OtterSec

OtterSec is a crypto security firm. It checks the code behind apps, wallets and bridges for bugs before hackers find them. Robert Chen founded it in 2022, and it is one of the best-known code auditors on Solana. Its clients include the Solana Foundation, Phantom, Jupiter and Raydium. It also works on Sui, Stellar and Ethereum-style chains.

OtterSec also runs Anchor, the main toolkit people use to write Solana programs. Since December 2025 it has shared its top team with another security firm, Asymmetric Research, but each firm keeps its own name and staff. OtterSec has no token. It sells audits, posts its reports in public, and gives away free tools.

What an OtterSec audit covers

An OtterSec audit is a paid code review. Its researchers try to break a project's code before hackers do. The client gets a report that lists each bug, ranks how bad it is, and notes whether it was fixed. OtterSec posts most reports on its audit reports page.

The firm's website says it has audited more than 120 projects. It claims those projects hold over $36.8 billion, and that it has helped fix bugs worth more than $1 billion. These are OtterSec's own figures, and no one outside the firm has checked them.

Recent public reports show the mix of work. Solana reports in 2026 include MetaDAO META$4,955.56+6.5% (February), Doppler (March), OnRe (July), a multi-tenant hosting program (August) and Solana Keychain (September). In the same period OtterSec published reports for Stellar, Sui, EVM and Fogo projects.

A report tells you exactly what was checked. The Solana Keychain audit status, maintained by the Solana Foundation, shows OtterSec reviewed the Rust, TypeScript, Python and Go code. It found 27 issues: 4 medium, 15 low and 8 informational, all marked resolved. We covered that release in Solana Keychain v2 adds Python and Go, Fordefi and Ledger signers, and an OtterSec audit.

OtterSec does not publish prices. Expect to request a quote based on your code size and deadline.

OtterSec and Asymmetric Research shared leadership

On 8 December 2025, OtterSec and Asymmetric Research said they would share leadership. The two firms now plan their work together, but each keeps its own name, staff and day-to-day running. Robert Chen is still CEO of OtterSec. Jonathan Claudius is still CEO of Asymmetric Research.

The goal is to look after a project from start to finish. OtterSec brings deep audits and bug hunting. Asymmetric Research brings long-term help, engineering, and support when something goes wrong. In the news release, Claudius said that "security needs to be continuous to build a resilient system."

For you as a client, one deal can now cover an audit before launch and ongoing support after it. Asymmetric Research's own blog shows its Solana work, including an April 2026 post on catching a bug in Solana's p-token program before mainnet.

OtterSec and Anchor, the Solana program framework

OtterSec looks after Anchor, the toolkit most Solana coders use to write programs. Anchor does many safety checks for the coder, so whole kinds of bugs never get written. Its code lives at otter-sec/anchor on GitHub, where about 5,200 people have starred it.

OtterSec ships regular releases. Anchor v1.2.1 came out on 6 October 2026. According to OtterSec's announcement on X, it adds a solana-v4 feature gate so programs can use newer Token-2022 extensions such as PermissionedBurn.

The bigger change is Anchor v2. The first release candidate shipped on 13 August 2026, as we reported in Anchor v2.0.0-rc.1 ships. The v2 docs claim programs up to 94% smaller that use far less compute. Version 2 was still a test release (rc.2) in October 2026. You install it from the anchor-next branch, not crates.io, so treat it as unfinished.

Robert Chen also presented the Anchor roadmap at Breakpoint 2025 (Anchor: Today and Tomorrow).

OtterSec decompiler, verification tools and security research

OtterSec builds free tools that let anyone look inside Solana programs, even ones whose code was never made public. Its bn-ebpf-solana add-on for Binary Ninja, a code-reading tool, turns a live Solana program back into code a person can read. Robert Chen showed it off at Accelerate 2025 (decompiling Solana programs).

The firm also runs solana-verified-programs-api. It checks that the program running on Solana matches the code its team posted. A third tool, sol-ctf-framework, helps people build Solana hacking puzzles.

