# Fidesium

> Automated Audits and DevSecOps


## Posts

- [Proof of reserves: what it does and doesn't prove](https://fidesium.com/blog/proof-of-reserves/): Proof of reserves is a check that a custodian, usually a crypto exchange, controlled enough of an asset at a given moment to cover what it owed customers in that asset.
- [Timelocks and the governance attacks they prevent](https://fidesium.com/blog/timelock/): A timelock is a smart contract that forces a fixed delay between a decision and its execution.
- [Fuzzing: what it finds in smart contracts, and what it cannot prove](https://fidesium.com/blog/fuzzing/): Fuzzing is automated testing that feeds a program large numbers of generated inputs and watches for a failure.
- [Solana smart contract audit: pricing, scope, and tools](https://fidesium.com/blog/solana-smart-contract-audit/): A Solana smart contract audit is a manual review of your Rust program, and most of the hours go to three places: how each instruction validates the accounts it is handed, what happens across cross-program invocations, and who holds the upgrade key.
- [Arbitrum smart contract audit: what changes on an L2](https://fidesium.com/blog/arbitrum-smart-contract-audit/): A captain who has crossed an ocean still takes a harbour pilot aboard at the mouth of a strange port. The ship is the same ship.
- [Can a perps DEX rug pull your funds?](https://fidesium.com/blog/can-a-perps-dex-rug-pull-your-funds/): Yes, if someone holds a key that can move your collateral, replace the code, set the price or close the exit, and nothing stops them using it before you can leave.
- [Formal verification: proving a failure cannot exist](https://fidesium.com/blog/formal-verification/): Formal verification is a way of proving, mathematically, that a piece of code keeps a rule you wrote down, for every input and every sequence of calls it could ever receive.
- [Protocol integration security checklist: what to check before you plug into another protocol](https://fidesium.com/blog/protocol-integration-security-checklist/): On 17 July 1981 two suspended walkways in the atrium of the Hyatt Regency hotel in Kansas City collapsed, killing 111 people. Two of the injured later died.
- [How a smart contract audit works, step by step](https://fidesium.com/blog/smart-contract-audit-process/): Before a book that names real people goes to print, the publisher sends it for a legal read.
- [The smart contract audit firms worth shortlisting in 2026](https://fidesium.com/blog/smart-contract-audit-companies/): There is no best smart contract audit firm, and a ranked list of ten is an answer to a question nobody asked.
- [SOC 2 for Web3: what it actually requires when your stack is multisigs and onchain custody](https://fidesium.com/blog/soc-2-for-web3/): A commercial kitchen inspection does not hand you a list of approved fridges.
- [Bug bounty vs security audit: when protocols need each (and when they need both)](https://fidesium.com/blog/bug-bounty-vs-audit/): In July 1714 the British Parliament passed "An Act for Providing a Publick Reward for such Person or Persons as shall Discover the Longitude at Sea".
- [Solidity static analysis tools: what they catch, and what they miss](https://fidesium.com/blog/solidity-static-analysis-tools/): A spell checker will catch recieve every time. It will never tell you that the paragraph argues the opposite of what you meant. Both are errors.
- [Continuous monitoring vs one-time audits: what each one catches](https://fidesium.com/blog/continuous-monitoring-vs-smart-contract-audits/): A smart contract audit and continuous smart contract monitoring are not competing purchases. They answer different questions.
- [Rug pull red flags: what to check before you buy](https://fidesium.com/blog/rug-pull-red-flags/): Six things decide whether a token can be taken from you, they are all readable on-chain in about ten minutes, and every one of them is the same question wearing a different hat.
- [How continuous monitoring catches what a point-in-time audit misses: a worked example](https://fidesium.com/blog/post-deployment-monitoring-worked-example/): Every so often somebody publishes a way to open a lock that has been on doors for years. Nothing about the lock changes.
- [Sherlock vs Hacken vs Cyfrin: how the top smart contract audit firms actually differ](https://fidesium.com/blog/sherlock-vs-hacken-vs-cyfrin/): Three engineers can inspect the same bridge and hand you three different documents. One walks it with the drawings and argues with your maintenance plan.
- [Rug pull vs exploit vs hack: what actually happened, and how to tell from the transaction](https://fidesium.com/blog/rug-pull-vs-exploit-vs-hack/): Three words get used for the same event and they describe three different events.
- [Honeypot contracts: how they work and how to spot one](https://fidesium.com/blog/honeypot/): A honeypot in crypto is a token you can buy and cannot sell.
- [Bridges: the most exploited component in Web3](https://fidesium.com/blog/chain-bridges/): A chain bridge is a protocol that moves value or messages between two blockchains that have no way to verify each other.
- [Mempool, MEV and front-running explained](https://fidesium.com/blog/mempool/): A mempool is the waiting area a blockchain node keeps for transactions it has checked and accepted but not yet put in a block.
- [August 2026 - Tech Update](https://fidesium.com/blog/august-2026-tech-update/): This month the API that's been running internally for months went into testing with a real public surface: keys, scopes, signed webhooks, metered billing.
- [Lessons from reddit.com/r/defi (and r/blockchain) ](https://fidesium.com/blog/lessons-from-reddit-com-r-defi-and-r-blockchain/): In May and November of 2025, two of the year's most expensive DeFi exploits had an uncomfortable amount in common.
- [Anatomy of a Targeted Meeting Lure](https://fidesium.com/blog/anatomy-of-a-targeted-meeting-lure/): TL;DR A contact I recognised reached out to “catch up”, steered me toward a video call, then pushed a link that looked like a Microsoft Teams invite. It wasn’t.
