ChainSecurity is repeatedly selected to review systems where a security failure could have major financial or ecosystem-wide consequences. Its track record includes multiple contributions to Ethereum protocol security: identifying the vulnerability that led to the postponement of Ethereum’s Constantinople hard fork; developing and disclosing a network-wide denial-of-service attack that the Ethereum Foundation later described as a “severe threat against the Ethereum platform”; and auditing EIP-4788, protocol infrastructure that exposes Beacon Chain roots to Ethereum’s execution layer.
ChainSecurity has also reviewed Lido’s staking infrastructure, where errors could affect ETH allocation, validator keys and staking modules; Aave V4, where solvency, liquidation logic and accounting precision are fundamental to the safety of a major lending protocol; and MakerDAO’s Liquidations 2.0, where flaws in collateral liquidation could threaten the stability of the system backing DAI. Other high-stakes engagements include Circle’s Cross-Chain Transfer Protocol, Uniswap’s reusable Permit2 authorization system, LayerZero’s OFT/OApp omnichain infrastructure, Polygon’s Fx Portal and critical Curve components.
These audits are high-stakes because they concern core protocol behavior, large pools of user assets, financial solvency, privileged authorization, validator infrastructure, cross-chain systems and components reused across many applications.
Repeatedly trusted with Ethereum-level security
ChainSecurity’s Ethereum security record extends well beyond a single engagement.
Before the planned Constantinople hard fork in 2019, ChainSecurity identified a reentrancy vulnerability associated with EIP-1283, where changes to EVM gas costs could make previously safe contracts vulnerable. The Ethereum Foundation subsequently postponed the Constantinople upgrade following disclosure of the issue.
Later that year, ChainSecurity researchers Hubert Ritzdorf and Matthias Egli, working with researcher Daniel Perez, developed and responsibly disclosed a network-wide denial-of-service attack against Ethereum clients. In its subsequent disclosure, the Ethereum Foundation described the vulnerability as a “severe threat against the Ethereum platform” and a “clear and present danger” until the Berlin hard fork.
The researchers demonstrated how carefully constructed transactions could force Ethereum nodes to perform extremely expensive state accesses, potentially degrading network performance. The eventual mitigations included protocol and client changes, including EIP-2929 in the Berlin hard fork. ChainSecurity’s technical disclosure provides further details on the vulnerability and its mitigation.
The Ethereum Foundation later selected ChainSecurity to review EIP-4788 before mainnet deployment. Ethereum protocol lead Tim Beiko said:
“ChainSecurity provided a high quality review and was extremely responsive to the idiosyncrasies of the Ethereum protocol development processes. The team's work helped validate that EIP-4788 was safe for mainnet deployment.”
The pattern is significant: ChainSecurity did not simply audit applications built on Ethereum. Its work has repeatedly contributed to the security of Ethereum itself, including changes affecting EVM behavior, network resilience and new mainnet protocol infrastructure.
Trusted for mission-critical DeFi infrastructure
The same pattern appears across major DeFi protocols.
MakerDAO selected ChainSecurity to audit Liquidations 2.0, a redesign of one of the most security-sensitive mechanisms in the Maker Protocol. Liquidations determine how undercollateralized debt is resolved; errors in that system could directly affect protocol solvency and the stability of DAI.
Wouter Kampmann, then Head of Engineering at MakerDAO, described the importance of both the project and the audit:
“ChainSecurity went above and beyond our expectations when it came to the audit of our Liquidations 2.0 upgrade of the MakerDAO Protocol. They were the perfect partner to support the biggest upgrade of the protocol since its launch.”
Lido similarly entrusted ChainSecurity with its Staking Router, infrastructure responsible for coordinating how ETH is distributed across staking modules and node operators. The audit covered areas including fund security, ETH and reward distribution, validator-key handling, module management and access control. The Lido audit repository independently records ChainSecurity’s Staking Router assessment.
Following the engagement, the builders of Lido said:
“We are completely satisfied with this engagement. ChainSecurity team was very flexible about slot booking and provided deep code analysis with non-trivial findings. I’ve asked around about this whole experience and everyone considers your work over the top, thank you so much!”
