Megapot
Medium severityCode4rena competitive audit
A Medium-severity finding accepted and paid in a Code4rena competitive audit, judged against every other researcher who submitted on the same codebase.
Code4rena profileTaking on a small number of retainer clients
Ongoing smart contract security review for small GameFi and DeFi teams across EVM chains
Focused on the business-logic and economic exploits that matter most to live protocols.
Most security work is a single point-in-time event: the repo is frozen, someone reads it once before launch, and after that nobody is looking at your changes. This works the other way round. Your code is treated as continuous, and every update you ship is reviewed before it goes live — built for small, resourceful teams that audit firms are too big to prioritise.
At a glance
- Onboarding Review
- $300–600 once
- Then ongoing review
- From $300/month
- Turnaround
- Usually 3–5 business days
- Built for
- Small GameFi & DeFi teams
Your exact monthly price is set after the Onboarding Review, against your real codebase and how often you ship. See the full breakdown.
- Medium
- Code4rena finding on Megapot
- Critical
- Finding on BulkSender
- 2 paid
- Audits: KoinArcade and BulkSender
- 3 disclosed
- Ronin projects: Fableborne, Apeiron, MoTZ
Chains: Ethereum · Base · Ronin · BNB Chain · Polygon · Arbitrum · any EVM-compatible chain
Pricing
What ongoing smart contract review costs
Two parts, in order. A one-time Onboarding Review that reads the code you already have live, and then ongoing review of everything you ship after it. The Onboarding Review is where both prices stop being ranges and become your actual numbers.
Step 1 · required once
Onboarding Review
$300–600one-time
A baseline read of the codebase you already have deployed. It happens once, before any ongoing review begins, and it is where both the exact price for this step and your monthly price get settled against the real code rather than guessed from a form.
- Read of your current deployed contracts end to end
- A written map of trust boundaries, privileged roles, and value flows
- Severity-rated findings in the code you have live today
- A list of the assumptions your system depends on, which I then watch for breakage on every later deploy
- Your exact price inside the $300–600 range, set by codebase size and complexity
- Your monthly Ongoing Review price, quoted from what I actually found in the code
- Turnaround
- 5–7 business days
- Required
- Once, before ongoing review starts
Step 2 · ongoing
Ongoing Review
From $300/month
One offering with two triggers. When you are shipping, you send the diff and the changed code and everything it touches is reviewed for exploitability before it goes live. When you are not shipping, the same attention goes to the contracts you already have deployed: a periodic re-check of unchanged code against attack patterns that have become known since I last looked.
- Changed code and every code path it touches, reviewed before you deploy
- Periodic re-checks of existing contracts against newly known attack patterns
- Severity-rated findings with a concrete fix for each
- Proof-of-concept tests for anything exploitable
- Direct line to me for questions while you patch
- Exact price
- Agreed after the Onboarding Review
- Cadence and scope
- Set with you, not by deploy count
- Turnaround
- Agreed with you — usually 3–5 business days per diff
Ongoing Review starts at $300/month. Cadence and scope are agreed based on how often you ship and how much attention your existing contracts need, so a team shipping weekly and a team sitting on stable contracts are both covered by the same retainer. The final monthly price and your turnaround are set after the Onboarding Review, once I have read the actual code, rather than quoted off a fixed range up front.
Shipping faster than that? Shipping more often than a couple of times a month, or need a diff turned around faster than that? Say so on the scoping call and we will work out an arrangement that matches your deploy rhythm — there is no fixed menu here.
Changes above the Ongoing Review threshold
Quoted separately
New modules, new external protocol integrations, and major logic rewrites are not covered by Ongoing Review.
Ongoing Review covers incremental change to a codebase I already know. Work that adds a new module, integrates a protocol you were not previously exposed to, or rewrites core logic is a new scoped engagement, quoted on its own before it starts. I tell you a change has crossed that line when you send the diff, not after.
Recently been exploited? After an exploit, the re-audit isn't enough covers where ongoing review fits once the fix has been signed off.
Comparing quotes? The pricing page has the full breakdown, how this compares to what audit firms charge, and what moves a quote up or down.
The quoted price is the price
Your monthly number is set after the Onboarding Review, agreed in writing before the first month starts, and does not move inside the term. No hourly overruns, no scope-creep invoices, no surprise line items.
Confidential by default
Your code and findings are never published or shared without your written permission. NDA on request, signed before you send anything.
What if my code isn't changing right now?
Then the review still has something to do. Your contracts stop changing. The set of known attack techniques does not.
