iosiro

• Name: iosiro
• URL: https://iosiro.com/
• Category: security company / public audit-report operator / vulnerability-disclosure and blockchain research firm
• Tags: ethereum-ecosystem
• Summary: iosiro belongs in companies/, not projects/, because the useful question is who operates the audit publication, disclosure cadence, and security-research surface that other builders may end up relying on as practical review infrastructure. The leverage is not just reputational. It sits in who decides which reports are public, which incident writeups become reusable learning material, and how much downstream launch or remediation workflow hardens around one named firm’s research and disclosure practices.
• What it does:
  • Performs smart-contract audits and broader cybersecurity work, with the official site centered on blockchain and smart-contract security services
  • Maintains a public archive of audit reports covering live crypto protocols and applications, making report publication part of the company’s persistent external surface
  • Publishes technical vulnerability disclosures and postmortem-style research that explain exploit conditions, affected code paths, remediation timelines, and mitigations
  • Positions its team as hands-on security researchers rather than only report writers, with public disclosures tied to concrete protocol incidents and bounty outcomes
  • Uses the audit archive and disclosure blog together as a reusable public knowledge base that other teams can learn from even when they are not direct customers
• Key claims:
  • The homepage prominently markets smart-contract auditing and surfaces featured crypto audit reports as a core part of iosiro’s public footprint
  • The smart-contract-auditing page says iosiro identifies functional and security issues in smart contracts and provides comprehensive reports intended to verify that code functions as intended
  • The public audits index shows a continuing stream of crypto audit reports across 2024-2026 for projects including Nexus Mutual, Wormhole, Synthetix, Infinex, Kwenta, and others, which makes the company’s publication choices analytically important in their own right
  • iosiro’s disclosure on the Across bridge double-spend issue says an iosiro researcher identified a high-risk vulnerability in Across relayer infrastructure and that Risk Labs awarded a $90,000 bounty after remediation, showing the firm’s work can reach outside private audit engagements into operator-critical infrastructure failures
  • The OpenZeppelin UUPS proxy disclosure says iosiro research helped prevent more than $50 million in losses across affected projects, which is stronger evidence of ecosystem-facing research infrastructure than a normal one-off client report
  • Taken together, the public audit corpus and disclosure posts show iosiro functioning as an operator of reusable security knowledge, not only a private consulting shop
• Whitepaper: No canonical standalone iosiro company whitepaper surfaced in this pass. The clearest current primary materials remain the official site, smart-contract-auditing page, public audit archive, and first-party vulnerability disclosures already captured in ../whitepapers/iosiro-primary-sources-2026-05-04.md.
• Sources:
  • https://iosiro.com/
  • https://iosiro.com/services/smart-contract-auditing
  • https://iosiro.com/audits
  • https://iosiro.com/blog/high-risk-bug-disclosure-across-bridge-double-spend
  • https://iosiro.com/blog/openzeppelin-uups-proxy-vulnerability-disclosure

Internal linkages

• Product-layer note collapsed into alias: iosiro.
• Useful adjacent company reads: trail-of-bits, coinfabrik, and ottersec.
• Useful incident-adjacent read where public disclosure materially improved ecosystem understanding: openzeppelin-uupsupgradeable-uninitialized-implementation-selfdestruct-bricking-near-miss-2021-09-09.

Protocol / company boundary

• There is no especially useful standalone iosiro protocol boundary doing analytical work here.
• The meaningful surface is the company-run security shell: public audit publication, disclosure timing, vulnerability writeups, researcher judgment, and the broader trust teams place in iosiro as a source of remediation guidance and public technical lessons.
• That is why iosiro belongs in companies/: the sharper question is who is operating and publishing security knowledge that shapes other teams’ release and response workflow, not whether one branded service page can be treated as an isolated product.

Control surface

• Practical leverage sits in what iosiro chooses to publish, how it frames exploit mechanics, how it handles coordinated disclosure, and how much downstream engineering or security workflow starts relying on its audit archive and public incident research.

• The company usually does not hold protocol admin keys, but it can still become part of the real assurance perimeter when teams depend on its disclosures, remediation guidance, and published report corpus.

• Read iosiro as a security-research and audit-publication company first, not as a neutral protocol primitive.

• Last reviewed: 2026-08-11 UTC