- [Q2 2026 at Fidesium](https://fidesium.com/blog/q2-2026-at-fidesium/): Most product updates are changelogs. We try not to write those. The only question that matters is whether your protocol is safer today than it was 90 days ago.
- [Fidesium × Sumvin: Auditing a Soulbound Identity Protocol on Sei](https://fidesium.com/blog/fidesium-x-sumvin-auditing-a-soulbound-identity-protocol-on-sei/): Fidesium's latest customer, Sumvin, is a soulbound ERC-721 identity protocol.
- [Fidesium × Adrena: a Case Study](https://fidesium.com/blog/fidesium-x-adrena-a-case-study/): TL;DR: Fidesium audited Adrena - a Solana-native perpetual futures DEX run by the Autonom Foundation - across two engagements covering ~36,000 lines of Rust, 122 instructions, and a live version migration.
- [Attack Your Own Protocol Before Someone Else Does](https://fidesium.com/blog/attack-your-own-protocol-before-someone-else-does/): April 2026 was the worst month on record for crypto. Almost none of it was clever.
- [The Blockchain Security Crisis (in 2026)](https://fidesium.com/blog/the-blockchain-security-crisis-in-2026/): "In the rapidly evolving world of decentralised finance (DeFi) and web3, where billions of dollars pour through smart contracts and decentralised apps (dApps) daily, security should be the bedrock priority.
- [What We Built in Q1 2026 - And Why It Matters for Smart Contract Security](https://fidesium.com/blog/q1-2026-platform-update/): and a 90%+ improvement in reentrancy detection.
- [When Does a Smart Contract Audit Actually Expire?](https://fidesium.com/blog/when-does-a-smart-contract-audit-actually-expire/): An audit does not fail overnight.
- [Fidesium January 2026 Product Update: Preserving Audit Value as Code Ships Faster](https://fidesium.com/blog/blog-fidesium-january-2026-product-update/): Why do smart contract audits lose relevance so quickly?
- [Why Smart Contract Security Tools Struggle With Noise](https://fidesium.com/blog/reducing-false-positives-access-control/): False positives are one of the biggest blockers to effective smart contract security.
- [Fidesium December 2025 Product Update: Smarter Detection, Continuous Protection, Real-World Coverage](https://fidesium.com/blog/fidesium-product-update-smarter-detection-continuous-protection-real-world-coverage/): Web3 is moving fast, and so are the threats.
- [Audits Age. Attackers Don’t. Why Continuous Security Is Now Mandatory in Web3](https://fidesium.com/blog/audits-age-attackers-dont-why-continuous-security-is-now-mandatory-in-web3/): For years, Web3 teams have treated security audits like a milestone: something you complete once, check off, and move past.
- [SafeDrop Linea Airdrop Audit Validation: Evidence, Integrity, and Why It Matters for Web3 Security](https://fidesium.com/blog/safedrop-linea-airdrop-audit-validation/): Fidesium verified SafeDrop’s Linea airdrop case study, confirming coordinated wallet activity and the technical soundness of its codebase.
- [Chadi Sebbar’s Journey into Smart Contract Security](https://fidesium.com/blog/chadi-sebbar-journey-web3-security/): Web3 security isn’t just about code, it’s about the people who dedicate their careers to protecting the ecosystem, and with it a vision for a better future.
- [Formal Analysis in Web3: What Founders Need to Know (Without the Math)](https://fidesium.com/blog/formal-analysis-in-web3-what-founders-need-to-know-without-the-math/): If you’re a Web3 founder, you’ve probably heard terms like testing, fuzzing, audits — and now formal analysis.
- [NPM Supply Chain Attack: Wallet Address Swap Trick](https://fidesium.com/blog/npm-supply-chain-attack-wallet-swap/): How attackers used a string-similarity algorithm to trick users with look-alike wallet addresses.
- [Fidesium PB&J Case Study](https://fidesium.com/blog/fidesium-pbj-case-study/): In the world of blockchain and Web3 development, security is not merely a checkpoint but a continuous process.
- [Fidesium PB&J Case Study Part 2](https://fidesium.com/blog/fidesium-pbj-case-study-part-2/): In Web3, one missed vulnerability can erase months of work and millions in value - but one minute can save it all.
- [Why Security Needs to Be a Process, Not an Event](https://fidesium.com/blog/why-security-needs-to-be-a-process-not-an-event/): The B-52 Stratofortress, a legendary long-range strategic bomber, had a rocky early history with several crashes and incidents.
- [Sophisticated Phishing](https://fidesium.com/blog/sophisticated-phishing/): This write up will look at a flavour of social engineering scam that’s been emerging in the current VC winter.
- [The Wild West of Crypto: When a Rug Pull is Not a Rug Pull](https://fidesium.com/blog/the-wild-west-of-crypto-when-a-rug-pull-is-not-a-rug-pull/): The cryptocurrency space is often compared to the Wild West - largely unregulated, where degens and normies alike transact in an ecosystem full of risk and opportunity.
- [Proof of Humanities Implication for Security](https://fidesium.com/blog/proof-of-humanity-and-fidesium/): The rise of Zero Knowledge Proof and Proof of Humanity protocols like Rarimo presents an interesting crux point for our decentralized ecosystem.
- [Blockchain's Need for Speed](https://fidesium.com/blog/the-blockchain-security-crisis/): The blockchain ecosystem is at an inflection point.
- [Flare Networks: A Simplified Guide to the Time Series Oracle and State Connector](https://fidesium.com/blog/the-blockchain-security-crisis-2/): Flare is an upcoming blockchain that aims to bring new utility and functionality to cryptocurrencies like XRP, Litecoin, and Dogecoin.
- [The Blockchain Security Crisis](https://fidesium.com/blog/the-blockchain-security-crisis-3/): In the rapidly evolving world of decentralized finance (DeFi) and web3, where billions of dollars pour through smart contracts and decentralized apps (dApps) daily, security should be the bedrock priority.
- [Is PayPal acting in good faith?](https://fidesium.com/blog/is-paypal-acting-in-good-faith/): Last week, PayPal (or rather, Pax’s on behalf of PayPal), released the PAX stablecoin.

