Sec3

• Name: Sec3
• URL: https://sec3.dev/
• Category: Solana security company / static-analysis and public-report operator / formal-methods-heavy review workflow shell
• Tags: solana-ecosystem
• Summary: Sec3 belongs in companies/, not only projects/, because the useful question is not just which audit did they publish? but which named operator turns formal-methods-heavy review, static-analysis rule coverage, public-report publication, IDL recovery, and post-deployment monitoring into part of the practical Solana security workflow? The practical leverage is not limited to advisory prestige. It sits in who defines the X-Ray scanning surface, publishes the audit corpus, maintains IDLGuesser and monitoring utilities, and packages launch or upgrade support into a company-run operating shell that downstream teams may start treating as part of their release boundary.
• What it does:
  • Performs security audits, formal verification, and launch-or-upgrade security support centered on Solana-heavy protocols and infrastructure
  • Publishes a large public audit-report archive that functions as a reusable Solana review corpus rather than only one-off marketing collateral
  • Maintains X-Ray, an open-source static-analysis toolchain for Solana programs and smart contracts written in Rust, plus a production version with broader scanning coverage
  • Maintains IDLGuesser for recovering instruction layouts from closed-source Anchor-based Solana programs compiled to sBPF bytecode
  • Offers free nonce-staging and multisig-configuration monitoring, pushing Sec3 further into post-deployment operational-assurance workflow rather than pure pre-launch review
  • Packages those report, tooling, monitoring, and launch-support surfaces under one company boundary instead of leaving them as unrelated side projects
• Key claims:
  • The homepage frames Sec3 around Security for Solana Protocols, pairing PhD-led academic rigor and elite competitive security expertise, which is analytically useful because it shows the company selling a combined formal-methods-plus-adversarial workflow rather than a generic audit brand
  • The homepage says Sec3 provides security audits, formal verification, open-source static analysis, IDL recovery tooling, free nonce and multisig monitoring, a Solana ecosystem report, and broader launch support under SecLaunch, which is strong first-party evidence that several practical security surfaces sit inside one named operator shell
  • The X-Ray README says the toolchain parses Rust programs, lowers them to LLVM IR, and applies static analysis with built-in rules for issues such as integer overflows, unverified parsed accounts, type confusion, bump-seed validation failures, insecure PDA sharing, and arbitrary CPI, which shows Sec3 packaging real detection coverage rather than just publishing opinions
  • The X-Ray README also says Sec3 offers a production version with a more comprehensive rule set, which means rule coverage and scanning depth remain company-shaped even when the open-source tool exists
  • The public sec3-service/reports repository says it contains audit reports and publications that Sec3 makes available once clients decide to publish them; the repo currently spans a long list of Solana and adjacent engagements including Kamino, Huma, Wormhole, Metaplex, Helium, UXD, Jupiter, Pyth, and others, making the report archive itself a meaningful company-run review corpus
  • The homepage’s free monitoring offer for nonce staging and multisig configuration changes is high-signal because it pushes Sec3 into live operational-assurance workflow, not only code review
• Whitepaper: No classic standalone company whitepaper is the important artifact here. The clearest primary materials are the official homepage, the public reports repository, and the X-Ray / IDLGuesser repositories already captured in ../whitepapers/sec3-primary-sources-2026-04-28.md.
• Sources:
  • https://sec3.dev/
  • https://sec3.dev/report
  • https://github.com/sec3-service/reports
  • https://github.com/sec3-product/x-ray
  • https://raw.githubusercontent.com/sec3-product/x-ray/master/README.md
  • https://github.com/sec3-service/IDLGuesser

Internal linkages

• Product-layer note collapsed into alias: sec3.
• Useful adjacent company reads: ottersec, chainsecurity, and verichains.
• Useful contrast where the emphasis stays more on formal-methods tooling than one review shop’s broader operator shell: certora.

Protocol / company boundary

• There is no especially useful standalone Sec3 protocol doing the analytical work here.
• The meaningful surface is a company-run review-and-assurance shell: public audits, X-Ray rule coverage, IDL recovery, post-deployment monitoring, launch support, and the security heuristics downstream teams inherit when Sec3 becomes part of the release process.
• That is why Sec3 belongs in companies/: the practical questions are about who authors tooling, decides scanning depth, publishes reports, and turns security judgment into launch-or-don’t-launch operational truth.

Control surface

• Practical leverage sits in what Sec3 chooses to formalize into X-Ray rules, production-only scanning coverage, IDL recovery workflow, public-report publication, nonce and multisig monitoring, and release-readiness expectations.

• The sticky dependency is workflow authority: once a protocol or wallet team hardens around Sec3-authored scan results, monitoring hooks, report expectations, or launch support, the company becomes part of the effective security-operating perimeter even without holding onchain admin keys.

• Read Sec3 as a security-review and operational-assurance company first, not as a neutral protocol primitive.

• Last reviewed: 2026-08-09 UTC