SlowMist primary sources — 2026-04-30

Project status in this pass

• No canonical standalone company whitepaper or litepaper surfaced.
• The clearest current source of truth is the official site and service pages plus the public GitHub organization, vulnerability-advisory corpus, threat-intelligence tooling repos, and open security-guidance materials.

Primary-source snapshots

1) Official homepage / about page

• URLs:
  • https://www.slowmist.com/
  • https://www.slowmist.com/about-us.html
• Key excerpt:
  • The site describes SlowMist as a blockchain-security and threat-intelligence firm founded in January 2018 by a team with more than ten years of network-security experience.
  • The about page says the company provides auditing, blockchain threat intelligence, defense deployment, and a suite of SaaS security products including MistTrack, SlowMist KYT, MistEye, fake-deposit scanning, and SlowMist Hacked.
  • The same page says its cryptocurrency-crime investigation work has been cited by international organizations and government bodies including the United Nations Security Council and the United Nations Office on Drugs and Crime.

2) Smart-contract audit service page

• URL: https://www.slowmist.com/service-smart-contract-security-audit.html
• Key excerpt:
  • The page exposes a detailed audit taxonomy across token, DeFi, RWA, Move, Solana, and EOS environments.
  • It lists many concrete issue classes such as access-control problems, reentrancy, flash loans, forged-account attacks, replay attacks, malicious event logs, arithmetic accuracy deviations, authority vulnerabilities, and protocol-specific logic risks.
  • This level of public taxonomy makes the service page itself a meaningful primary technical artifact.

3) Web3 Project Security Practice Requirements

• URLs:
  • https://github.com/slowmist/Web3-Project-Security-Practice-Requirements
  • https://raw.githubusercontent.com/slowmist/Web3-Project-Security-Practice-Requirements/main/README.md
• Key excerpt:
  • The README says attacks against Web3 projects are constant and complex, and that most teams lack the energy or experience to build a complete security system on their own.
  • It says SlowMist open-sourced Web3 Project Security Practice Requirements to help teams establish and improve their own security systems rather than depending only on a short-term audit.
  • The guide covers development preparation, coding requirements, test coverage, CI/CD, frontend hardening, server-environment security, and release-process controls.

4) Auditor-learning roadmap

• URLs:
  • https://github.com/slowmist/SlowMist-Learning-Roadmap-for-Becoming-a-Smart-Contract-Auditor
  • https://raw.githubusercontent.com/slowmist/SlowMist-Learning-Roadmap-for-Becoming-a-Smart-Contract-Auditor/main/README.md
• Key excerpt:
  • The README says the document is a compilation of the abilities required for SlowMist smart-contract security auditors.
  • It publishes a large public roadmap spanning blockchain basics, Solidity, common vulnerabilities, DeFi risk, audit reports, bug bounties, EVM internals, gas optimization, and incident analysis.
  • This is strong evidence that public security education is part of SlowMist’s ecosystem footprint.

5) Vulnerability-research advisories

• URLs:
  • https://github.com/slowmist/papers
  • https://raw.githubusercontent.com/slowmist/papers/master/README.md
  • Supporting API: https://api.github.com/repos/slowmist/papers
• Key excerpt:
  • The repository describes itself as SlowMist Vulnerability Research Advisories.
  • Its README links to vulnerability writeups and PDFs covering Ethereum ecosystem defects, uninitialized storage pointers, EOSIO P2P attacks, random-number attacks, and other incidents/research topics.
  • The README also notes that updates have moved to the Knowledge-Base repository, which helps explain the current maintenance path.

6) Blockchain threat-intelligence tooling

• URLs:
  • https://github.com/slowmist/blockchain-threat-intelligence
  • https://raw.githubusercontent.com/slowmist/blockchain-threat-intelligence/master/README.md
  • Supporting API: https://api.github.com/repos/slowmist/blockchain-threat-intelligence
• Key excerpt:
  • The repository describes a blockchain threat-intelligence sharing platform built to simulate Ethereum/EOS-style node RPC functionality in order to monitor attacks against blockchain systems across the global network.
  • It includes Docker and source-build instructions plus runtime flags for target RPC endpoints and bounty addresses.
  • This is valuable evidence that SlowMist’s public surface includes operational monitoring and attack-observation tooling, not only reports or advisory text.

7) GitHub organization overview

• URL: https://github.com/slowmist
• Supporting API: https://api.github.com/orgs/slowmist/repos?per_page=20
• Key excerpt:
  • The organization exposes repositories such as mwadb-go, papers, Knowledge-Base, blockchain-threat-intelligence, node-security checklists, bug-bounty lists, and other security resources.
  • Taken together, the repo mix suggests a security-and-intelligence platform with research, tooling, datasets, and guidance layers.

Working conclusion

SlowMist is best cataloged as blockchain security and threat-intelligence infrastructure with auditing, AML/compliance, incident-response, research, and public tooling layers. The combined site and GitHub surfaces make it much broader than a classic audit boutique.