Cowrie Research

trail-of-bits-primary-sources-2026-04-30

3 min read

Trail of Bits primary sources — 2026-04-30

Project status in this pass

  • No single canonical company whitepaper surfaced.
  • The clearest current source of truth is the official site, the trailofbits and crytic GitHub organizations, the public publications repository, and secure-contracts.com.

Primary-source snapshots

1) Official homepage

  • URL: https://www.trailofbits.com/
  • Key excerpt:
    • The homepage says Trail of Bits helps secure some of the world’s most targeted organizations and devices.
    • It says the company combines high-end security research with a real-world attacker mentality.
    • The page breaks its work into software assurance, security engineering, research and development, and training.

2) Software Assurance page

  • URL: https://www.trailofbits.com/services/software-assurance/
  • Key excerpt:
    • The page says the software-assurance practice spans application security, blockchain, cryptography, and AI/ML.
    • It emphasizes tailored assessments across the SDLC and the ability to combine standalone specialist services into multidisciplinary engagements.
    • The page also describes a structured engagement model with technical onboarding, weekly status reporting, final readouts, and fix review.

3) Main GitHub organization

  • URL: https://github.com/trailofbits
  • Key excerpt:
    • The org page explicitly points readers to @trailofbits as the main org and @crytic as the blockchain security group.
    • Pinned repositories include publications, skills, and other security-engineering tools.
    • This is a strong signal that public tooling and research distribution are core parts of the company’s operating model.

4) Crytic GitHub organization

  • URL: https://github.com/crytic
  • Key excerpt:
    • The pinned repositories include slither, medusa, echidna, building-secure-contracts, solc-select, and properties.
    • The broader repository list includes EVM disassembly, compilation, and analysis utilities.
    • This makes the crypto-specific tooling surface very clear: Trail of Bits is not only auditing contracts, it is maintaining a widely used smart-contract security toolchain.

5) Publications repository

  • URL: https://github.com/trailofbits/publications
  • README: https://raw.githubusercontent.com/trailofbits/publications/master/README.md
  • Key excerpt:
    • The publications README is organized into Academic Papers, White Papers, Guides and Handbooks, Conference Presentations, Security Reviews, and other sections.
    • It includes a dedicated blockchain section under security reviews, plus named major clients such as Frax Finance, MobileCoin, Offchain Labs, Reserve Protocol, Scroll, and Uniswap.
    • The white-paper section includes official Trail of Bits documents such as Preventing Account Takeovers on Centralized Cryptocurrency Exchanges Recommended Practices, Are Blockchains Decentralized?, and Do You Really Need a Blockchain?.

6) Building Secure Smart Contracts / secure-contracts.com

  • URL: https://secure-contracts.com/
  • Key excerpt:
    • The site says it is “Brought to you by Trail of Bits” and offers guidelines and best practices for developing secure smart contracts.
    • It collects development guidance, incident-response recommendations, EVM references, common-vulnerability examples, and program-analysis material.
    • It also serves as an education hub for Trail of Bits tools such as Echidna, Medusa, Slither, and Manticore.

7) Slither README

  • URL: https://raw.githubusercontent.com/crytic/slither/master/README.md
  • Key excerpt:
    • Slither is described as a Solidity and Vyper static analysis framework that runs vulnerability detectors, exposes visual/code-comprehension views, and provides an API for custom analyses.
    • The README emphasizes low false positives, CI integration, support for Hardhat and Foundry builds, and a large detector catalog.
    • This is strong evidence of Trail of Bits maintaining reusable security infrastructure rather than only producing reports.

8) Echidna README

  • URL: https://raw.githubusercontent.com/crytic/echidna/master/README.md
  • Key excerpt:
    • Echidna is described as a property-based Ethereum smart-contract fuzzer using ABI-aware input generation.
    • The README highlights coverage guidance, source-code integration, invariant testing, multiple testing modes, build-system integration, and workflow automation.
    • Together with Slither, it shows that Trail of Bits maintains a substantial smart-contract testing stack, not just advisory output.

Working conclusion

Trail of Bits is best cataloged as security research, smart-contract security tooling, and public audit/research infrastructure with a significant crypto specialization. The combination of consulting, publications, open-source tooling, and training material makes it much broader than a conventional audit firm.

Graph View