Most of what gets found in this industry is not a brand-new class of bug. It is a technique proven against one protocol, written up, and then found to apply to a dozen others that were deployed months or years earlier and never touched since. Code that was genuinely safe against everything known in March can be exploitable against what is known in September without a single line of it changing.
This is why serious protocols stopped treating security as something you buy once before launch and started treating it as a process that runs continuously. A point-in-time audit still matters at milestones. It just stopped being the whole answer, because the thing it measured you against keeps moving after the report is delivered.
When you are shipping
You send the diff before you deploy. I read the changed code and every path that reaches it, against the map built during onboarding.
When you are not
I re-check what is already live against what has become known since the last look. Same retainer, same monthly price, no separate product to buy.
How it works
How ongoing review actually runs
One baseline review at the start, then a loop that runs whether or not you are shipping. Steps three to five repeat for the life of the retainer.
- 01
Scoping call
A short call about what you have deployed and how often you ship contract changes. You leave knowing what the Onboarding Review will cost and when it can start.
- 02
Onboarding Review
A one-time $300–600 baseline read of your current codebase. I map the trust boundaries, privileged roles, value flows, and the assumptions your system relies on. This is also where your monthly price and turnaround are set, against real code rather than a guess.
- 03
A diff, or a quiet month
If you are shipping, you send the diff at least 3 business days before you deploy. If you are not, you send nothing and the retainer turns to the contracts already live. You never have to tell me which mode you are in — the absence of a diff is the signal.
- 04
I review it against your map
A diff is read for exploitability along with every code path that reaches it. A quiet month means your deployed contracts get re-read instead, checked against attack techniques that have become public since I last looked at them. Both are the same job against the same model of your system.
- 05
Findings back, map updated
Severity-rated, with a concrete fix for each, and I stay reachable while you patch. Whatever moved — your code or the set of known attacks — the assumptions map is updated so the next review starts from the current state. Steps three to five then repeat for as long as the retainer runs.
What each review covers
What I look at in a review
Every review asks one thing: whether the code can be exploited, and what it breaks in the code it touches. Same scope whether it is a diff you are about to ship or a re-read of what is already live. That is the whole of it, and the things outside it are listed too.
Access control
New or modified privileged functions, role boundaries that moved, upgrade hooks, and emergency functions that quietly bypass every other control.
Accounting and reward maths
Balance tracking, reward-per-share drift, fee application order, and rounding direction — the arithmetic that drains a pool one transaction at a time.
Economic and business-logic exploits
Sequences of entirely legal transactions that end badly: incentive sizing, emission schedules, liquidation edges, and anything a determined player or trader will grind until it pays.
External call safety
Reentrancy across the whole call graph the change opens up, untrusted callbacks, unchecked return values, and assumptions inherited from protocols you integrate.
Oracle and price assumptions
Manipulation windows, stale or absurd feed values, and what your changed logic does when the price it reads is wrong.
Breakage of existing invariants
The assumptions mapped during the Onboarding Review are re-checked on every review, so a safe-looking change to one contract does not silently invalidate another — and so an assumption that only became unsafe later does not go unnoticed.
Explicitly not in scope
These are real concerns, and they are not what you are paying me for. Reviews stay on security so the turnaround stays short.
- Gas optimisation
- Code style, formatting, and naming
- Architecture preferences and refactoring advice
- General code quality or test-suite review
Track record
Findings, clients, and disclosures by name
Specific work on specific projects. Two of the reports are published in full on this site, so you can read the depth and format before you hire me.
BulkSender
Critical severityPaid audit · public report
Batch token distribution contract. Found a Critical issue in the transfer accounting before it reached production. The full report is published here.
Read the report (PDF)KoinArcade
Report publishedPaid audit · public report
On-chain arcade with player payouts. Reviewed game logic, payout accounting, and randomness handling. The full report is published here.
Read the report (PDF)Fableborne
DisclosedResponsible disclosure · Ronin
Public disclosure to a live Ronin ecosystem game, reported through the project's own channel rather than published first.
Apeiron
DisclosedResponsible disclosure · Ronin
Public disclosure to a live Ronin ecosystem project, reported directly to the team.
MoTZ
DisclosedResponsible disclosure · Ronin
Public disclosure to a live Ronin ecosystem project, reported directly to the team.
Several of these are Ronin ecosystem projects, because that is where a lot of small GameFi teams ship. The work itself is not Ronin-specific: the review covers Solidity and Vyper on any EVM-compatible chain, including Ethereum, Base, Arbitrum, BNB Chain, and Polygon.
Everything above is checkable: Code4rena profile · GitHub d4rk-source · Telegram @Alex_Cipher · X @_AlexCipher
Get your next deploy reviewed before it goes live
Send me your repo, your chain, and roughly how often you ship contract changes. You get a monthly number and a start date back, usually the same day.
