Zellic primary sources — 2026-04-28

Project

• Name: Zellic
• URL: https://www.zellic.io/
• Category: smart-contract security / offensive-security research firm / audit-and-tooling infrastructure / blockchain security engineering platform
• Whitepaper status: No canonical Zellic whitepaper or litepaper found in this pass.

Primary sources reviewed

1. Homepage: https://www.zellic.io/

   • Positions Zellic as a security firm for emerging technologies.
   • Emphasizes offensive-security research roots and multidisciplinary expertise across cryptography, web/mobile security, low-level exploitation, and finance.
   • Strong high-level signal, though the homepage alone understates the breadth of Zellic’s public operating surface.

2. Research/blog index: https://www.zellic.io/blog/

   • Shows public research spanning vulnerabilities, validators, Solana internals, Bitcoin, TON, cryptography, DeFi, ZK, and broader security topics.
   • Useful evidence that Zellic acts as a public research producer rather than only a private audit vendor.

3. GitHub organization: https://github.com/Zellic

   • Shows the organization publishing more than audit PDFs, including monitoring, search, parser, and verification-adjacent tooling.
   • Popular repos surfaced from the org page include publications, EVM-trackooor, Masamune, solidity-parser, weth, and move-prover-examples.

4. Publications repository README: https://raw.githubusercontent.com/Zellic/publications/master/README.md

   • States that Zellic’s audit reports are available in both GitHub and HTML form on the web.
   • The repo index itself is a very strong primary source because it lists a large, current, cross-chain audit corpus spanning EVM, Solana, Cosmos, Move, TON, Cairo, Rust, and more.
   • Helpful for understanding Zellic as an operating security platform with a substantial public audit archive.

5. EVM Trackooor README: https://raw.githubusercontent.com/Zellic/EVM-trackooor/master/README.md

   • Documents a modular tool for realtime/historical EVM monitoring of events, transactions, and blocks.
   • Shows concrete security workflows such as proxy-upgrade detection, Tornado Cash-linked exploit tracking, Uniswap volume alerts, and funding-path graphing.
   • Strong evidence of Zellic publishing practical operator tooling, not just assessment reports.

6. Masamune README: https://raw.githubusercontent.com/Zellic/Masamune/master/README.md

   • Describes a search utility for smart-contract security vulnerabilities built over a curated corpus of audits, hacks, and research.
   • The listed data sources include Zellic’s own reports alongside other major industry sources, showing Zellic building knowledge tooling for auditors/researchers rather than only marketing collateral.

7. Solp README: https://raw.githubusercontent.com/Zellic/solidity-parser/master/README.md

   • Documents a Solidity parser/analysis library that works without solc and targets AST/IR generation for analysis use cases.
   • Useful evidence that Zellic develops internal-grade analysis infrastructure and exposes some of it publicly.

Takeaways

• Zellic is best cataloged as security research and tooling infrastructure, not just a contract-audit boutique.
• The key differentiator is the combination of a large public audit corpus with open-source operational tooling and research output.
• The public GitHub inventory is essential to understanding the project; the homepage alone makes Zellic look narrower than it is.
• No classic whitepaper appears necessary here; the repo/blog/report corpus is the real first-party source of truth.