Hashlock

Hashlock is an Australian Web3 security firm founded in 2022 and headquartered in Sydney. The company provides manual smart contract audits, blockchain security assessments, penetration testing, bug bounty program management, tokenomics reviews, and ongoing security advisory services to projects across more than 30 blockchains — including Solana.

What It Does

Hashlock's primary service is manual smart contract security auditing. Rather than relying on automated scanning alone, the firm leads with line-by-line code review conducted by human security researchers trained in each blockchain's native language and runtime behavior. Its stated mission is to ensure that decentralized projects can operate securely in Web3.

The full service portfolio includes:

• Smart contract audits: Research-led manual review for Rust, Solidity, Move, Cairo, and other languages
• L1 chain audits: Protocol-level security assessments of entire blockchain codebases
• Penetration testing: Simulated real-world attack scenarios against Web3 applications and infrastructure
• Tokenomics review: Economic modeling and mechanism analysis to identify incentive-layer vulnerabilities
• Bug bounty management: Designing and operating ongoing vulnerability disclosure programs
• On-chain monitoring: Continuous post-deployment security surveillance
• Incident response: Emergency support following live security incidents

Hashlock also acquired StealthTest, an API-based Web3 development platform that provides private test networks for most EVM-compatible chains, expanding its tooling into automated quality assurance and compliance testing.

Audit Methodology

Engagements follow a three-phase structure:

1. Preliminary phase: Initial scoping consultation, followed by thorough code examination — meticulous and line-by-line — plus automated tooling where appropriate. A preliminary report is delivered categorizing all identified vulnerabilities by severity.
2. Revision phase: Re-audit of the remediated codebase to verify fixes were correctly implemented, followed by a final audit report with an overall security rating.
3. Ongoing phase: Optional continuous monitoring and post-launch advisory support.

Hashlock provides personalized quotes rather than fixed-rate pricing, promising to return estimates within 6 to 48 hours of inquiry. The firm positions itself as more cost-effective than the top global audit firms while more thorough than purely tool-automated competitors.

Projects passing the most rigorous review earn the firm's highest designation — the Hashlocked rating.

Solana Coverage

Hashlock maintains dedicated capabilities for the Solana ecosystem. Its researchers have documented expertise in Rust, the Anchor framework, and Solana's distinct programming model. Specific areas of focus include program-derived address (PDA) handling, account ownership and validation, cross-program invocation (CPI) security, and instruction introspection risks.

Documented Solana engagements include:

• Balanced Network / ICON General Message Passing (GMP): Completed September 2024, covering Rust contracts that enable ICON's cross-chain messaging protocol on Solana. All findings from the report were remediated, allowing Balanced's DeFi protocol to proceed to front-end launch with confidence.
• Spicenet: A cross-chain DeFi brokerage infrastructure project building on Solana. Hashlock conducted a competition-level manual review of Spicenet's asynchronous execution engine, optimized Merkle tree implementation, and zero-knowledge proof integrations. Spicenet achieved the Hashlocked rating — Hashlock's highest security designation.

Chain and Language Breadth

Hashlock is chain-agnostic by design, auditing across more than 30 blockchain ecosystems:

• Languages: Rust, Solidity, Vyper, Move, Cairo, Go, CosmWasm, Haskell/Plutus, Noir, Circom
• Chains: Ethereum, Solana, Polkadot (Substrate), Cosmos, Aptos, Sui, Starknet, Bitcoin Layer 2s, Near, Avalanche, BNB Chain, Arbitrum, Base, Polygon, Kadena, Stacks, and others

Track Record

As of 2026, Hashlock has published more than 254 public audit reports, with roughly 26 additional NDA-bound engagements, totaling approximately 280 security assessments. The firm reports that no project it has fully audited has subsequently suffered a successful exploit, and it claims to have contributed to securing more than $2.3 billion in on-chain assets across its client base.

Named clients across the broader portfolio span DeFi, gaming, infrastructure, and institutional staking: Rocket Pool, 1inch, SushiSwap, EigenLayer, Gala, Vana, Energy Web, Redbelly Network, Verida Network, P2P.org, Manifest, and Peaq. The firm has also worked with the New South Wales Government and Australian universities including RMIT and UNSW.

Team

Hashlock was co-founded by Jock Haslam, who brings a decade of cybersecurity consulting experience, and Fletcher Roberts, who leads digital strategy. Key technical personnel include Chris Moore (Lead Security Researcher, previously at Seer Security and CyberCX) and Kristoffer Lewinsky (Executive Business Development Manager). The team had grown to approximately 20 employees as of mid-2026 and was actively recruiting Golang security researchers, signaling expansion into additional runtimes.

The company is bootstrapped — no external venture funding — and maintains membership in Blockchain Australia and FinTech Australia. The University of Newcastle has cited Hashlock as an example of Australian firms reshaping norms in the Web3 security industry.

Ecosystem Fit

As Solana's builder ecosystem has expanded into DeFi, cross-chain bridging, real-world asset tokenization, and gaming, demand for Rust-native security expertise has grown alongside it. Hashlock addresses this need as a manually-driven, research-led auditing firm with documented Solana and Rust specialization. For Solana projects prioritizing thorough human review over automated scanning, Hashlock offers chain-specific expertise with a verifiable public audit portfolio and an active Australian-headquartered team.