No obligation, and no sales sequence. Ongoing Review runs for a 3-month minimum, then month to month with 30 days' notice.
Terms of the retainer
What is and isn't covered
The limits of this service, written down before you buy it rather than discovered halfway through a month.
Scope is security and exploitability only
I review whether the changed code can be exploited, and what it breaks in the code it touches. I do not review gas optimisation, code style, naming, architecture preference, or general code quality. If something is inefficient but safe, I will not spend your review on it.
This is not a substitute for a full audit
Ongoing review catches what changes between deploys. It does not replace a full audit before a major version release or a public launch, and it should be paired with one. If you are launching or shipping a v2, book a full audit for that release — from me or from anyone else — and keep the retainer running around it.
Send diffs at least 3 business days before you deploy
Turnaround is agreed with you after the Onboarding Review and is usually 3–5 business days per diff, so a diff that arrives the morning of a deploy cannot be reviewed in time. Submitting late does not shorten the turnaround; it just means the deploy goes out unreviewed.
Large or complex changes fall outside Ongoing Review
New modules, new external integrations, and major logic rewrites are quoted separately as their own scoped engagement. Everything else — parameter changes, bug fixes, incremental feature work on existing contracts — is covered by the monthly fee. I flag the boundary when the diff arrives, before any extra work happens.
Ongoing Review runs for a minimum of 3 months
The retainer carries a 3-month minimum term. After that it continues month to month and either of us can end it with 30 days' written notice. The minimum exists because the first month is largely spent building context that only pays off over the following ones.
Your code stays confidential
Code, diffs, and findings are never published or shared without your written permission. An NDA can be signed before you send anything.
The full contractual version of these terms is on the Terms of Service page. Anything agreed in writing for a specific engagement takes precedence over both.
Also available
One-time Full Audits
A single point-in-time audit of a codebase, delivered as a written report. Same reviewer, same method, same depth as the retainer work — just without the ongoing part.
One-time Full Audit
From $1,200
Project-based, not monthly
Priced per project on the size and complexity of the scope, agreed in writing before the work starts. Typical engagements for the teams I work with land between $1,200 and $5,000; larger scopes are quoted after reading the repo.
Turnaround depends on scope and is fixed on the scoping call — usually 1 to 3 weeks from the day the code is frozen.
Get a project quoteTake this instead of a retainer when
- You are about to launch and need one thorough review of the whole system
- You are shipping a major version and want a point-in-time report you can publish
- You want to see how I work before committing to a retainer
- Your code changes rarely enough that a monthly retainer would be poor value
Who this is not for
This is still scoped to small and independent teams. I am one reviewer, not a firm, and I do not bid on large protocol audits that need a multi-person team and a months-long timeline.
About
The person reading your code
I'm Adomas Venslovas — Alex Cipher — a blockchain security researcher reviewing smart contracts for small GameFi and DeFi teams on EVM-compatible chains. I work as @_AlexCipher on X and d4rk-source on GitHub.
My work centres on the parts of a protocol that actually hold value: staking contracts, AMM logic, token flows, payout and reward systems, and the business logic that turns a well-written contract into an exploitable one when nobody reads it end to end. Alongside GameFi and DeFi, a real share of that has been on-chain gambling and prediction markets, where randomness, payout accounting and house edge are the whole attack surface.
I have a Medium-severity Code4rena finding on Megapot, a Critical-severity finding on BulkSender, paid audit work for KoinArcade and BulkSender, and public disclosures to Ronin ecosystem projects including Fableborne, Apeiron, and MoTZ.
I built this as a retainer rather than an audit shop because the teams I work with ship constantly, and a report written against a commit from three months ago tells them nothing about the code running today.
Key skills
Languages
Solidity, Vyper, Foundry test suites
Security analysis
Manual review, exploit proof-of-concepts, invariant reasoning
Specialisation
GameFi protocol logic, on-chain gambling and prediction markets, DeFi staking and AMM mechanics, business-logic and economic exploits
Chains
Ethereum, Base, Ronin, BNB Chain, Polygon, Arbitrum, and any EVM-compatible chain
FAQ
Ongoing smart contract review: common questions
Direct answers to the questions teams ask before starting. If yours isn't here, ask me and I'll answer it directly.
What does ongoing smart contract review cost?
There are two parts. A one-time Onboarding Review is $300–600, and it has to happen once before ongoing review starts. Ongoing Review then starts at $300 per month. Your exact monthly price is not a fixed range: it depends on how complex your codebase is and how often you ship, so it is agreed after the Onboarding Review, once I have read the actual code. The same applies to turnaround. If you ship more often than a couple of times a month or need diffs back faster, that is a direct conversation rather than a listed tier.
