OtterSec

• Name: OtterSec
• URL: https://osec.io/
• Category: security-review and verification-infrastructure company / public research and audit-publication operator / Solana build-attestation workflow shell
• Tags: solana-ecosystem
• Summary: OtterSec belongs in companies/, not only projects/, because the useful question is not just which audit did they publish? but which named operator is shaping verified-build workflow, public exploit research, audit publication, and formalization habits that downstream teams may treat as part of their live release boundary? The practical leverage is not limited to advisory prestige. It sits in who decides how deployed-program verification is packaged, which review findings are surfaced publicly, what technical lessons become first-party research canon, and how much of a launch or upgrade workflow hardens around OtterSec-operated tooling and judgment.
• What it does:
  • Performs blockchain security reviews and smart-contract audits for protocols, wallets, foundations, exchanges, and infrastructure teams across multiple chains
  • Publishes first-party exploit research, technical tutorials, and protocol-specific engineering writeups spanning Solana, zkVMs, ERC-4337, Aptos, Cosmos, browser security, and software supply-chain risk
  • Maintains open-source security tooling and verification infrastructure including Solana verifiable-build tooling, an onchain verification program, reverse-engineering utilities, and challenge or testing frameworks
  • Contributes directly to the practical Solana verified-build workflow by shipping tools and docs that help users check whether deployed programs match public source code
  • Packages audit work, report publication, research output, and verification tooling under one company boundary instead of leaving them as unrelated side projects
• Key claims:
  • The homepage says OtterSec has secured more than $36.82BinonchainTVLandpatchedmorethan$1B in vulnerabilities while working with major ecosystems and applications across Solana, Sui, Aptos, Circle, LayerZero, Wormhole, MetaMask, PancakeSwap, Jito, Backpack, and others
  • The homepage frames OtterSec around deep multichain expertise, communication-heavy audit work, and credibility with core ecosystem infrastructure rather than only one-off contract reviews
  • The public blog index is high-signal because it shows a steady stream of first-party exploit research and technical education across smart contracts, verification, virtual machines, authentication, browser bugs, and supply-chain security
  • OtterSec’s 2023 formal-verification case-study post says the team built a prototype for formally verifying security-critical properties of Solana programs, integrating with Anchor and the Kani Rust Verifier to express and check instruction/account invariants
  • The solana-verifiable-build repository says verified builds ensure deployed Solana programs match public source code and documents workflows for repo-based verification plus remote-job submission, which makes OtterSec part of the practical release-attestation pipeline rather than only an external reviewer
  • The otter-verify repository documents an onchain Solana program and PDA-based verification data flow for verifying deployed programs, reinforcing that the company ships verification infrastructure rather than only audit PDFs
• Whitepaper: No classic standalone company whitepaper is the important artifact here. The clearest primary materials are OtterSec’s homepage, public research blog, public reports surface, GitHub organization, and the verified-build / onchain-verification repositories already captured in ../whitepapers/ottersec-primary-sources-2026-04-28.md.
• Sources:
  • https://osec.io/
  • https://osec.io/blog/
  • https://osec.io/blog/2023-01-26-formally-verifying-solana-programs/
  • https://osec.io/reports
  • https://github.com/otter-sec
  • https://raw.githubusercontent.com/otter-sec/solana-verifiable-build/master/README.md
  • https://raw.githubusercontent.com/otter-sec/otter-verify/master/README.md

Internal linkages

• Product-layer note collapsed into alias: ottersec.
• Useful adjacent company reads: trail-of-bits, chainsecurity, and openzeppelin.
• Useful contrast where the emphasis stays more on formal-methods tooling than one review shop’s broader operator shell: certora.

Protocol / company boundary

• There is no especially useful standalone OtterSec protocol doing the analytical work here.
• The meaningful surface is a company-run review-and-verification shell: public audits, first-party exploit research, verified-build tooling, onchain verification workflow, and the release-attestation habits downstream teams inherit when OtterSec becomes part of the deployment process.
• That is why OtterSec belongs in companies/: the practical question is who authors tooling, validation norms, and review outputs that can become part of the effective release boundary even without onchain admin keys.

Control surface

• Practical leverage sits in what OtterSec chooses to formalize into verified-build tools, onchain verification paths, public research framing, report publication, and reusable review expectations.

• The sticky dependency is workflow authority: once a protocol or wallet team relies on OtterSec’s build-attestation tooling, review heuristics, or public security research during launches and upgrades, the company becomes part of the real security-operating perimeter rather than a detached outside advisor.

• Read OtterSec as a security-review and verification-infrastructure company first, not as a neutral protocol primitive.

• Last reviewed: 2026-08-08 UTC