessed 2026-09-24
11. Blog: Introducing Polocolo — https://www.zellic.io/blog/introducing-polocolo — accessed 2026-09-24
12. Blog: Inside the SVM, sBPF JIT pitfalls — https://www.zellic.io/blog/solana-sbpf — accessed 2026-09-24
13. Blog: Enumerating all Ethereum contracts — https://www.zellic.io/blog/all-ethereum-contracts — accessed 2026-09-24
14. GitHub org — https://github.com/zellic — accessed 2026-09-24
15. Publications repo — https://github.com/zellic/publications — accessed 2026-09-24
16. Publications commit history — https://github.com/zellic/publications/commits/master — accessed 2026-09-24
17. EVM-trackooor — https://github.com/zellic/EVM-trackooor — accessed 2026-09-24
18. WETH9 Z3 verification — https://github.com/zellic/weth — accessed 2026-09-24
19. Move Prover examples — https://github.com/zellic/move-prover-examples — accessed 2026-09-24
20. Forky — https://forky.zellic.io — accessed 2026-09-24
21. The Block: Code4rena wind-down, Immunefi to absorb customers (13 May 2026) — https://www.theblock.co/news/regulation/2026-05-13-immufefi-absorb-code4rena-bug-bounty-customers-shutdown-decision-401179 — accessed 2026-09-24
22. The Block: Zellic acquires Code4rena (2024) — https://www.theblock.co/post/312583/zellic-code4rena — accessed 2026-09-24
23. Circle partner directory: Zellic (founded 2021), accessed 2026-10-14