Nethermind Security

Comprehensive security from @Nethermind, from audits to formal verification. Book now:

[Nethermind Security @NethermindSec]

Building on Arbitrum? The Arbitrum Security Program can cover part of your audit, and we're one of its auditors again.

https://t.co/jQHlJvD205

[Arbitrum @arbitrum]

Introducing the Arbitrum Security Program

The Arbitrum Foundation is subsidizing smart contract audits for teams building on the Arbitrum Platform including:

> apps on testnet
> projects on mainnet
> migrating from another chain
> dedicated Arbitrum chains

Get audited with the likes of @OpenZeppelin, @trailofbits, @cyfrin, @Nethermind and many more

Read more below and register today:

https://t.co/sD6n9Rgwqw

[Nethermind Security @NethermindSec]

Most onchain losses now start with keys, access and build pipelines.

@TheoriqAI self-hosted our pre-release infrastructure tool against its own systems as a design partner. Here's what they found worth fixing.

https://t.co/PEQWFY0ucp

[Theoriq @TheoriqAI]

https://t.co/bAxYxarzms

[Nethermind Security @NethermindSec]

Getting audit quotes on Avalanche? Here's what you get with us.

Findings while the audit runs, so you fix as we go.

Your off-chain code reviewed too, like relayers and bridge services. That's where most of this year's losses came from.

Fixes worked out with Nethermind engineers. 90% get implemented right away.

https://t.co/NdCrKtBalK

https://t.co/lV7bM50YZU

[Avalanche Developers 🔺 @AvaxDevelopers]

The Avalanche Audit Marketplace is live on the Builder Hub 🔺

One request reaches all Ava Labs vetted firms. Quotes stay private, you pick one, and the program can cover up to 75% of the cost.

$0 fees for builders and auditors.

Request quotes 👇

[Nethermind Security @NethermindSec]

AuditAgent's most in-depth scan now costs half.

$0.05 per billable line of code, down from $0.10.
We want every team scanning with the best AuditAgent has. So there's now one scan, the full one, at half the price.

Your first scan shows you everything AuditAgent can do.

https://t.co/z9eK6ko5nn

[Nethermind Security @NethermindSec]

The mode a protocol runs in when it's most fragile is often the one it has tested least.

For @suno_finance, that's rescue mode. If the reserve behind uWatt drops below $1 per token, governance can open minting below par to bring in new capital.

In that mode the price follows the reserve. Every solar payment that lands moves it up in one step, and the payment shows in the mempool before it lands. Mint before, redeem after, and the rescue money goes to whoever was watching.

The first fix handled payments that leave the reserve under $1. It missed the ones that push it back over. The final version caps redemptions near the pre-payment price either way.

Suno's team reproduced each case in their own test suite before fixing it. The review covered 2,472 lines of Solidity, from issuance and redemption through to the cross-chain layer.

[Nethermind Security @NethermindSec]

One signing key, days of settlement volume behind it. That's the risk @xochi_fi's PXE Bridge is built around: it gives EVM solvers a familiar JSON-RPC path to shielded settlement on Aztec, backed by a pre-funded account.

SpendingLimitAccount puts the spending rules in the account: per-tx and daily caps, a fail-closed allowlist, and a proof that what gets checked is what actually moves.

We reviewed it assuming the signing key was already stolen. Even then, the contract must prevent a compromised signer from bypassing the spending controls. The team addressed all findings before the final report.

[Nethermind Security @NethermindSec]

Building on Lighter?

We're a Lighter Accelerate partner, so your audit just got cheaper.
https://t.co/7b2PqWY1PL

https://t.co/GW2GkxdWuS

[Lighter @Lighter_xyz]

If you’re building on Lighter, we want to help you accelerate!

Check out @lighter_hub’s program for support, visibility, and perks from partners — including credits, discounts, and access to tools and services for your app.

[Nethermind Security @NethermindSec]

Jacob at @particle_cs summed up Bloxchain Protocol's security review in one line: "Each layer caught what the last one left, and we fixed as we went." Bloxchain is a reusable library for approvals, time-locks and role-based controls, built to be dropped into other teams' EVM stacks.

The layers: AuditAgent with fixes between runs. Then an AgentArena competition, where independent agents on the same codebase caught what the scans had left. By the time our auditors opened the repo, the routine defects were already fixed and their time went to design and algorithmic questions.

https://t.co/OlS8Wnhror

[Nethermind Security @NethermindSec]

We completed a security review of @1inch's Aqua and SwapVM.

