Quantstamp primary sources — 2026-04-30

Project status in this pass

• No canonical standalone whitepaper or litepaper surfaced.
• The clearest current source of truth is the official site, service pages, audit-readiness material, Chainproof launch post, and first-party GitHub repositories.

Primary-source snapshots

1) Official homepage

• URL: https://quantstamp.com/
• Key excerpt:
  • Says Quantstamp has worked with recognized web3 names since 2017 and has audited Layer 1s, Layer 2s, DeFi protocols, NFT marketplaces, exchanges, and clients.
  • Says Quantstamp provides managed security services for continuous security and monitoring post-deployment.
  • Also says its insurance product Chainproof secures customers against smart-contract hacks and slashing risks.

2) Audits page

• URL: https://quantstamp.com/audits
• Key excerpt:
  • Describes the core audit workflow as intake, scoping, a customized quote, kickoff, an initial report, remediation, and a final report.
  • Thin page, but useful for confirming the structured audit process.

3) Infrastructure audits page

• URL: https://quantstamp.com/infrastructure-audits
• Key excerpt:
  • Explicitly says web3 consists of smart contracts plus surrounding Web2 architecture and that a single misconfigured server, API, or cloud component can undermine secure contracts.
  • Frames the service as a review using both automated scanning and manual penetration testing.
  • Names APIs, cloud providers, node operators, SaaS platforms, and other offchain critical components as relevant targets.

4) Economic exploitability page

• URL: https://quantstamp.com/economic-exploits
• Key excerpt:
  • Positions flash-loan and DeFi-mechanics risk as a class of issues that can evade conventional audits.
  • Says Quantstamp partnered with researchers to turn that research into a production-level automated tool for detecting flash-loan attacks.
  • This is an important clue that Quantstamp’s security surface includes economic-analysis tooling, not only code review.

5) Audit readiness guide

• URL: https://quantstamp.com/audit-readiness-guide
• Key excerpt:
  • Explains what a security audit is, why audits should happen before mainnet deployment, and why follow-up audits matter after upgrades.
  • Says Quantstamp allocates a minimum of three audit engineers per project and mixes manual auditing with proprietary tooling.
  • Describes the iterative workflow: preliminary report, remediation period, fix review, and final report, while also pointing to public reports at certificate.quantstamp.com.

6) Responsible disclosure policy

• URL: https://quantstamp.com/legal/responsible-disclosure
• Key excerpt:
  • Documents a formal vulnerability-reporting and reward process.
  • Scopes *.quantstamp.com as in-scope and lists prohibited or out-of-scope behaviors.
  • Useful evidence that Quantstamp operates its own vulnerability-intake / bounty-style process, not just client-facing audits.

7) Chainproof launch post

• URL: https://quantstamp.com/blog/chainproof
• Key excerpt:
  • Says Chainproof was incubated by Quantstamp and positioned as the world’s first regulated smart-contract insurance provider for non-custodial smart contracts.
  • Notes backing by Sompo and reinsurance support from Munich Re.
  • Important because it shows Quantstamp extending into underwriting/risk-transfer infrastructure around smart-contract security.

8) Rollup Security Framework repository

• URL: https://raw.githubusercontent.com/quantstamp/l2-security-framework/master/README.md
• Key excerpt:
  • Describes research carried out by Quantstamp researchers and funded by Quantstamp plus an Ethereum Foundation grant.
  • Frames the repository as a framework for assessing rollup security, attack vectors, escape hatches, bridges, sequencers, validators, data availability, and operational risk.
  • This is strong evidence of a public research footprint beyond client audit marketing.

9) ERC4337 Checker repository

• URL: https://raw.githubusercontent.com/quantstamp/erc4337-checker/master/README.md
• Key excerpt:
  • Describes a tool for validating ERC-4337 limitations around forbidden opcodes and disallowed storage access.
  • Intended for use as a Foundry-test dependency against the reference account-abstraction implementation.
  • This shows Quantstamp publishing concrete developer-facing security tooling, not only PDF reports.

Working conclusion

Quantstamp is best cataloged as a multi-surface web3 security platform spanning audits, infrastructure testing, exploit analysis, and public security tooling. In this pass, the service pages plus GitHub research/tooling surface were much more revealing than the thin audits landing page alone.