Cowrie Research

ottersec-primary-sources-2026-04-28

2 min read

OtterSec primary sources — 2026-04-28

Project

  • Name: OtterSec
  • URL: https://osec.io/
  • Category: smart-contract security / multichain audit firm / formal-verification and verifiable-build tooling / security-research infrastructure
  • Whitepaper status: No canonical OtterSec whitepaper or litepaper found in this pass.

Primary sources reviewed

  1. Homepage: https://osec.io/

    • Frames OtterSec as a blockchain-security partner with multichain audit experience.
    • Publicly claims 1B+ in vulnerabilities patched.
    • Shows a broad client/reference surface spanning major protocols, wallets, exchanges, and ecosystem foundations.

  2. Blog index: https://osec.io/blog/

    • Shows sustained first-party publication across smart-contract exploits, Solana internals, zkVM issues, ERC-4337 risks, Move/Aptos security, browser bugs, and software supply-chain attacks.
    • Strong signal that the firm operates as a research producer, not just a private services vendor.

  3. Formal verification case study: https://osec.io/blog/2023-01-26-formally-verifying-solana-programs/

    • Describes a prototype for formally verifying Solana programs.
    • Says OtterSec integrated with Anchor and the Kani Rust Verifier to specify instruction/account invariants and auto-generate proof harnesses.
    • Helpful for understanding OtterSec as a formal-methods-capable security shop, not only an audit-report publisher.

  4. Public reports index: https://osec.io/reports

    • Redirects to a public Notion-hosted report index.
    • The rendered content was not easily extractable in this pass, but the official reports URL itself is a useful source for confirming OtterSec maintains a public audit-report surface.

  5. GitHub organization: https://github.com/otter-sec

    • Verified to control the osec.io domain.
    • Exposes public repositories for reverse engineering, Solana verification, verifier APIs, challenge frameworks, and other security tooling.

  6. Solana verified builds README: https://raw.githubusercontent.com/otter-sec/solana-verifiable-build/master/README.md

    • Explains verified builds for Solana programs.
    • Documents repo-based verification flows and remote job submission, with a pointer to official Solana verified-build docs.
    • Strong evidence that OtterSec participates directly in operational verification infrastructure.

  7. Otter Verify README: https://raw.githubusercontent.com/otter-sec/otter-verify/master/README.md

    • Documents an onchain Solana program that stores verification data via a PDA and can itself be verified from source.
    • Reinforces that OtterSec ships verifiable infrastructure and not just consulting output.

Takeaways

  • OtterSec is best cataloged as broader security-and-verification infrastructure rather than as a simple audit boutique.
  • The strongest differentiator is the combination of public exploit research, protocol-specific verification work, and open-source verification tooling.
  • No classic whitepaper appears necessary to understand the project; the blog + GitHub corpus is the real source of truth.

Graph View