Smart contract logic
Authorization, invariants, asset accounting, upgrades, external calls, and protocol-specific execution paths.
SERVICES
Reviews across contracts, runtime flows, and integrations.
Forge reviews how contracts, frontend flows, wallet interactions, transaction paths, infrastructure boundaries, and protocol assumptions behave together — as one connected system.
Coverage snapshot
The service model stays intentionally focused: understand the connected system, validate meaningful weaknesses, and report only what the evidence supports.
dApp and frontend transaction flows
Calldata construction, UI-only assumptions, API boundaries, replay resistance, and transaction-path integrity.
Wallet and signing interactions
Connection flows, signature requests, user intent, approval safety, RPC assumptions, and signing-context clarity.
Architecture, boundaries, and economic assumptions
Trust boundaries, operational dependencies, governance controls, incentives, and assumptions that affect systemic risk.
Core review areas
Each engagement is scoped around the surfaces that matter for your target, with findings tied to concrete behavior, impact, and practical remediation.
Smart Contract and Protocol Logic Review
How your contracts actually behave: access control, state transitions, asset accounting, upgrade paths, and the protocol-specific assumptions that can lose funds, break permissions, or corrupt system integrity — reviewed against your intended design, not just in isolation.
dApp and Wallet Interaction Security
The paths where users actually sign: frontend transaction construction, wallet prompts and signing flows, RPC and API trust boundaries, and the off-chain assumptions that meet on-chain execution. We trace what a user is really approving, not just what the UI says.
Architecture and Assumption Review
How failures propagate: protocol architecture, infrastructure boundaries, governance controls, incentives, and economic assumptions that decide whether a single bug stays contained or cascades across contracts, integrations, and operations.
Remediation and Disclosure Support
Findings you can act on: clear fix guidance tied to validated root causes, with reporting that supports engineering remediation, retesting, and whatever responsible-disclosure requirements your engagement or bounty program requires.
Fit
Built for teams that need review across boundaries.
Scoped reviews, architecture validation, dApp and wallet transaction-flow assessment, and remediation planning where evidence and responsible handling matter.
Pre-launch review
Support for teams preparing contract, frontend, and operational paths before exposing users or significant value.
Live-system assessment
Focused review of specific concerns, integrations, flows, or suspected weakness areas in production systems, within authorized scope.
Remediation alignment
Issue framing that helps engineering teams understand impact, reproduce behavior where applicable, and validate fixes.
What you get back
Every engagement ends with a scoped report, not a raw scanner dump.
- Validated findings, each with reproduction steps — not unfiltered scanner output.
- An evidence packet per finding — the transactions, traces, or test artifacts that prove the issue.
- Severity rationale tied to real impact — funds at risk, blast radius, trigger conditions.
- Practical remediation guidance written for engineers, plus retest support after fixes.
- A scoped report delivered through your agreed channel, with responsible-disclosure handling where relevant.