01 / AI-native cybersecurity

Deep reviews of critical code.

We work with your team from design through post-deployment. Our auditors review, fuzz, and scan with AI in the loop.

Request audit how we work →

src/loan.sol:createLoan WAKE 5.0

crit a lending smart contract: the external _tryPermit() call sits before settlement — a re-enterable back-edge.

entry of interest re-entry path control flow

Trusted by

Field metrics

0 hacks across the team's 237 audits.

source: rekt.news/leaderboard →

48% discover crit+high

Nearly half of all audits discover at least one critical or high severity issue — 114 of 237.

+22% more findings with ai

38 critical or high findings with the ack3 AI scan, 31 without — backtest on 2025 production audits.

AI cross-component scan

Blue chips such as Lido run the ack3 AI scan: one review that combines on-chain contracts and off-chain infrastructure.

What impressed us most was the AI audit's ability to identify complex issues arising from interactions between different parts of the system. These cross-component findings are typically among the most difficult classes of vulnerabilities to discover.

Maxim (@notnick) · Lido · Staking Router + CSM

recall_benchmark.txt 2026-05 / N=94 high-sev

ack3 AI scan 66/94

best frontier model 48/94

ack3 AI scan: +30% bugs found vs bare frontier models — recall of 94 real high-severity vulnerabilities from public audit competitions, 2026-05 run.

What we do · the partnership

From design to post-deployment.

The core engagement is a security review: manual review, Wake fuzzing, and the ack3 AI scan across EVM smart contracts, Solana programs, and the off-chain infrastructure around them. Around the review, the partnership spans the whole lifecycle.

Stage 01 — Design advisory

Before code is written.

Reviewing protocol architecture, threat models, and economic design while choices are still cheap to change.

Stage 02 — Tooling

Wake fuzzing & AI.

We create manually guided fuzzing campaigns and run the ack3 AI scan against the codebase.

Stage 03 — Security review

Integrations and dependencies.

A smart contract audit extends into libraries, off-chain components and dependencies that affect the system's security. Critical code stays inside the audit scope.

94.4% of losses at audited projects were outside audit scope — H1 2026 research

Stage 04 — Partnership

Coverage that follows the code.

A monthly ack3 AI scan follows the code; re-reviews and incident support as the protocol evolves — where the relationship compounds.

How we review · methodology

The method behind the record.

Every review starts with a model of the system and ends with a report the team stands behind.

System modeling

The codebase and its external interactions mapped; expected behavior checked against implementation.

wake graph tooling · mathematical models

ack3 AI scan

Launched at the start, pinned to the scoped commit, run in parallel with the manual review — added coverage and leads, every finding reviewed by the team.

scoped commit · manual triage

Manual & agentic review

Vulnerability hypotheses, escalation paths, chained weaknesses, trust boundaries — every finding validated by auditors.

ai workflows · wake static analyzer · lsp

Testing & fuzzing

Unit tests and fuzzing confirm findings and verify exact behavior — campaigns guided by an auditor, fuzz tests AI-generated.

wake test · fuzz campaigns

The team

The people behind the record.

ack3 is an in-house team of security researchers — the team that built Ackee Blockchain — auditing Ethereum and Solana protocols since 2021, trusted by Lido, Safe, and Axelar. The team teaches blockchain security at the Czech Technical University in Prague, led by founder Josef Gattermayer, Ph.D.

on stage

Benchmarking AI for Smart Contract Security → jgattermayer · ethprague 2026
The Art of Manually Guided Fuzzing → jaczkal · defi security summit 2025
Beyond Unit Tests: Beginner Fuzzing with Wake 5.0 → michprev · ethprague 2026
The Art of Manually Guided Fuzzing → michprev · protocol berg 2025
Why We Built an Open-Source Swiss Knife for Solidity → jgattermayer · tu munich seminar

Open source · tooling

We build Wake.

Wake is the framework behind every ack3 audit — pytest-based testing, property-based fuzzing, vulnerability detectors, and the language server that powers the Solidity (Wake) VS Code extension. It started in 2022 as the team's internal framework at Ackee Blockchain; we re-build it now for our own engagements and share it with everyone, open source.

Wake is built for the AI era: the agents drive Wake; our auditors drive the agents. The research behind it is conducted with the Czech Technical University in Prague.

wake docs → get the extension →

wake on stage

wake development backed by a coinbase grant · 2022

The Wake Detections panel in VS Code: fifteen high-severity detections listed beside the ERC-20 source that raised them, with inline reference and control-flow-graph code lenses in the editor. — wake detections in the editor — the extension is the frontend of the same detectors that run on every audit.