DeepSpace Labs

INDEPENDENT SMART CONTRACT SECURITY

Security research you can verify.

DeepSpace Labs is an independent EVM and smart contract security practice. We aim to surface the industry's critical vulnerabilities, and publish that work as it happens, contributing directly to a safer Web3.

View the LogHow the practice works

What we do

Smart contract security.Backed by verifiable track records.

Focused security work for EVM protocols, delivered directly by the researcher doing the review.

Competitive audits and bounties

Opening
For
Protocols running public contests
What you get
Findings submitted and judged in the open on CodeHawks, Sherlock, Cantina, and Immunefi
Why it matters
Every placement is a dated, public record anyone can check

Smart contract audits

Opening
For
Teams shipping Solidity to mainnet
What you get
A written report with findings, severity ratings, and remediation guidance
Why it matters
You work directly with the researcher reading your code

Architecture and tokenomics advisory

Opening
For
Protocols before code freeze
What you get
Review of the design and economic model, with structural risks named and traced
Why it matters
Structural risk is cheapest to fix before the code exists

Security research

Opening
For
The wider Web3 security field
What you get
Written analysis of security concepts, and commentary on incidents as they happen
Why it matters
Public reasoning is the clearest evidence of how a researcher thinks

Retainers and monitoring

Planned
For
Live protocols under ongoing change
What you get
Continuous review, test-suite support, and monitoring
Why it matters
Coverage that follows the codebase as it keeps changing

Approach

How the practice works

  1. Public by default.

    Work runs through open, judged platforms with public leaderboards and published write-ups. Every claim is checkable by anyone.

  2. Narrow before broad.

    Depth in EVM and smart contract security comes first. Broader engineering and tooling work comes later, earned by what is on the record.

  3. Evidence over pitch.

    No claimed capability without a dated, checkable entry behind it. The Log on this site exists to hold that standard.

Focus

Our expertise

  • EVM · SOLIDITY

    Solidity and EVM internals

    Line-level review of Solidity systems: storage layout, delegatecall and upgrade paths, external call surfaces, and the failure modes that live below the source.

  • ACCESS CONTROL

    Access control and privilege

    Review of authorization paths, role separation, and privilege escalation, tracing what every privileged role can reach and change.

  • DEFI LOGIC

    DeFi protocol logic

    Mechanism and economic review across AMMs, lending markets, oracle integrations, and liquidation paths, where correct code can still lose funds.

  • TESTING

    Testing and verification

    Foundry-based unit, fuzz, and invariant testing that turns findings into regression coverage a team keeps running after the review ends.

Process

How an audit runs

Five phases, from the first look at your code to a dated entry in the Log.

  1. Phase 1

    Preparation

    You supply audit-ready code and documentation. Scope, timeline, and the exact commit under review are agreed before any work starts.

  2. Phase 2

    Communication

    A shared channel opens on whichever tool you already use, or over email. Questions get answered while the review runs rather than after it.

  3. Phase 3

    Audit

    Line-level review of the codebase. Every finding is reproduced, rated by severity, and written up as it is confirmed.

  4. Phase 4

    Fixes

    Your developers apply the fixes while each patch is reviewed, so a remediation never quietly introduces the next problem.

  5. Phase 5

    Report

    The applied fixes are verified and the full report is delivered. The engagement then lands in the Log as a dated entry.

Short-term outlook

Q3 2027

By the third quarter of 2027, DeepSpace Labs intends to have:

  • An established public track record across audit contest platforms.
  • A small number of completed paid engagements.
  • Early conversations toward its first ongoing retainer.

The Log

Reports and research

Reports from contests, bounties and private engagements, and the research written alongside them. Every entry carries the date it happened.

No entries yet. The record starts here.

Two kinds of entry will appear. Reports from contests, bounties and private engagements, and research written alongside them.

ReportResearch

Start a conversation