Cowrie Research

sec3-primary-sources-2026-04-28

2 min read

Sec3 primary sources — 2026-04-28

Project

  • Name: Sec3
  • URL: https://sec3.dev/
  • Category: Solana security / formal-methods-driven audit firm / static-analysis tooling / public audit-report infrastructure
  • Whitepaper status: No canonical Sec3 whitepaper or litepaper found in this pass.

Primary sources reviewed

  1. Homepage: https://sec3.dev/

    • Frames Sec3 directly around Solana security, audits, and formal verification.
    • Emphasizes a dual model of “academic core” plus “adversarial core,” including PhD-led formal-methods work and elite competitive-security expertise.
    • Names a substantial set of Solana ecosystem clients and exposes extra surfaces like open-source tooling, free monitoring, a year-end report, and SecLaunch.

  2. Solana Security Ecosystem Review 2025: https://sec3.dev/report

    • Provides first-party quantitative research rather than just marketing copy.
    • Claims 163 security reviews examined, 1,669 vulnerabilities recorded, and 99.4% of audits identifying vulnerabilities.
    • Useful evidence that Sec3 positions itself as a research-and-measurement organization in addition to a services firm.

  3. GitHub organization (sec3-service): https://github.com/sec3-service

    • Confirms an official public repo surface.
    • Exposes repositories for IDLGuesser, Owl-LM, and public reports.
    • Helps show the company publishes tooling and research artifacts, not just private client work.

  4. Public reports repository: https://github.com/sec3-service/reports

    • Lists many public audit reports from 2022 through 2026.
    • Shows strong concentration in Solana while also surfacing work across Solidity, Sei, TON, Radix/Scrypto, and web2 contexts.
    • Strong evidence that Sec3 has real ecosystem penetration and a sustained public-report footprint.

  5. X-Ray repository: https://github.com/sec3-product/x-ray

    • Describes an open-source CLI toolchain for static analysis of Solana programs and Rust smart contracts.
    • Explains the technical pipeline: Rust parsing, AST generation, LLVM-IR conversion, then rule-based static analysis.
    • Important for understanding Sec3 as tooling infrastructure, not only an audit brand.

  6. IDLGuesser repository: https://github.com/sec3-service/IDLGuesser

    • Officially described on the Sec3 homepage and GitHub org as an open-source tool for recovering IDL information from closed-source Anchor-based Solana programs.
    • Useful as additional evidence of reverse-engineering and analysis tooling beyond standard audit PDFs.

Takeaways

  • Sec3 is best cataloged as Solana security-and-tooling infrastructure with a strong formal-methods orientation.
  • The combination of public audit reports, open-source analysis tools, reverse-engineering utilities, and ecosystem-level statistics makes the company meaningfully broader than a services-only audit boutique.
  • The strongest current source-of-truth surface is the homepage plus GitHub footprint, rather than any single whitepaper.

Graph View