Adevar Labs

Adevar Labs is a boutique Web3 security firm founded in February 2025. The company name comes from the Romanian word adevăr, meaning "truth," which reflects the firm's stated commitment to honest, actionable security assessments over checkbox-style approvals. Its tagline is "Ship Safely" — a shorthand for the core promise that teams can launch production code with verified security confidence rather than ceremonial audit stamps.

What the Firm Does

Adevar Labs specializes in white-box code reviews and security auditing for blockchain systems, with particular depth in Rust and Solidity on Solana and Ethereum. The firm's technical coverage extends to Move, Go, Vyper, Yul, C++, Clarity, and FunC, making it applicable across the major smart contract environments — Solana Virtual Machine (SVM), Ethereum Virtual Machine (EVM), and the Move-based runtime used by Aptos.

Beyond language coverage, Adevar Labs audits the full software stack: on-chain programs, DeFi protocol logic, consensus-layer components, backend infrastructure, and cloud or bare-metal deployment environments. The audit scope for an infrastructure engagement such as the Fystack Apex Backend included authentication and session management, payment and checkout flows, MPC wallet signing, webhook delivery, and CI/CD configuration — not just contract code.

Service Portfolio

The firm offers six core service lines:

White Glove Audits are the primary engagement type. These are manual code reviews with no sampling — every line of in-scope code is reviewed by internal engineers. Reports include executive summaries, categorized findings by severity, and actionable remediation guidance. Clients receive a follow-up fix review in which Adevar Labs independently verifies each remediation before signing off.

Formal Verification applies mathematical provers to critical system properties on EVM and SVM chains. This is used to confirm that specific invariants hold unconditionally rather than relying solely on test coverage or fuzzing.

Custom Continuous Fuzzing builds targeted harnesses tuned to a specific protocol's architecture. The GLAM Protocol engagement, for instance, used specialized fuzzing and stress-testing harnesses to probe for share dilution and unauthorized fund diversion scenarios.

Infrastructure Audits assess the operational environment: deployment pipelines, cloud or bare-metal configurations, CI/CD flows, and admin key security — areas frequently overlooked in protocol-only reviews.

Penetration Testing simulates real-world attack scenarios with a focus on practical, exploitable risk rather than theoretical vulnerability catalogues.

Protocol Design Consulting engages projects before coding begins, embedding security thinking into architecture decisions to reduce the volume and severity of findings discovered at audit time.

Audit Model

Adevar Labs operates on a hybrid model designed to address two common failure modes in blockchain security reviews. In competitive audit contests, incentive structures push auditors toward severity inflation — every finding tends to be called critical or high because compensation scales with severity, resulting in disputes and noise. At traditional audit firms, clients typically have no visibility into or control over which auditors review their code, and teams often work with whoever is available rather than whoever has the deepest familiarity with the relevant language or domain.

Adevar Labs addresses both problems by allowing clients to select their preferred auditors from the firm's network, while an embedded internal security researcher provides quality assurance and calibrates severity ratings independently. This separation of discovery and judgment is intended to produce cleaner, more accurate final reports.

Audit Portfolio

As of mid-2026, Adevar Labs has published 24 public audit reports through its GitHub repository, all released with client consent. The portfolio is weighted toward Solana, spanning DeFi infrastructure, real-world asset tokenization, lending vaults, liquid staking, prediction markets, and cross-chain components.

Notable Solana engagements include:

GLAM Protocol (three separate audits: November 2025, February 2026, April 2026) — programmable investment infrastructure covering DeFi integrations, single-asset vaults, and iterative security enhancements. Across the GLAM engagements, 14 findings were identified and resolved, including high-severity stale AUM calculations and external position overpricing vulnerabilities. Targeted fuzzing harnesses were built to probe for share dilution and unauthorized fund diversion.

DoubleZero (three audits in November 2025) — infrastructure for the DoubleZero network, covering the Passport Sentinel, Converter Program, and Revenue Distribution components.

Carrot Lend / Clend Vaults (November 2025) — a lending vault audit that uncovered 10 vulnerabilities, including a critical oracle mispricing risk and high-severity accounting underflows.

Loopscale Periphery (July 2025) — one of the firm's earliest published reports, covering periphery lending program contracts on Solana.

M0 Extensions and M0 Liquidity Delivery (2025–2026) — stablecoin infrastructure for the M0 protocol on Solana, along with a cross-chain M0 Portal spanning EVM and Solana.

ORO Protocol (March 2026) — liquid staking protocol audit on Solana.

Spiko Solana Minter (June 2026) — real-world asset tokenization program audit on Solana.

Crafts Arcium Fundraising (June 2026) — DeFi fundraising infrastructure on Solana.

Additional Solana engagements include Indentura Vault, Altura NavVault, Trepa (prediction markets), DeGate Solana LP Handler, and the Ignition Stake Pool on the Fogo chain.

Outside Solana, Adevar Labs has audited Pact Protocol on Aptos (governance and DeFi infrastructure), LiFi Zapps on EVM, and Fystack's Apex Backend — a centralized Web2 payment and MPC wallet system — demonstrating that the firm's scope extends to off-chain infrastructure when it interacts with on-chain protocols.

Team

The Adevar Labs team has backgrounds from firms including Bitdefender, Quantstamp, and Chainproof. The firm describes its approach as selective in choosing client engagements and emphasizes matching auditors to projects based on domain and language familiarity. The firm was actively hiring when it launched, targeting auditors who prioritize technical rigor over high-volume throughput.

Ecosystem Position

Adevar Labs is listed as a partner in the Circle Alliance Directory, where it is documented as a security audit provider covering Solana among other supported chains including Ethereum, Aptos, Arbitrum, Base, and Hedera. The firm appears in the HackenProof Blockchain Auditors Leaderboard and in independent roundups of Solana-focused security firms.

Adevar Labs does not issue a protocol token and has no on-chain program of its own. It is a professional services firm; revenue comes from audit and consulting engagements.

The firm publishes security research on its blog, including technical analyses of supply chain attack vectors in the Solana ecosystem and landscape coverage of the competitive audit market. It also produces the Ship Safely Podcast, a security-focused podcast with guests from the Web3 ecosystem covering topics such as bug bounty design, incident response, and protocol security posture.