Engineering audits

We audit software before it goes out, whether that’s a launch, a listing or a raise.

We look at protocols and smart contracts, CI/CD and agent pipelines, system architecture, and what it all costs to run.

We build these systems ourselves, so we know where they tend to fail. We run your code and try to break it.

What we look at

We tell you what we think matters most for your project. A quick pass suits an early stage, and a deep dive suits a launch or a raise.

Protocols

Node and consensus code
Smart contracts and runtime modules
Bridges and cross-chain messaging
Supply, fees and emissions, checked against your docs
Keys, admin powers and governance

Pipelines and agents

CI/CD permissions and secrets
Release signing and reproducible builds
Dependencies and supply chain
What your agents can reach, and who approves what they do
Automated review and merge rules

Architecture

Module boundaries and who owns what
Where the real data lives, and what can be rebuilt from it
Failure and recovery paths
Security boundaries in the code, not just on the diagram

Performance and process

Build and test times, CI cost, caching
Benchmarks that measure what you think they measure
Hot paths, memory and infrastructure spend
How work gets tracked, reviewed and released

What we’ve found

From our own systems. What we find for clients stays with them.

A damaged manifest makes recovery delete every segmentEmbedded vector database we run in production

Found: The manifest is written in place, with no checksum and an unchecked close, and recovery deletes every segment it doesn’t list. We cut it short at every possible length and filled the disk during a flush. Some cuts made the next open delete every segment.
Fix: Check the manifest before every open, and refuse to open or clean up anything when it doesn’t verify.
Result: A crash or a full disk now stops the open instead of deleting data. The bug is reported upstream with failing tests.

Every reviewer re-read the whole change at full priceAgent review pipeline

Found: Six review agents per round each got the full change in their own prompt. They shared only the first 36,000 of about 270,000 characters, so the prompt cache barely helped.
Fix: One base session holds the change, and each reviewer runs as a fork of it that reuses its cache.
Result: On the same five changes with the same models, 10.1 million tokens became 1.55 million: 85% fewer, with about the same issues found.

Later review rounds paid more to check lessAgent review pipeline

Found: Each round re-reviewed the whole change and carried every earlier report. Over five rounds the prompt per reviewer grew from 287,000 to 661,000 characters, while the fix under review shrank from 874 lines to 26.
Fix: Later rounds review only what changed since the last reviewed version, with each reviewer’s own last report.
Result: A check round costs $1.22–2.40 in our tests. The old rounds cost an estimated $19–26 each.

An audit took longer than the tests it auditedOur test tooling

Found: The check that every cited test exists re-ran each one in its own process: 43.5 s for 88 tests, and 65.7 s for a suite that runs in 22.6 s.
Fix: Read the report the normal test run already writes, and fall back to one batch per runner.
Result: The check takes 0.48 s. Running test classes in parallel with shared fixtures also cut the largest suite from 327.9 s to 55.9 s.

1 / 1

How it works

DiscoveryA first call: what you’re shipping, when, and who the report is for.
ScopeAn agreed list of repos, deployments and documents, pinned to a commit.
ReviewWe read, run and measure. What we can’t answer from the code, we ask you.
ReportFindings with evidence and fixes, then a retest after you’ve fixed them.

If something changes after the report goes out, you get a dated update, not a quietly edited PDF. We write down what we didn’t check. We don’t issue certificates or give legal advice. If you’d rather we build the fix, we can do that too.

What we’ve built

Protocol primitives

Some of the mechanisms we’ve designed: order batching for DeFi trades, rate limits that hold back cross-chain deposits over a per-asset limit, and a hybrid oracle that combines on-chain and outside price sources. When those sources disagree or go stale, it pauses or holds back only the affected actions instead of trading on a bad price.

A production chain

We ran engineering, security and infrastructure for a DeFi chain in production, on tens to hundreds of dedicated machines. That included runtime fuzzing against mainnet state, upgrade tests on forked chains, outside audits and a public bug bounty.

Pipelines

Our CI runs on our own hardware, more than ten times cheaper than the same work on hosted runners. It’s faster too, so we now run far more of it. Every job runs in a throwaway virtual machine. Native dependencies are rebuilt reproducibly and checked by hash before anything links to them. Storage code is crash-tested by killing it at every step that touches the disk, which is how we found crashes that left a database unable to reopen.

Automated audits

Several AI models from different providers go after your code at the same time, each looking for a way to break it. Each one finds things the others miss: in our tests, over half the problems were caught by only one model. Every security finding is written up as an attack: who sends what, what gets past your checks, and what they end up with. Each run starts where the last one left off and goes back over everything that changed. We add new models as they come out. Next, we’re making every attack run against a copy of your code in a sealed sandbox, to prove it works.

References on request, under NDA.

Launching something?

Tell us what it is and when. Send an NDA first if you need one.

Ask about an audit

Audits are a service of Symbiotic Labs LLC, a Wyoming limited liability company, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. hello@symbiotic.build