Blockchain Security
Security reviews for blockchains, protocols, nodes and bridges.
Find the flawbeforeattackers do.
Hylox Security protects blockchain projects end to end: blockchain security, smart contract auditing, penetration testing, threat detection, consulting, KYC verification and legal opinions.
Manual code reviewAuditors read your code line by line.
Severity-ranked findingsKnow exactly what to fix first.
Fixes re-checkedEvery fix confirmed before the final report.
Part of Ecrox GroupThe security company of a blockchain group.
One bug can cost everything. Find it first.
Smart contracts hold real money and cannot be patched quietly after launch. A single missed check can drain a project in minutes.
Hylox reviews your code, systems and team before launch, so the problems are found by us, not by an attacker.
Launching without a review
- Vulnerabilities
- Found by attackers
- Investors and exchanges
- Ask for proof you can’t show
- Fixes
- Made under pressure after a loss
Launching with Hylox
- Vulnerabilities
- Found and fixed before launch
- Investors and exchanges
- A published report and KYC certificate
- Fixes
- Planned, tested and re-checked
What we do
Seven services that protect your project, from code to company.
Security and auditing
Smart Contract Auditing
Manual, line-by-line audits of your contracts before launch.
Penetration Testing
Attacker-style testing of your apps, APIs and infrastructure.
Threat Detection
Monitoring and alerts for suspicious on-chain and system activity.
Advisory and compliance
Cybersecurity Consulting
Architecture reviews, threat models, policies and training.
KYC Verification
Identity verification of project teams for investors and exchanges.
Legal Opinion
Formal legal opinions on tokens, often needed for exchange listings.
How an audit works
Step 1
Scope and quote
Share your code, documentation and deadline. We agree the scope, timeline and price.
Step 2
Review
Our auditors review the code by hand, supported by automated analysis and testing.
Step 3
Draft report
You receive every finding with its severity, impact and how to fix it.
Step 4
Fix and re-check
Your team fixes the issues. We check each fix and look for new problems.
Step 5
Final report
You get a final report showing the status of every finding, ready to publish.
5severity levels
in every report
in every report
Reports your team can act on.
Every finding comes with a severity, a plain explanation of the risk, where it is in the code and how to fix it. Then we check the fix.
Severity scale
| Severity | What it means |
|---|---|
| Critical | Funds can be stolen or permanently lost, or the system can be taken over. Fix before launch. |
| High | Serious loss or disruption is possible under realistic conditions. Fix before launch. |
| Medium | Harm is possible but limited, or needs unusual conditions. Fix soon. |
| Low | Minor issue with little direct impact. Fix when convenient. |
| Informational | Best-practice and code-quality notes. No direct risk. |
What a finding looks like
An illustrative example from a smart contract audit.
41function withdraw(uint256 amount) external {42 require(balances[msg.sender] >= amount, "Insufficient");43 (bool ok, ) = msg.sender.call{value: amount}("");44 require(ok, "Transfer failed");45 balances[msg.sender] -= amount; // updated after the call46}
Reentrancy in withdraw()
The contract sends funds before it reduces the caller’s balance.
- Impact
- A malicious contract can call withdraw() again during the transfer and drain the vault.
- Recommendation
- Reduce the balance before the external call, or add a reentrancy guard.
- Status
- Fixed Verified in the re-check
Common questions
What does Hylox Security do?
Blockchain security, smart contract auditing, penetration testing, threat detection, cybersecurity consulting, KYC verification and legal opinions.
How long does an audit take?
It depends on the size and complexity of your code. Share your repository and deadline and we will include a timeline with the quote.
How much does an audit cost?
Pricing depends on scope. Send your code and documentation through the request form for a quote.
Do you check our fixes?
Yes. Every audit includes a re-check of the fixes for the findings in our report.
What is KYC verification for projects?
We verify the identity of a project’s core team and issue a KYC certificate, so investors and exchanges know accountable people are behind it. Personal documents stay private.
Who writes your legal opinions?
Legal opinions are prepared and signed by qualified lawyers in the relevant jurisdiction.
Good to know. An audit greatly reduces risk but cannot guarantee code is free of vulnerabilities. Findings apply to the code version reviewed. Legal opinions are prepared and signed by qualified lawyers.
Launching soon? Book your audit.
Share your code, documentation and deadline. We reply with a scope, timeline and quote.