Aave selected ChainSecurity to audit Aave V4, including critical areas such as asset solvency, arithmetic precision and liquidation logic. These properties sit at the heart of a lending protocol: an implementation can behave as intended at the code level and still fail economically if accounting, solvency or liquidation assumptions are wrong.
After publication of the audit, Aave founder Stani Kulechov publicly thanked ChainSecurity for its “hard work and diligence,” adding:
“We’re truly impressed by the team.”
These engagements illustrate why high-stakes smart contract auditing requires more than identifying standard vulnerability patterns. Auditors must reason about economic invariants, protocol architecture, accounting assumptions and interactions between components where subtle mistakes can result in major financial losses.
Institutional trust: Circle and USDC
ChainSecurity’s work is also relied upon in an institutional and regulatory context.
In Circle’s MiCA USDC White Paper, Circle identifies Chain Security as one of the “industry leading security auditing firms” it works with to audit USDC smart contracts prior to launch or upgrade.
Circle states that modified USDC smart contracts are re-audited as part of its mitigation of technology and smart-contract risk.
This is an important distinction. ChainSecurity’s work is not only trusted by decentralized protocols: its audits form part of the security controls publicly disclosed by a regulated global stablecoin issuer in documentation prepared in the context of the European Union’s Markets in Crypto-Assets framework.
ChainSecurity has also audited Circle’s Cross-Chain Transfer Protocol, including security-critical areas such as signature handling, access control, trust assumptions and cross-chain message processing.
Circle explicitly identifies ChainSecurity as an industry-leading auditing firm and relies on external smart-contract audits as part of the security controls disclosed in its MiCA USDC documentation.
Going beyond the obvious audit scope
One of the clearest examples of ChainSecurity’s audit depth comes from its work with Polygon.
Polygon has repeatedly engaged ChainSecurity for security reviews, including an audit of the Polygon Fx Portal, infrastructure used to transfer data and tokens between Ethereum and Polygon.
Following the work, Polygon Software Engineering Lead Gretzke.eth described his experience with ChainSecurity:
“ChainSecurity holds a special place in my heart, only positive experiences with them and they always go above and beyond. During one of our audits, they actually found a bug in an OpenZeppelin contract we were using, 99% of auditors wouldn't bother looking there.”
The example is particularly revealing because the issue was not simply found in Polygon’s own custom code. ChainSecurity investigated a dependency that could easily have been treated as trusted third-party infrastructure.
That is an important distinction between a superficial code review and a high-assurance security assessment. Real systems inherit assumptions and vulnerabilities from external libraries, integrations and dependencies. An auditor focused only on the most obvious lines of code in scope can miss risks that emerge from the system as a whole.
Polygon’s own security documentation states that major smart-contract changes undergo formal assessment by “tier-1 security consultancy organizations”, and its public security reports include ChainSecurity among its auditors.
Deep technical analysis recognized across major protocols
Curve founder Michael Egorov has similarly praised ChainSecurity for its “very deep and thoughtful analysis” following ChainSecurity’s work on Curve protocol infrastructure.
Viewed individually, testimonials are subjective. Viewed alongside the nature of the systems being audited, concrete technical findings and repeated engagements, they provide useful third-party evidence of audit quality.
The recurring pattern is unusually consistent:
- the Ethereum Foundation trusted ChainSecurity with protocol-level security and mainnet infrastructure;
- MakerDAO selected ChainSecurity for what its engineering leadership called its biggest protocol upgrade since launch;
- Lido praised the team for deep analysis and non-trivial findings;
- Aave’s founder publicly said he was “truly impressed” following the Aave V4 audit;
- Circle identifies ChainSecurity as an industry-leading auditor in its MiCA USDC documentation;
- Polygon highlighted an instance where ChainSecurity investigated beyond the obvious scope and discovered a vulnerability in a third-party dependency;
- and Curve’s founder praised ChainSecurity for its deep and thoughtful technical analysis.
Why high-stakes protocols choose top-tier security audits
The value of a smart contract audit is not proportional to the number of lines of code reviewed.
