iosiro primary sources — 2026-05-04

Project status in this pass

• No canonical standalone iosiro whitepaper or litepaper surfaced.
• The clearest current sources of truth were the official site, the smart-contract-auditing page, the public audit archive, and first-party vulnerability disclosures.
• iosiro looks broader than a conventional private audit consultancy because its public materials combine current audit output with detailed ecosystem-facing incident research.

Primary-source snapshots

1) Official company positioning

• URL: https://iosiro.com/
• Key excerpt:
  • The homepage prominently markets smart-contract auditing and surfaces featured audit reports directly on the main page.
  • Even from the limited homepage extract, the firm presents blockchain security work as a primary public identity rather than as a side offering within generic cybersecurity.
  • The site navigation and featured-report pattern suggest a standing public security surface, not just a lead-generation page.

2) Smart-contract-auditing service page

• URL: https://iosiro.com/services/smart-contract-auditing
• Key excerpt:
  • The service page says iosiro identifies functional and security issues in smart contracts and delivers comprehensive reports so clients can verify that code behaves as intended.
  • It also frames unaudited mainnet deployment as high risk and positions independent review as a necessary step before production release.
  • This page anchors iosiro’s core identity as a manual security-review provider.

3) Public audit archive

• URL: https://iosiro.com/audits
• Key excerpt:
  • The audit archive lists a continuing stream of crypto reports across 2024-2026, including audits for Paravel Citadel DAO, Wormhole, Nexus Mutual, Synthetix, Infinex, and Kwenta.
  • The archive is valuable because it is not just a logo wall: it exposes named engagements, dates, and per-project report pages.
  • That makes iosiro’s audit output a reusable public reference set for the wider ecosystem.

4) Across bridge double-spend disclosure

• URL: https://iosiro.com/blog/high-risk-bug-disclosure-across-bridge-double-spend
• Key excerpt:
  • The disclosure says an iosiro researcher found a high-risk issue in Across relayer infrastructure that could have enabled deposits to be fulfilled twice by relayers.
  • It says no user funds were at risk, that Risk Labs paused relayers and fixed the issue, and that iosiro received a $90,000 bounty.
  • The writeup includes protocol context, off-chain and on-chain mechanics, and exploit reasoning, which is strong evidence of public-facing security research rather than simple marketing copy.

5) OpenZeppelin UUPS vulnerability disclosure

• URL: https://iosiro.com/blog/openzeppelin-uups-proxy-vulnerability-disclosure
• Key excerpt:
  • The disclosure says iosiro research into an arbitrary delegatecall bug affecting UUPS proxy deployments helped prevent more than $50 million in losses across several affected projects.
  • It explicitly ties the issue to wider ecosystem deployment practices and to OpenZeppelin’s remediation of the affected library.
  • This is especially important because it shows iosiro operating at dependency and ecosystem level, not only at individual client-contract level.

Working conclusion

iosiro is best cataloged as blockchain security research and disclosure infrastructure. The deciding evidence in this pass was the combination of a public audit archive and technically detailed first-party disclosures tied to real protocol incidents and major shared dependencies. That combination makes the firm materially more useful to the ecosystem than a private audit shop whose output stays behind NDAs.