Cardano smart contract security
Security and engineering for the Cardano ecosystem.
alwaystrue provides independent security audits, product engineering, and embedded engineering teams to organizations building on Cardano. We work with all Cardano technologies to build decentralized applications, protocols, products, and contribute to the open-source libraries the ecosystem depends on.
Request a proposalWe join at any stage of development
Security audit
Security and optimization audits
We conduct a systematic review of each validator, enumerating the execution paths through the contract and the transactions an adversary could construct against it. Every finding is delivered with a severity rating, a reproduction, and a recommended remediation. Optimization reviews include measured before-and-after execution budgets.
- Severity-rated findings
- Reproductions
- Remediation guidance
- Fix verification
Delivered product
Product engineering
We take Cardano products from idea to mainnet: defining the product, designing the protocol, implementing the validators and the dapp around them, testing at the unit, integration, and property level, and deploying to testnet and mainnet. Engagements range from discrete components to complete delivery under the client's own name.
- Product definition
- Protocol design
- Testing
- Deployment
Embedded engineers
Team augmentation
We place senior Cardano engineers within existing teams, integrated into the client's repository, development process, and on-call rotation. Our engineers are experienced in the extended UTxO model and require no ecosystem onboarding.
- Senior
- Embedded
- Contract or retainer
Upstream contributions
Open source
We maintain and contribute to the open-source libraries the Cardano ecosystem depends on, and publish the tooling developed for our own audit practice under the same licenses.
- Libraries
- Audit tooling
- Upstream fixes
Case studies
Audit · TxPipe
GitHoney
A bounty protocol that pays open-source contributors through Cardano smart contracts, built by TxPipe. The review of its Aiken validators found three critical vulnerabilities, including one that allowed bounty rewards to be stolen, all resolved before release.
- Aiken
- 21 findings
- 3 critical
Audit · TxPipe
Asteria
A Cardano bot challenge by TxPipe in which players pilot tokenised ships across an on-chain grid to reach a prize pool. The review of its Aiken validators found two critical vulnerabilities that allowed the prize pool to be drained, both resolved during the engagement.
- Aiken
- 9 findings
- 2 critical
Open source · Input Output
ContractsLibrary
Cardano's counterpart to OpenZeppelin: complete, reusable contracts shipped as on-chain code, off-chain builders, a specification, and machine-checked proofs. alwaystrue owns the project for Input Output, delivering five contracts to a ready-to-audit bar by November 2026.
- Aiken
- Lean 4
- Apache 2.0
Open source · Input Output
cardano-init
A command-line tool that scaffolds a complete, wired-together Cardano protocol monorepo in one command, with a worked example that builds and passes its tests out of the box. alwaystrue owns the project for Input Output's Developer Experience initiative.
- Rust
- Apache 2.0
- v0.2.1
Request a proposal.
Send an outline of the system and your intended mainnet date. We will respond with a proposed scope of review, a fee estimate, and an expected timeline.
contact@alwaystrue.io