Cowrie Research

oxorio-primary-sources-2026-05-04

3 min read

Oxorio primary sources — 2026-05-04

Project status in this pass

  • No canonical standalone Oxorio whitepaper or litepaper surfaced.
  • The clearest current sources of truth were the official site, the smart-contract-audits page, the public-audits repository, and Oxorio’s 2023 security-report post.
  • Oxorio is best understood as public security-review infrastructure with an interactive reporting layer, rather than as a simple private audit shop.

Primary-source snapshots

1) Official company positioning

  • URL: https://oxor.io/
  • Key excerpt:
    • The homepage presents Oxorio as a smart-contract-audit and security-solutions provider.
    • It lists services including smart-contract audits, code review, penetration testing, incident reports, formal verification, and zero-knowledge solutions.
    • It also advertises cumulative metrics such as more than 103k audited non-comment lines, 1,174 reported issues, and more than $25B in audited TVL.

2) Smart-contract-audits page and methodology

  • URL: https://oxor.io/audits
  • Key excerpt:
    • The page says Oxorio audits Solidity, Cairo, Rust, and Vyper systems and works across Layer 2, zero-knowledge, and EVM-based solutions.
    • It distinguishes among code review, pre-audit, full smart-contract audit, and subscription-audit services, with different scope, duration, and outcome profiles.
    • It also says audits extend beyond the immediate contract scope to include interactions with other modules or systems, deployment scripts, contract updates, and off-chain infrastructure, and that clients receive interim reports every 1–2 weeks.
    • The page highlights an interactive reporting system where clients can track each finding’s severity, code location, and status.

3) Public audit corpus

  • URL: https://raw.githubusercontent.com/oxor-io/public_audits/master/README.md
  • Key excerpt:
    • The repository is titled “Oxorio Public Audit Portfolio” and says Oxorio specializes in smart contracts, zk solutions, and security consulting.
    • It says all reports are published with client consent.
    • The repository lists a substantial public corpus including engagements for Lido, Aave, Privacy Pools, Altitude, WisdomTree, and others, often with both PDF report links and web-report links.
    • This is the clearest first-party evidence that Oxorio operates a reusable public audit-report surface rather than only private service work.
  • URL: https://oxor.io/blog/2024-01-24-oxorio-2023-security-report/
  • Key excerpt:
    • The post says Oxorio audited 46,764 lines of code in 2023 and identified 529 vulnerabilities.
    • It uses those results to synthesize broader industry security narratives including rollups, liquid staking, bridge failures, and the need for formal verification and pentesting.
    • This matters because it shows Oxorio turning audit output into a reusable first-party research product for the broader ecosystem.

Working conclusion

Oxorio is best cataloged as public audit-report and security-review infrastructure. The deciding evidence in this pass was the combination of a broad multi-service security practice, explicit support for interactive web reports, a client-consented public audit repository spanning recognizable protocols, and a first-party annual research report that generalizes lessons from its audit corpus into ecosystem security analysis. That package looks more like a reusable security distribution layer than a simple audit boutique.

Graph View