Aqua is a shared liquidity layer where the same capital backs multiple strategies and tokens stay in the LP's wallet until a swap executes. SwapVM runs swap strategies as signed bytecode programs, so makers get pegged swaps and concentrated liquidity without deploying a contract.

The review covered 1,903 lines of Solidity across three repositories, with well-documented, well-tested code throughout.

[Nethermind Security @NethermindSec]

AuditAgent's Findings tab is built for triage now, not just reading. Every finding shows who can trigger it, what config makes it exploitable, what's lost and who bears it, all filterable. Notes save with the scan. Export as JSON, MD or PDF.

https://t.co/3TitmxxWxv

[Nethermind Security @NethermindSec]

@voicecc Learn more:

https://t.co/VCrDWwoHON

[Nethermind Security @NethermindSec]

We completed a security review for @voicecc, a platform where users vote on the outcome of events to create an opinion economy. With Voice, users don’t have to pick the winning outcome to earn rewards. Everyone who votes is rewarded.

The review covered 2,386 lines of Rust across the Solana program, including deposits, off-chain reward commitments, and token validation.

[Nethermind Security @NethermindSec]

We completed a security review of @VistaPex, a perpetual futures exchange on Avalanche. The review covered the protocol's pooled USDC custody logic and its offchain trade settlement path, which uses SP1 zero-knowledge proofs to verify offchain calculations onchain.

We reported 5 findings, all addressed swiftly by the VistaPex team. Full report:

https://t.co/6y6JVI4ghb

[Nethermind Security @NethermindSec]

Privacy bridges rarely fail at the cryptography. They fail at signature scope and the timing of state updates.

We audited Holonym's Aztec Bridge, which moves ERC-20s from Ethereum to @aztecnetwork while proving Proof of Humanity and Proof of Clean Hands, so transfers stay compliant and private.

The risk didn't sit in the ZK math. A signature issued for another Holonym use case could be replayed against the bridge, weakening its Sybil resistance. And Aztec's DelayedPublicMutable timing left two openings: a denial of service that would have made the deployed contracts unusable, and a nonce that could be reused because reads went stale between a scheduled state update and when it took effect.

6 findings, all resolved before mainnet. Solidity, Noir, the ZK circuits, and the credential logic, reviewed as one system.

https://t.co/1poCSZXT9W

[Nethermind Security @NethermindSec]

Solidity accounts for 0.01% of The Stack v2, one of the main datasets AI coding assistants learn from.

So when one finishes your withdrawal function for you, it's guessing from almost nothing, in a language where a single wrong line locks funds for good.

Our approach is therefore trust but verify, and we hold our own tooling to it as much as anyone else's. Use AI across the workflow, whether you're brainstorming contract designs, scaffolding functions, or generating tests, but never ship code without manual review and thorough testing. Keep the human in control and keep your own engineering judgment sharp.

https://t.co/t8piluxUxB

[Nethermind Security @NethermindSec]

Most protocols stop at the audit. Lido didn't.
An audit is essential, but it's a snapshot:
New AI models find what older ones and past reviews missed.
New attack vectors surface, and attackers weaponize them fast.

So @LidoFinance had us run AI + experts on already-audited Lido Core: AuditAgent and AgentArena, tuned on their protocol knowledge. Together they went deeper and wider, with less noise.

And it doesn't stop. We re-run AgentArena as new models drop, so coverage gets sharper as the models do.

Full write-up ⬇️
https://t.co/SjKJUH8LkV

[Nethermind Security @NethermindSec]

Formal verification isn't worth it for most code.

That flips at the infrastructure layer.

An app bug stays local. A verifier or zkVM bug hits everything that trusts it, and onchain there's no undo.

When does proof cost less than uncertainty? ⬇️

https://t.co/hkpbClceBU

[Nethermind Security @NethermindSec]

AuditAgent's MCP server is live. Start a scan on your contracts and get the results straight in your coding agent

New accounts come with $50 in free credits, enough to run Auditor, our most in-depth scan mode, on your own code.

By popular request, findings can now be grouped by file or by topic too, not just severity. Makes triage a lot faster on a big codebase.

[Nethermind Security @NethermindSec]

We started an audit of @0xNullEth.

Null is the first modular synthetics protocol on Ethereum. Its markets are permissionless, immutable, and provide exposure to any asset.

The review covers the full Solidity codebase, focused on settlement logic and ERC-4626 vault architecture.