Cardano smart contract security
Security and engineering for the Cardano ecosystem.
alwaystrue provides independent security audits, product engineering, and embedded engineering teams to organizations building on Cardano. We work in Aiken, Plutus, and Plutarch, and contribute to the open-source libraries the ecosystem depends on.
Request a proposalWe join at any stage of development.
Engagements begin with a finished codebase, a roadmap that is not yet built, or a team that needs additional capacity. In each case the work is staffed from the same group of Cardano engineers.
Security audit
Security and optimization audits
We conduct a systematic review of each validator, enumerating the execution paths through the contract and the transactions an adversary could construct against it. Every finding is delivered with a severity rating, a reproduction, and a recommended remediation. Optimization reviews include measured before-and-after execution budgets.
- Aiken
- Plutus / PlutusTx
- Plutarch
- eUTxO threat modeling
Delivered product
Product engineering
We deliver Cardano products end to end: on-chain validators, the off-chain services and indexers that support them, and the client applications above. Engagements range from discrete components to complete delivery under the client's own name.
- On-chain
- Off-chain services
- Indexing
- Client applications
Embedded engineers
Team augmentation
We place senior Cardano engineers within existing teams, integrated into the client's repository, development process, and on-call rotation. Our engineers are experienced in the extended UTxO model and require no ecosystem onboarding.
- Senior
- Embedded
- Contract or retainer
Upstream contributions
Open source
We maintain and contribute to the open-source libraries the Cardano ecosystem depends on, and publish the tooling developed for our own audit practice under the same licenses.
- Libraries
- Audit tooling
- Upstream fixes
Case studies
Two security reviews and two open-source projects we lead for the ecosystem. Reports are published where the client has agreed to disclosure.
Audit
GitHoney
A bounty protocol that pays open-source contributors through Cardano smart contracts, built by TxPipe. The review of its Aiken validators found three critical vulnerabilities, including one that allowed bounty rewards to be stolen, all resolved before release.
- Aiken
- 5 on-chain files
- May 2025
Audit
Asteria
A Cardano bot challenge by TxPipe in which players pilot tokenised ships across an on-chain grid to reach a prize pool. The review of its Aiken validators found two critical vulnerabilities that allowed the prize pool to be drained, both resolved during the engagement.
- Aiken
- 6 on-chain files
- March 2025
Open source
ContractsLibrary
Cardano's counterpart to OpenZeppelin: complete, reusable contracts shipped as on-chain code, off-chain builders, a specification, and machine-checked proofs. alwaystrue owns the project for Input Output, delivering five contracts to a ready-to-audit bar by November 2026.
- Aiken
- Lean 4
- Apache 2.0
Open source
cardano-init
A command-line tool that scaffolds a complete, wired-together Cardano protocol monorepo in one command, with a worked example that builds and passes its tests out of the box. alwaystrue owns the project for Input Output's Developer Experience initiative.
- Rust
- Apache 2.0
- v0.2.1
Request a proposal.
Send an outline of the system and your intended mainnet date. We will respond with a proposed scope of review, a fee estimate, and an expected timeline.
contact@alwaystrue.io