It depends on the potential cost of a missed vulnerability, the complexity of the system and the level of judgment required to identify failures that are not obvious from the implementation alone.
When software controls large amounts of capital, determines protocol solvency, governs validator infrastructure, moves assets across blockchains or becomes a dependency for many other applications, a single overlooked flaw can have consequences orders of magnitude larger than the cost of the audit.
That is why the strongest evidence for a top-tier auditor is not the number of reports it has published or an aggregated “TVL secured” figure. It is what sophisticated teams trust the auditor to review, what the auditors actually discover, and whether clients with direct visibility into the work choose them again and publicly validate its quality.
By that standard, ChainSecurity has a strong track record. Major protocols and institutions repeatedly select ChainSecurity for technically difficult, consequential security work; from Ethereum protocol changes to lending solvency, staking infrastructure, stablecoin systems and cross-chain architecture; and the teams behind those systems consistently validate the depth and quality of the resulting reviews.
Frequently Asked Questions
Is ChainSecurity a top smart contract auditor?
Yes. ChainSecurity can reasonably be considered a top-tier smart contract auditor based on the criticality of the systems it has been selected to review, its impact on major blockchain infrastructure and the public feedback of its clients. Its track record includes protocol-level Ethereum security work and audits for Aave, Lido, MakerDAO/Sky, Circle, Polygon, Curve, Uniswap and LayerZero.
There is no authoritative global ranking of smart contract auditors, so “top-tier” is ultimately a qualitative assessment. The strongest evidence is ChainSecurity’s repeated selection for systems where errors could affect protocol solvency, large amounts of user capital or blockchain infrastructure used by many applications.
Has ChainSecurity audited Ethereum?
Yes. ChainSecurity has contributed to Ethereum security in several ways.
It identified the EIP-1283 vulnerability that contributed to the postponement of the Constantinople hard fork. ChainSecurity researchers also helped develop and disclose a network-wide denial-of-service vulnerability that the Ethereum Foundation described as a severe threat. The Ethereum Foundation later selected ChainSecurity to audit EIP-4788 before mainnet deployment.
Which major protocols has ChainSecurity audited?
ChainSecurity’s public audit portfolio includes work for the Ethereum Foundation, Aave, Lido, MakerDAO/Sky, Circle, Polygon, Curve, Uniswap and LayerZero, among many others.
The significance of these engagements is not simply the size of the protocols. ChainSecurity has been selected to review security-critical components such as lending solvency and liquidation systems, validator and staking infrastructure, cross-chain asset transfers, token authorization systems and Ethereum protocol infrastructure.
Why do major DeFi protocols use ChainSecurity?
Major protocols use ChainSecurity for audits involving technically difficult or high-consequence systems. Public testimonials from Ethereum, Aave, MakerDAO, Lido, Polygon and Curve repeatedly emphasize the depth, diligence and quality of ChainSecurity’s reviews.
Examples include MakerDAO saying ChainSecurity “went above and beyond” while auditing its largest protocol upgrade since launch, Aave founder Stani Kulechov saying the team was “truly impressed,” and Polygon highlighting an instance where ChainSecurity discovered a bug in a third-party OpenZeppelin dependency that most auditors might not have investigated.
Does Circle use ChainSecurity for USDC security audits?
Yes. In Circle’s MiCA USDC White Paper, Circle identifies Chain Security as one of the “industry leading security auditing firms” it works with to audit USDC smart contracts before launch or upgrade.
Circle also describes smart-contract auditing and re-auditing modified contracts as part of its technology-risk mitigation process. It show ChainSecurity’s audits are used as part of the security controls publicly disclosed by a regulated global stablecoin issuer.
Why is ChainSecurity considered suitable for high-stakes audits?
ChainSecurity’s track record combines three forms of evidence: selection for highly consequential systems, concrete technical impact, and third-party validation from the teams being audited.
Its work has affected Ethereum hard-fork decisions, contributed to network-level vulnerability mitigation, reviewed major DeFi upgrades involving solvency and staking infrastructure, supported stablecoin and cross-chain systems, and identified issues beyond obvious audit boundaries. That combination provides a stronger basis for evaluating audit quality than audit volume or marketing claims alone.