Do I have to take the Onboarding Review first?
Yes, if you want ongoing review. It is a one-time $300–600 engagement and it is the only way the monthly price and turnaround can be quoted against your real code instead of guessed. It is not a sales step: you get a written map of your system and severity-rated findings out of it whether or not you go on to a retainer. A one-time Full Audit does not require it.
How is this different from a smart contract audit?
An audit is a single point-in-time review: you freeze the code, someone reads all of it, you get a report, and from the next deploy onward nobody is reading your changes. Ongoing review is the opposite shape. You keep shipping, and every contract change gets read for exploitability before it goes live. Ongoing review does not replace an audit before a major release or a public launch — the two are meant to be paired, with an audit at the big milestones and continuous review covering everything between them.
Who is this for?
Small and independent GameFi and DeFi teams on EVM chains — the teams traditional audit firms consider too small to prioritise, and who cannot pay firm-scale audit fees every time they ship a feature. If you have live contracts, a handful of developers, and you deploy changes more than once a quarter, this is built for you.
What is actually reviewed on each deploy?
The code you changed, and every code path that reaches it. The focus is exploitability: access control, accounting and reward maths, external call safety, oracle assumptions, and the sequences of entirely legal transactions that drain a protocol. Gas optimisation, code style, and general code quality are explicitly out of scope.
How fast do I get findings back?
Turnaround is agreed with you after the Onboarding Review, based on how often you ship, and is usually 3–5 business days per diff. That is why diffs need to arrive at least 3 business days before you plan to deploy — sending one the morning of a deploy does not shorten the turnaround. If you need something faster than that as a standing arrangement, tell me on the scoping call and we will work it out.
What if a change is too big for the retainer?
New modules, new external protocol integrations, and major logic rewrites fall outside Ongoing Review and are quoted separately as their own scoped engagement. I tell you when a diff crosses that line as soon as it arrives, before any additional work or cost happens. Parameter changes, bug fixes, and incremental feature work on existing contracts stay inside the monthly fee.
Is there a minimum term?
Yes. Ongoing Review runs for a minimum of 3 months, then continues month to month with 30 days' written notice to cancel. The minimum is there because the first month is mostly spent building context about your system that only pays off across the following months. The Onboarding Review is a one-time engagement and carries no term at all.
Can I get a one-time audit instead of a retainer?
Yes. One-time Full Audits start from $1,200 and are priced per project on the scope. It is the same reviewer and the same method as the ongoing work, without the recurring part, and it does not require an Onboarding Review first. It suits teams that want one thorough point-in-time review — before a launch, before a major version, or to see how I work before committing to anything ongoing.
Which chains and languages do you cover?
Solidity and Vyper on any EVM-compatible chain, including Ethereum, Base, Ronin, Arbitrum, BNB Chain, and Polygon. A lot of my published work is on Ronin because that is where many small GameFi teams ship, but nothing about the review is chain-specific.
What experience are you basing this on?
A Medium-severity finding on Megapot in a Code4rena competitive audit, a Critical-severity finding on BulkSender, paid audit work for KoinArcade and BulkSender with both reports published on this site, and public disclosures to Ronin ecosystem projects including Fableborne, Apeiron, and MoTZ.
Who am I actually working with?
One person: Adomas Venslovas, who works as Alex Cipher. You talk to the person reading your code, not an account manager. That is also the limit of the offer — I take a small number of retainers at a time so each one gets a real turnaround.
Contact
Tell me what you're shipping
No form, no sales sequence, no discovery deck. Pick whichever of these you would actually use.
Telegram
@Alex_Cipher
The fastest way to reach me, and the one most teams I work with prefer. Send a message, no introduction needed.
hello@alexcipher.xyz
Best for a longer brief. The button opens a short prefilled message — three lines, and you can delete any of them.
X (DMs open)
@_AlexCipher
Fastest for a quick question, a slot check, or if you would rather not use email at all.
Book a scoping call
30 minutes, or longer if we need it
If you would rather talk it through. We go over what you have deployed and how often you ship, and you get a number on the call. It is booked as 30 minutes but there is no hard stop — we can take as long as you need.
Helpful, but not required
Send these three and I can usually quote in the first reply. Send none of them and just say hello — that works too.
- Your repo link or deployed contract addresses
- The chain you are on
- Roughly how often you ship contract changes
You are messaging me, not a form or an assistant. I answer everything myself — usually the same day, always within one business day.
If your scope is outside what I cover, I will tell you that instead of taking the work.