BlockVigil
Request audit →
Products

A security stack that stays on after the audit ends.

Six products, designed to compose. Start with a single audit, add continuous monitoring, scale into formal verification and incident response.

01 · Smart Contract Audits

Dual-team reviews. No shared context. Zero theater.

Every BlockVigil audit runs as two parallel reviews by independent teams. Findings are arbitrated together. The delta between teams is our most valuable signal.

  • ◆
    Living repo, not a PDFFindings ship as GitHub issues with reproduction steps, severity, and fix guidance.
  • ◆
    Fuzz + manualEchidna, Foundry invariants, and handwritten attack vectors.
  • ◆
    Fixed feeScoped by LOC and risk class. No padding, no surprise invoices.
  • ◆
    LanguagesSolidity, Vyper, Rust, Move, Cairo, Huff.
Request an audit →
AUDIT · OPERA-V4● IN REVIEW
✕ CRITICAL · #BV-108
Re-entrancy in Vault.withdraw()
Cross-function re-entrancy via ERC-777 receiver allows draining of vault deposits before state update.
◆ HIGH · #BV-109
Oracle staleness in PriceFeed.latest()
Fallback feed lacks freshness check; stale price can be used for liquidations.
● MEDIUM · #BV-110
Unchecked return value
42,118 LOC5C · 9H · 14M · 22I
02 · Watchtower Monitoring

Your invariants, enforced every block.

Watchtower ingests every block, every mempool tx, and every governance call. It raises pagers when an invariant breaks, a pattern emerges, or a threshold trips.

  • ◆
    Sub-block latencyDetection median 148ms from event emission to pager.
  • ◆
    Auto-pause guardianOpt-in gnosis-signed pause when a critical invariant breaks.
  • ◆
    Mempool MLTrained on 5 years of exploit mempool signatures.
  • ◆
    IntegrationsPagerDuty · Slack · Discord · OpsGenie · webhooks.
WATCHTOWER · LIVE● 4 CHAINS
● ALERT · BLOCK #18,294,012
Oracle drift exceeded 3σ · mitigated in 14s
P50
148ms
UPTIME
99.99%
INVARIANTS
214
03 · Formal Verification

Prove it. Don't test it.

Fuzzing finds bugs. Verification proves their absence. We compile your invariants to SMT constraints and run them against bytecode, for every possible input.

  • ◆
    Toolchain agnosticCertora · Halmos · Kontrol · Z3 · CVC5.
  • ◆
    Proven invariants ship with youCI-gated proofs re-run on every contract change.
  • ◆
    Counter-example minimizationFailing traces reduced to minimal reproducible inputs.
SPEC · meridian.spec
rule sharesNeverInflate {
  env e;
  uint256 _total = totalSupply();
  // any user action
  method f; calldataarg args;
  f(e, args);
  uint256 total_ = totalSupply();
  assert total_ >= _total =>
    assets() >= liabilities();
}
✓ PROVED142s · Z3
38/38 invariants · 0 counter-examples
04 · Managed Bug Bounty

Curated researchers. Zero noise.

BlockVigil's bounty network is invite-only. Every submission is triaged by a staff engineer before it hits your inbox. We pay researchers, you pay us a flat retainer.

  • ◆
    94% triage accuracyOnly validated findings reach your team.
  • ◆
    Capped liabilityPre-agreed bounty ceilings per severity tier.
  • ◆
    Bounty pool managementWe hold, pay, and tax-report for you.
BOUNTY · 12 OPEN$1.2M POOL
#BB-2041 · @0xhorizonCRIT
Signature malleability in withdraw path
REWARD · $240,000
#BB-2042 · @checkmateHIGH
DoS via unbounded loop
REWARD · $42,000
#BB-2043 · @zynthaxMED
TRIAGE ACCURACY · 94%PAID · $4.8M
05 · Team KYC

Prove you're not anonymous, without doxxing.

BlockVigil verifies your team's identities and publishes an on-chain attestation with jurisdiction and revocation metadata. Users and regulators can verify without seeing names.

  • ◆
    On-chain attestationEAS-compatible signed claims across 8 chains.
  • ◆
    RevocableAttestations can be revoked by BlockVigil or your ops team.
  • ◆
    Jurisdiction disclosureHelpful for institutional counterparties.
ATTESTATION · 0x8f4a…c912● VALID
ISSUER
BlockVigil Labs
SUBJECT
Opera Protocol
TEAM SIZE
14 verified
JURISDICTION
DE · SG · US
SIG · 0x3f8a92c1…
ETHEREUM BASE ARBITRUM OPTIMISM
06 · Incident Response

30-minute pager. Forensics by dawn.

When things break, BlockVigil's incident team is on a rotation, with a 30-minute response SLA for subscribed protocols. We trace funds, coordinate exchanges, and write the post-mortem.

  • ◆
    30-min response SLAFor Watchtower + retainer customers.
  • ◆
    Fund tracingChainalysis + TRM partnerships for recovery coordination.
  • ◆
    Public post-mortemCo-authored with your team. Transparency earns trust.
● PAGER · HELIX-2025-07T+00:14:22
Oracle manipulation detected
Attacker drained $14.2M via flash-loan + TWAP arb on Helix perps pool.
✓T+00:14 · Incident opened
✓T+00:28 · War room assembled
✓T+00:41 · Protocol paused (guardian)
⟳T+01:12 · Funds traced to Tornado
○CEX freeze coordination · queued
Start anywhere

Every BlockVigil product works alone. They work better together.

Not sure where to start? Our team will scope a minimum-viable security posture for your protocol in a single 30-minute call.

Request a quote →