## Pages

- [Fore Protocol risk audit, March 2025: 34 findings, all nine High resolved](https://fidesium.com/audits/fore-protocol/): Fidesium ran a risk audit of Fore Protocol's Solidity contracts, and the report is dated 7 March 2025.
- [Yimmit Penetration Test, August 2026: Whitebox security assessment](https://fidesium.com/audits/yimmit/): Yimmit engaged Fidesium to run a whitebox security assessment of Yimmit Exchange.
- [SafeDrop risk audit, October 2025: 12 findings across two repositories](https://fidesium.com/audits/safedrop/): Fidesium was asked to perform a risk audit on SafeDrop's codebase, covering both its back end and its front end.
- [Adrena security assessment, April 2026: 42 findings on a Solana perpetuals DEX](https://fidesium.com/audits/adrena/): Autonom engaged Fidesium to assess the Adrena program, a perpetual futures protocol on Solana.
- [Blockchain Penetration Testing](https://fidesium.com/blockchain-penetration-testing/): An audit reads the code. A penetration test attacks the system the code runs in.
- [Solidity Developer Tools](https://fidesium.com/solidity-developer-tools/): Automated scanning powered by advanced AST analytics and static analysis, trained on millions of lines of code. Instant results on every commit.
- [Smart Contract Tooling](https://fidesium.com/smart-contract-tooling/): Automated scanning powered by advanced AST analytics and static analysis, trained on millions of lines of code.
- [Security Services](https://fidesium.com/security-services/): Custom on-chain monitoring, managed bug bounties, compliance gap analysis and architecture review, run by the Fidesium core team for the months around your audit.
- [Manual Smart Contract Audits](https://fidesium.com/manual-smart-contract-audits/): The combination of advanced tooling and experienced security researches allows us to deliver outsized results.
- [Changelog](https://fidesium.com/changelog/): #Added- SARIF File Generation, Pro users can now generate and download SARIF files, enabling seamless integration with other SAST providers and security tools.
- [SOC2 Field Guide](https://fidesium.com/soc2-field-guide/): Enterprise customers expect SOC 2. Your stack runs on smart contracts, custodial keys, and onchain infrastructure. We help you bridge the gap.
- [Audits](https://fidesium.com/audits/): This is Fidesium's public audit portfolio: 23 signed reports covering 16 protocols, most of them on EVM chains and Solana, published between 2024 and April 2026.
- [Blog](https://fidesium.com/blog/)
- [Terms & Conditions](https://fidesium.com/terms-conditions/): Please read this Agreement (the "Agreement") carefully before using the Fidesium web application (the "software") offered by Fidesium LTD. ("Fidesium").
- [Pricing](https://fidesium.com/pricing/): Fidesium publishes its prices.
- [Contact](https://fidesium.com/contact/): Please feel free to contact us with whatever channel is most convenient or schedule a call bellow.
- [About](https://fidesium.com/about/): Fidesium is a UK smart contract security firm that audits Web3 protocols and then re-runs audit-grade analysis on every commit, pull request and deployment, for DeFi, RWA, gaming and infrastructure teams building on EVM chains and Solana.
- [Home](https://fidesium.com/): Including teams operating audited contracts in production.
- [Privacy Policy](https://fidesium.com/privacy-policy/): Please read this policy carefully before using our website or the Fidesium Platform.

## Optional

- [Agent (MCP protocol)](websites-agents.hostinger.com/fidesium.com/mcp)

[comment]: # (Generated by Hostinger Tools Plugin)