Security research
Audit reports
Independent audits of live, mainnet deployments — led by what we can prove on a fork of the deployed bytecode, not what the docs promise. Each report carries severity-rated findings, a doc-vs-code drift inventory, an audit-coverage cross-check against prior audits, and practical guidance for users. Findings are disclosed to the project first; the disclosure timeline is part of every report.
Meson
Caution5/10 overallSpotBlock effort 4/10Cross-chain stablecoin swap (modified HTLC, signature-based unlock)
The swap path most Meson users take has no safety net — once your tokens leave your wallet you cannot cancel, and this code was never audited or documented.
Ostium
SpotBlock effort 7/10Perpetual trading platform
Traders could be liquidated before their own stop loss triggers, because two parts of the platform disagreed on the limit. Proven with a simulation on the live chain.
PillarDAO
SpotBlock effort 4/10Staking vault
Two reentrancy flaws in the vault, the kind of bug that lets an attacker drain funds. Confirmed with a working attack in a controlled test.
Upside
SpotBlock effort 4/10Social prediction market
Four findings in a single review, two of them high severity. One lets an attacker skip fees entirely with a fake token.
Audits for your project
Want your protocol audited the way an attacker would?
Fork-tested findings with working PoCs, a docs-vs-code drift inventory, and disclosure handled with the team first — the same standard as the reports above.
Independent security research by SpotBlock Labs, Zurich. Not financial advice. Reports reflect the deployed contracts at the stated verification dates; code and parameters may have changed since.