Smart contract security between audits.
Fixed-scope security engineering for Web3 teams preparing for an audit, shipping after one, or trying to keep production changes from drifting beyond reviewed assumptions.
Fixed scope. Human-reviewed artifacts. Not a formal audit or no-bugs guarantee.
audit-drift check
audited tag: v1.4.2-audit
current: HEAD
! PAUSER_ROLE granted to new address
! oracle source changed
Chainlink ETH/USD → Pyth ETH/USD
! timelock delay reduced
24h → 12h
! invariant touched
totalAssets >= totalSupply assumption
review decision:
senior PR review requiredAudits are snapshots. Your protocol keeps changing.
New PRs, oracle changes, role updates, integrations, deployment configs, and governance actions can quietly invalidate the assumptions your last audit relied on. SuperDroids turns those assumptions into review workflows, tests, runbooks, and monitoring rules your team can keep using.
Before the audit
Threat models, privilege maps, static-analysis triage, invariant catalogs, and audit-readiness memos before you spend serious budget on a formal review.
After the audit
Map audited assumptions to current HEAD, flag high-risk PRs, and make security-sensitive changes easier to review before they merge.
In production
Monitoring rules, escalation paths, pause/no-pause decisions, and incident runbooks for live protocols.
Fixed-scope security sprints
Start with one bounded engagement. Keep the artifacts afterward.
Protocol Threat Model & Audit Readiness Sprint
Go into your next audit with the obvious gaps already handled.
Audit Drift & PR Risk Guard
Install a review workflow for PRs that re-open audited assumptions.
Invariant & Fuzzing Sprint
Turn protocol assumptions into executable tests that run in CI.
Monitoring & Incident Readiness Setup
Make alerts actionable with severity rules, runbooks, and escalation paths.
Ongoing review for teams shipping between major audits.
Two weeks to one shipped artifact.
Not slideware. A working asset wired into your repo, with a follow-up window so it survives after we leave. Fixed scope, fixed timeline.
What a SuperDroids sprint looks like.
Book a scoping callPick the security outcome that matters
We pick one concrete deliverable — audit readiness, drift guard, invariant suite, monitoring setup, or ongoing review — and define what success looks like before any code gets touched.
~2 days
Map the assumptions that can break
Trust boundaries, privileged roles, oracle dependencies, invariants, integration points, and production controls. The audit firm sees the code; this step sees the protocol.
~4 days
Hand off something that runs
Tests, checklists, review templates, CI workflows, monitoring rules, or runbooks — wired into your repo, walked through with your team, with a tuning window so the artifact survives the handoff.
Engagement complete
AI-assisted where it helps. Human-reviewed where it matters.
I use AI to accelerate PR triage, audit-drift detection, invariant brainstorming, static-analysis triage, documentation review, and test-generation support. The output is not raw AI noise: findings are validated with human review, tests, PoCs, or written reasoning.
AI can flag what changed.
Tests and review prove whether it matters.
Humans decide whether the change is safe.
Robert Schneider
robert@superdroids.co
The exploit isn’t in the audit report. It’s in the next ten PRs.
Years reviewing production protocols at Trail of Bits taught me a hard lesson: the bug that takes a protocol down usually isn’t in the code that got audited. It’s in what the team merges next — under deadline, with AI generating half of it.
I started SuperDroids to build what was missing: security workflows that live between audits, with AI doing the breadth work and humans providing the proof. If your team ships faster than your auditors can keep up, that’s the gap I close.
Selected public reviews
Seaport (OpenSea) · Maple Finance · LooksRare · Immutable zkEVM Bridge · Franklin Templeton · Arcade.xyz
Common questions.
Quick answers to what most teams ask before booking.
Still have a question?
Email me directly and I'll respond within a business day.
Two weeks. One shipped artifact.
Book a 30-minute scoping call. No commitment, no sales pitch.