OtterSec's research blog goes well beyond smart contracts. Posts in 2026 include:

• breaking six zero-knowledge virtual machines (March);
• a QEMU hypervisor escape (March);
• a Samsung Internet browser exploit (April);
• a critical flaw in Dusk Network's PLONK proof checks (April);
• unsafe WebView code in more than 20 mobile wallets (June);
• an automated reverse-engineering of Hyperliquid's risk engine (June);
• "Breaking open a propAMM" (2 October 2026), which applies decompilation to Solana's closed-source proprietary AMMs.

OtterSec CTF: rCTF and the Save CTFs Fund

OtterSec's team comes from hacking contests called capture-the-flag, or CTF. In a CTF, teams race to solve security puzzles. The firm runs rCTF, a free site for hosting these contests. It released rCTF v2 on 14 July 2026.

On 7 July 2026, OtterSec put $100,000 into a Save CTFs Fund. The firm says AI can now solve most classic CTF puzzles. As a result, scores end up measuring "token budget rather than skill." The fund backs contest hosts who try new formats that still reward human skill.

Is OtterSec the right auditor for your Solana project?

OtterSec suits teams whose code will hold real user funds. Think lending apps, exchanges, bridges, stake pools and wallets. Its best fit is a Solana program written with Anchor, since the firm runs Anchor itself. It also suits teams that launch on several chains, as it audits Sui, Stellar, EVM and Fogo code too.

It is a weaker fit for a small team with a simple token and a tight budget. A plain SPL token built on standard programs has little custom code to check. Almost all of OtterSec's public reports cover custom programs.

If you are a user rather than a builder, treat an OtterSec report as one input to your own judgement. Check which program and version it covered, its date, and whether the findings were fixed.

OtterSec audit risks and limits

An audit checks one version of the code at one point in time. If a project changes its program after the audit, the report no longer describes what is running. The Solana Keychain audit shows the gap: it excluded the Ledger signing backend, which was added later. Always compare an audit's commit hash with the deployed program.

OtterSec runs no user-facing protocol and has no token, so you take no custody or smart-contract risk by using it. The risk sits with the projects it audits. No audit firm can promise that audited code will never be exploited.

There is also a dispute about the firm's origins. A civil suit, Yao v. Chen, is pending in federal court in Maryland. It was brought by the estate of Sam Chen, father of co-founder David Chen, against Robert Chen and the companies Otter Audits LLC and RC Security LLC. BlockTribune reported in March 2024 that the court allowed the case to proceed. The estate claims Robert Chen dissolved the original OtterSec company and relaunched it under new entities without paying for Sam Chen's stake. According to a July 2026 case summary, breach of fiduciary duty and breach of contract claims survived a January 2025 ruling. That summary also says Robert Chen filed a separate suit accusing David Chen of taking company code and about $24,000 in crypto. None of these claims has been decided at trial, and the dispute has not visibly slowed OtterSec's audit output.

OtterSec vs Neodyme, Sec3 and other Solana auditors

OtterSec is one of several firms with deep Solana skills. Pick based on who will review your code, and how well they know your kind of program. An October 2026 comparison by FluidRWA makes the same point. It says Neodyme focuses on Token-2022 and how Solana accounts interact. It says Sec3 pairs automated code scans with a review of the app's logic.

Projects often use more than one firm. Solayer's audit list, for example, includes OtterSec reports alongside reviews by Halborn.

Asymmetric Research is the closest alternative, but it is not an independent second opinion. Because the two firms share leadership, a team that wants two unrelated reviewers should pair OtterSec with a firm outside that group.

When you compare quotes, ask each firm for:

• the named senior reviewer;
• the exact scope and exclusions;
• whether the report will be published;
• how long the free re-test window lasts.

OtterSec founder Robert Chen and company history

Robert Chen founded OtterSec in 2022 and remains its CEO. The team built its name in Solana security from the network's early DeFi period. Today it combines paid audits, open-source tools and public research.

Key milestones:

• 2022: OtterSec is founded and begins auditing Solana protocols.
• 2024: Robert Chen gives the Breakpoint keynote "Safe Solana Stack Smashing" (watch the talk).
• 2025: OtterSec shows its Solana decompiler at Accelerate. In December it agrees shared leadership with Asymmetric Research.
• 2026: Anchor v2 reaches release candidate; OtterSec launches rCTF v2 and the Save CTFs Fund.