5+ Years
Web3 development experience through RedDuck.
// SMART CONTRACT SECURITY
GreenDuck — Web3 & Smart Contract Security Audits
Securing Web3 protocols across EVM, Solana & NEAR.
- EVM
- SOLANA
- NEAR
// WHY US
Why GreenDuck?
3 Ecosystems
EVM, Solana, NEAR.
Developer Perspective
Security reviews backed by practical blockchain development experience.
// SERVICES
Services
Smart Contract Audits
Manual code review and vulnerability detection.
Security Reviews
Architecture, access controls and protocol security.
Remediation Verification
Reviewing fixes after an audit.
What we audit
// HOW WE WORK
Audit Process
-
01
Scoping
You share the repository and a fixed commit. We agree on scope, timeline and quote.
-
02
Review
Line-by-line manual review, backed by static analysis, fuzzing and invariant testing.
-
03
Report
A private report with findings ranked by severity and concrete remediation recommendations.
-
04
Fix Review
We verify your fixes and update the report with the final status of every finding.
// COVERAGE
Languages & Tooling
EVM
Solana
NEAR
Manual review
Line-by-line code and business-logic analysis
Static analysis
Slither and custom detectors
Fuzzing
Foundry fuzz & invariant tests, Echidna, Trident
Proof of concept
Exploit tests for confirmed findings
// ATTACK SURFACE
What We Look For
EVM
- Reentrancy, including cross-function and read-only
- Access control and privileged roles
- Oracle and price manipulation
- Rounding, precision and share inflation
- Signature replay and EIP-712 misuse
- Upgradeability and storage collisions
- Front-running and MEV exposure
Solana
- Missing signer and owner checks
- PDA seed and bump validation
- Account type confusion
- Unsafe CPI and arbitrary program invocation
- Duplicate mutable accounts
- Account closing and revival
- Arithmetic overflow and precision loss
NEAR
- Promise and callback failure handling
- State consistency across cross-contract calls
- Unprotected callbacks missing
#[private] - Predecessor vs signer account checks
- Storage staking and deposit accounting
- Access keys and permission scope
- Arithmetic overflow and precision loss
// REPORTING
Severity Classification
Critical
Direct loss of funds or permanent compromise of the protocol.
High
Significant loss of funds or protocol disruption under realistic conditions.
Medium
Limited loss or disruption that requires specific conditions to exploit.
Low
Minor issues, edge cases and deviations from best practices.
Informational
Code quality, gas optimizations and documentation improvements.
// ABOUT US
About Us
GreenDuck is a Web3 security audit company derived from RedDuck, a blockchain development company operating since 2020. We combine years of hands-on smart contract development experience with a dedicated focus on blockchain security.
redduck.io →// FAQ
Frequently Asked Questions
How long does an audit take?
It depends on the size and complexity of the codebase. We give you a timeline after scoping, before any work starts.
How much does an audit cost?
Pricing is based on scope: lines of code, protocol complexity and deadline. Message us on Telegram at @redduckua for a quote.
What should we prepare before the audit?
A repository with a frozen commit hash, a clear list of files or programs in scope, documentation or a spec describing intended behavior, and your existing test suite.
Which languages and chains do you cover?
EVM (Solidity, Vyper, Yul), Solana (Rust, Anchor and native programs) and NEAR (Rust, near-sdk).
What is in the report?
Every finding with its severity, description, impact and a recommended fix, plus a proof of concept where applicable. The report is delivered privately to the client.
Do you review the fixes?
Yes. After you address the findings, we verify each fix and update the report with its final status.