Cowrie Research

coinfabrik

4 min read

CoinFabrik

  • Name: CoinFabrik
  • URL: https://www.coinfabrik.com/
  • Category: security-review and tooling company / public audit-publication operator / multichain analysis-workflow steward
  • Summary: CoinFabrik belongs in companies/ because the useful question is not just what audit report or static-analysis tool exists? but which named operator turns cross-ecosystem review work, public audit publication, and CoinFabrik-authored developer tooling into workflow truth other teams may start treating as part of their security baseline. The practical leverage sits in who scopes and publishes the audit corpus, which vulnerability patterns get encoded into tools like Scout and Stacy, and how much downstream review workflow starts depending on CoinFabrik’s company-run methodology rather than on a neutral protocol surface.
  • What it does:
    • Performs smart-contract and protocol security reviews across Solidity, Rust, Clarity, Soroban, Go, Substrate, and adjacent stacks
    • Publishes a large first-party public audit corpus through its website and GitHub audit-report repositories
    • Maintains open-source security tooling including Scout for ink!, Soroban, and Substrate, plus Stacy for Clarity-focused analysis
    • Packages security work together with broader blockchain development, advisory, QA, and R&D efforts under one company boundary rather than leaving audits and tooling as detached side projects
    • Extends its security posture through grants, academic collaboration, and ecosystem-specific research work that can influence what non-EVM teams treat as standard review practice
  • Key claims:
    • The current homepage says CoinFabrik has spent 10 years securing the ecosystem, backs its work with 500+ successful projects, and highlights both security audits and open-source developer tools, which is strong evidence that the company wants audits and tooling read as one operator surface rather than as unrelated artifacts
    • The smart-contract-audits page currently advertises +10B Secured Assets, +350 Security Audits, +9K Vulnerabilities Detected, and 10 Years in the Market, reinforcing that CoinFabrik is not a marginal boutique but a scaled review and publication shop
    • That audit-services page also documents a four-step workflow of code submission, private report, client fixes, and optional public report publication, which matters because report-publication policy is part of the company-run assurance boundary
    • The public audits README shows a structured multiyear corpus spanning clients and ecosystems including Stacks, Paxos, THORChain, 1inch, Fireblocks, Soroban projects, and Substrate work, which makes CoinFabrik’s public-report archive a durable ecosystem artifact rather than marketing residue
    • Scout’s README says the tool is an extensible open-source security-analysis tool for ink!, Soroban, and Substrate developers and auditors, with CI, VS Code, and multi-format reporting support, showing CoinFabrik is authoring reusable developer workflow rather than only delivering PDFs
    • The homepage now also highlights Stacy and Scout in the Tools for Developers section, which is useful evidence that CoinFabrik is packaging productized security tooling directly alongside its audit business
  • Whitepaper: No classic standalone company whitepaper is the important artifact here. The clearest current source of truth is the homepage, smart-contract-audits page, public audits corpus, and Scout README captured in ../whitepapers/coinfabrik-company-primary-sources-2026-08-08.md.
  • Sources:

Internal linkages

Protocol / company boundary

  • Keep CoinFabrik in companies/ because the analytically important surface is the named entity that packages audit workflow, report publication, developer tooling, and research posture into one reusable security shell.
  • There is no especially useful standalone CoinFabrik protocol doing the main analytical work here. Even Scout and Stacy are better read as company-authored tooling branches inside a broader review-and-publication boundary.
  • That split matters because what does Scout detect? and who decides how the audit corpus, detectors, grants, publication workflow, and multichain review posture evolve? are related but not identical questions.

Control surface

  • Practical leverage sits in which bug classes CoinFabrik chooses to formalize into detectors, which ecosystems get sustained public audit coverage, how findings are summarized and published, and how much downstream teams treat CoinFabrik reports or tooling as part of a real release gate.

  • The sticky dependency is workflow authority: once a team relies on CoinFabrik’s published reports, Scout output, or Clarity / Soroban / Substrate-specific review heuristics, the company becomes part of the effective security-operating perimeter even without onchain admin keys.

  • Read CoinFabrik as a security-review and tooling company first, not as a neutral protocol primitive or one isolated analyzer.

  • Last reviewed: 2026-08-08 UTC

Graph View

Backlinks