QuillAudits

• Name: QuillAudits
• URL: https://www.quillaudits.com/
• Category: blockchain security company / public audit-report operator / exploit-research and auditor-education surface
• Summary: QuillAudits belongs in companies/, not projects/, because the useful question is not whether QuillAudits names a protocol. It is which named security company packages lifecycle security services, a large public audit-report corpus, exploit research, resource curation, academy training, and CTF-style education into one operator shell. The practical leverage sits in who defines review posture, who publishes the reusable corpus, and who shapes auditor education and monitoring expectations around that corpus.
• What it does:
  • Provides security services spanning design review, threat modeling, smart-contract and protocol audits, operational-security review, and post-audit monitoring
  • Publishes a large public repository of smart-contract audit reports under the Quillhash GitHub organization
  • Produces exploit and security-breach research such as its H1 2025 crypto exploits report
  • Maintains public educational and reference repositories including a smart-contract-auditor roadmap, Solidity attack-vector catalog, and web3-security-tools index
  • Operates adjacent academy and CTF training surfaces under the QuillAudits brand
• Key claims:
  • The homepage frames QuillAudits as securing protocols across the full lifecycle with design security, AI-driven risk detection, adversarial audits, operational review, and live monitoring, which is company-shaped workflow packaging rather than a protocol surface
  • The homepage explicitly highlights design-security advisory work, AI-powered vulnerability scanning, a Vigilant Squad model with 10-12 independent researchers per audit, and monitoring for signer anomalies, governance proposals, timelock changes, and unusual admin calls
  • The official GitHub organization describes QuillAudits as a leading smart-contract audit firm and claims a large audited-project footprint plus a public audit-report corpus, which matters because public report publication is part of the firm’s durable surface
  • The dedicated audit-reports repository positions QuillAudits as maintaining a reusable public-report library rather than publishing occasional marketing PDFs, and it emphasizes manual plus automated review, documentation alignment, gas optimization, and code-quality analysis
  • The H1 2025 exploits report shows the firm also operates a public research layer around exploit classification and incident interpretation
  • The Smart Contract Auditor Roadmap, Solidity Attack Vectors repository, and Web3 Security Tools repository show a persistent first-party education and resource-curation footprint around training auditors and developers
• Whitepaper: No classic standalone QuillAudits company whitepaper is the point here. The clearest current primary materials are the official site, the GitHub organization and audit-report repository, the first-party research pages, and Quillhash educational and resource repositories; see ../whitepapers/quillaudits-primary-sources-2026-05-02.md.
• Sources:
  • https://www.quillaudits.com/
  • https://github.com/quillaudits
  • https://github.com/Quillhash/QuillAudit_smart_contract_audit_Reports
  • https://www.quillaudits.com/reports/crypto-exploits-h1-report-2025
  • https://github.com/Quillhash/QuillAudit_Smart_contract_Auditor_Roadmap
  • https://github.com/Quillhash/Solidity-Attack-Vectors
  • https://github.com/Quillhash/Web3-Security-Tools
  • https://www.quillaudits.com/academy
  • https://www.quillaudits.com/academy/ctf

Internal linkages

• Product-layer alias note: quillaudits.
• Useful adjacent company reads: ackee-blockchain, audita, and trail-of-bits.
• Useful contrast where the emphasis stays more on formal methods or release-gating artifacts than a broad public research-and-training shell: certora and chainsecurity.

Protocol / company boundary

• There is no especially useful standalone QuillAudits protocol boundary doing the analytical work here.
• The meaningful surface is the company-run mix of audits, monitoring posture, exploit research, public report publication, and academy/resource stewardship.
• That is why QuillAudits belongs in companies/: the sharper questions are who defines the review and monitoring model, who curates the report and exploit corpus, and who shapes auditor education through first-party training materials.

Control surface

• Practical leverage sits in review methodology, monitoring claims, exploit taxonomy, report-publication policy, and the educational materials that turn QuillAudits’ preferred security framing into reusable downstream workflow.

• The company does not directly control the protected protocols, but it can influence what gets audited, which failure modes receive attention, and which heuristics become sticky through its public corpus and academy materials.

• Read QuillAudits as a company-run security-review, exploit-research, and education boundary first, not as a neutral protocol primitive.

• Last reviewed: 2026-08-12 UTC