Zellic

Zellic is a blockchain security assessment firm founded in November 2021 by Luna Tong (CEO) and Jasraj Bedi (CTO), who built the team around competitive security researchers with deep expertise in cryptography, web security, mobile security, and financial systems. The firm's tagline, Real security. Not rubber stamps., reflects its approach: each engagement assigns dedicated expert teams, maintains daily client communication, and applies techniques tailored to the specific technology stack, setting it apart from checkbox compliance reviews and automated scanning. Zellic's services span EVM smart contracts, Solana and Rust programs, zero-knowledge circuits, cross-chain bridges, Layer 1 and Layer 2 platforms, web application security, secure enclaves, and trusted execution environments. The firm publishes all completed audit reports publicly at github.com/Zellic/publications. In 2024, Zellic completed 241 security reviews identifying 193 critical vulnerabilities and 266 high-impact findings, with 59 percent of engagements revealing at least one critical or high-severity issue. In 2025, the firm completed 338 assessments, preventing 247 critical vulnerabilities from shipping and finding 308 high-impact issues. Notable clients include the Solana Foundation, LayerZero, Wormhole, Pyth, StarkWare, Scroll, Biconomy, Ethena, Mantle, Aptos Labs, Mysten Labs, Hyperliquid, SushiSwap, PancakeSwap, Wintermute, Cognition, and Polymarket. Zellic has been active in Solana security from the ecosystem early growth period, with published engagements including Drift Protocol in February 2022, Pyth Oracle Client in April 2022, Audius Solana in October 2022, and as one of multiple firms in the multi-auditor SPL Token 2022 review in December 2022. More recent Solana work includes LayerZero Solana Endpoint in July 2024, Chainflip Solana in August 2024, and multiple Anza engagements covering BPF stake programs and token wrapping. In February 2026 Zellic published a detailed analysis of security pitfalls and memory leaks in Solana's sBPF JIT compiler. In August 2024, Zellic made its first acquisition, purchasing Code4rena, a Paradigm-backed competitive smart contract auditing platform. The combined offering, branded Audits+, pairs Zellic's consultative time-boxed reviews with Code4rena's competitive audit model in a single engagement, delivering more complete coverage than either approach alone. Code4rena continues to operate independently under its existing community. Zellic also publishes original security research including a March 2026 Chrome V8 zero-day from V8CTF participation (CVE-2025-2135), formal verification of a Plonky2 ZK gate in June 2026, and an Ethereum contract enumeration methodology from May 2025. Zellic operates at the specialist security tier in the Solana ecosystem alongside firms such as OtterSec, Trail of Bits, and Halborn, and does not run a token or on-chain product.