Hexens

• Name: Hexens
• URL: https://hexens.io/
• Category: web3 security and cryptography research company / public audit-report infrastructure / smart-contract analysis tooling company
• Tags: ethereum-ecosystem
• Summary: Hexens belongs in companies/ because the useful cut is not a standalone protocol or app. It is a named security company that publishes a large first-party archive of audit reports, curates niche cryptography-attack research, and ships analyst tooling such as piller and Glider query-writing materials. The practical leverage sits in review methodology, report publication, detector and query ergonomics, and how the firm packages security research into reusable workflow infrastructure for downstream teams.
• What it does:
  • Publishes a first-party public archive of smart-contract audit reports and security reviews across major protocols and infrastructure projects
  • Maintains research and tooling repositories such as awesome-fhe-attacks, piller, and glider-skills, which broaden the firm beyond one-off audit delivery
  • Packages Solidity-analysis workflow guidance for AI coding assistants through the Glider query-writing skill and related documentation
  • Uses its GitHub organization as a substantive primary-source surface for present tooling, research posture, and public-review history
• Key claims:
  • The GitHub organization highlights Smart-Contract-Review-Public-Reports, awesome-fhe-attacks, piller, and glider-skills, which is strong first-party evidence that Hexens spans public review work, niche cryptography research, and reusable analysis tooling rather than only private consulting
  • The public-reports repository README says it contains the smart-contract audit reports and security reviews performed by Hexens, making report publication itself part of the company surface
  • The awesome-fhe-attacks README says it is a curated list of research, articles, tools, and resources focused on attacks against fully homomorphic encryption, which shows Hexens maintaining reusable security research infrastructure outside ordinary smart-contract auditing
  • The glider-skills README says it is an AI agent skill for writing Glider queries for Solidity smart-contract security analysis and that it was built by Hexens, which makes analyst enablement part of the company boundary
  • The official site was still protected by a Cloudflare challenge during this pass, so the clearest first-party technical evidence remained the GitHub organization and repository READMEs rather than the marketing site alone
• Whitepaper: No classic standalone Hexens whitepaper is the important artifact here. The clearest current primary materials are the GitHub organization plus the public-reports, FHE-research, and Glider-skill repositories; the broader source bundle remains ../whitepapers/hexens-primary-sources-2026-05-02.md.
• Sources:
  • https://hexens.io/
  • https://github.com/Hexens
  • https://github.com/Hexens/Smart-Contract-Review-Public-Reports
  • https://raw.githubusercontent.com/Hexens/Smart-Contract-Review-Public-Reports/main/README.md
  • https://raw.githubusercontent.com/Hexens/awesome-fhe-attacks/master/README.md
  • https://raw.githubusercontent.com/Hexens/glider-skills/main/README.md

Internal linkages

• Project-layer alias: hexens.
• Useful adjacent company reads: trail-of-bits, dedaub, and zksecurity.
• Keep the contrast honest: Hexens is strongest here as a company that packages public reports, research curation, and analyst workflow tooling together under one operator shell.

Protocol / company boundary

• There is no especially useful standalone Hexens protocol boundary doing the work here.
• The important surface is the named company that chooses how audits are scoped and published, which research areas get curated and emphasized, and how analysis tooling or query-writing workflow is exposed to downstream users.
• That is why Hexens belongs in companies/: the practical questions are about methodology, publication, tooling stewardship, and security-workflow packaging rather than about a neutral protocol primitive.

Control surface

• Practical leverage sits in reviewer methodology, what gets published in the public report corpus, how detector or query-writing workflow is taught and packaged, and which security narratives or research clusters the firm chooses to foreground.

• The sticky dependency is not only we bought an audit. It is that teams may adopt Hexens-shaped review norms, public-report expectations, and tooling habits that travel beyond one engagement.

• Read Hexens as a security-workflow and research-packaging company first, not as a standalone protocol or app.

• Last reviewed: 2026-08-08 UTC