Guardian Audits

• Name: Guardian Audits
• URL: https://guardianaudits.com/
• Category: smart-contract security company / dual-team review operator / invariant-fuzzing and report-publication surface
• Summary: Guardian Audits belongs in companies/, not projects/, because the useful question is not whether Guardian names a protocol. It is which named security company packages a two-team review model, invariant-driven fuzzing, remediation re-review, a public audit archive, and Solidity Lab education into one operator shell that downstream teams may start treating as part of their normal assurance baseline.
• What it does:
  • Performs smart-contract audits for DeFi, NFT, and infrastructure teams with an explicitly multi-phase review and remediation process
  • Uses a two-team review model in which separate security researchers independently review the same codebase
  • Builds stateful fuzzing and invariant-testing suites as a core part of engagements rather than treating fuzzing as an optional add-on
  • Re-audits remediations and re-runs fuzzing during a dedicated remediation review window before finalizing the report
  • Maintains a large public GitHub audit archive spanning protocols such as GMX, Baseline Markets, Ethena, Dolomite, Foil, Gamma Strategies, and others
  • Operates Solidity Lab, a public learning community and knowledge base around Solidity attack vectors, common bugs, and auditor education
• Key claims:
  • The homepage says Guardian uses two independent teams of security researchers reviewing the same contracts, which is the clearest first-party sign that the firm is selling a methodology boundary rather than only staffing hours
  • The homepage says every engagement includes a comprehensive stateful fuzzing suite and presents that as the way Guardian finds issues that manual review can miss
  • The homepage says all remediations are reviewed by both teams independently and fuzzed again before the report is finalized, which makes the remediation loop part of the firm’s durable workflow surface
  • The homepage FAQ says public reports are posted on Guardian’s GitHub when disclosure is allowed, and the case-studies page shows named work across major DeFi and infrastructure clients
  • The Solidity Lab repository says the community exists to help developers and auditors learn Solidity security through attack-vector references, handbooks, practice audits, and shadow-audit opportunities, which gives the company a real education layer beyond paid engagements
• Whitepaper: No classic standalone Guardian Audits company whitepaper is the point here. The clearest current primary materials are the official site, case-studies page, public GitHub organization and audit repository, the invariant-testing blog post, and the Solidity Lab repository; see ../whitepapers/guardian-audits-primary-sources-2026-05-07.md.
• Sources:
  • https://guardianaudits.com/
  • https://guardianaudits.com/case-studies
  • https://guardianaudits.com/blog/why-audited-teams-are-getting-hacked
  • https://github.com/GuardianAudits
  • https://github.com/GuardianAudits/Audits
  • https://github.com/GuardianAudits/SolidityLab
  • https://raw.githubusercontent.com/GuardianAudits/SolidityLab/main/README.md

Internal linkages

• Product-layer alias note: guardian-audits.
• Useful adjacent company reads: ackee-blockchain, audita, and trail-of-bits.
• Useful contrast where formal methods or release gating weigh more heavily than one firm’s review choreography: runtime-verification and chainsecurity.

Protocol / company boundary

• There is no especially clean standalone Guardian protocol boundary doing the analytical work here.
• The meaningful surface is the company-run mix of dual-team review structure, invariant-fuzzing workflow, remediation verification, public report publication, and Solidity Lab education.
• That is why Guardian Audits belongs in companies/: the sharper questions are who owns the review ceremony, who decides what invariant coverage looks like, and who teaches or publishes the downstream security heuristics other teams may inherit.

Control surface

• Practical leverage sits in review choreography, invariant selection, remediation sign-off, report-publication policy, and the education materials that make Guardian’s preferred audit habits portable.

• The company does not directly control the protected protocols, but it can shape what categories of failure get caught, which findings are emphasized, and which assurance rituals become normalized across teams that copy its workflow.

• Read Guardian Audits as a company-run review-methodology, fuzzing, and report-publication boundary first, not as a neutral protocol primitive.

• Last reviewed: 2026-08-12 UTC