Senior Smart Contract Auditor, Daml / Canton (contract)

Remote, contract-based, per audit engagement. You lead audits of Daml applications on Canton Network, covering authority, privacy, contract lifecycle and token flows. You use AI agents on every audit and stand behind every finding you sign.

What You’ll Do:

• Lead audits from start to finish: scoping, kickoff, threat model, review, report and remediation review.
• Act as the client's main technical contact on calls, questions, findings walkthroughs and severity discussions.
• Report everything that matters, from Critical to Informational: authorization and privacy flaws, lifecycle bugs, design risks and code quality.
• Use AI agents on every audit, adapted to Daml. Check every model claim against the code and Daml Script runs.
• Write Daml Script PoCs for High and Critical findings.
• Review other auditors' findings and mentor less experienced auditors.
• Build Daml checklists, skills and tools. The ecosystem has little public security tooling, so this is part of the role.

It’s a Match If You Have:

Portfolio (must have, links required)

• Public security audit reports with your name on them, including audits you led. Daml or Canton audits count most.
• If your audits are in other ecosystems, you also need proven production Daml experience.
• Part of your portfolio from before 2025. We want auditors who were strong before AI tools, and who are stronger with them.
• 4+ years in smart contract security or development.
• High-paid Critical or High bug bounties count in your favour. They do not replace audit reports.

Audit leadership

• You have led engagements and owned the client relationship.
• Developers and managers alike can follow your findings: root cause, impact, severity reasoning and a minimal fix.
• You can defend a severity rating, and you change it when the client shows you something you missed.

AI-native audit practice

• You use AI coding agents (Claude Code, Codex or similar) on every audit, not only in chat.
• You have built your own Daml checklists, agent skills or prompts. Models know far less Daml than Solidity, so you give them Daml-specific context and check their output more carefully.
• Your own audit pipeline or orchestrator, for Daml or any other language, is a strong plus.
• You know the common model failures and check for each:
  • invented behaviour of external packages and services
  • Solidity habits applied to Daml
  • one root cause reported as several findings
  • inflated severity
  • PoCs that pass for the wrong reason
  • lost context on large scopes
• You pick models and split scopes with cost and context limits in mind.
• You know what AI finds that you would miss, and what it misses that you find.

Daml and Canton depth

• Templates, choices and multi-party authorization: signatories, observers, controllers, actAs and readAs, and propose-accept and delegation patterns.
• Consuming and non-consuming choices, archiving, and contract lifecycle.
• Contract keys, including how key behaviour differs across Daml-LF versions.
• Privacy and selective disclosure: stakeholders, divulgence and explicit disclosure.
• Interfaces, Smart Contract Upgrade and DAR packaging.
• Ledger time and deadlines, and Decimal and Numeric precision.
• Canton: participant nodes, parties, the Ledger API, synchronizers and topology.
• The CIP-56 token standard: allocations, settlement, and Splice and Amulet flows.

Nice to Have:

• Solidity and EVM audits, since many Canton projects connect to EVM chains.
• Contributions to Splice or the Daml SDK, or a Digital Asset Daml certification.
• A background in tokenized assets, delivery-versus-payment (DvP), settlement or custody.
• Haskell or another functional language.
• Audit tools, agent skills or MCP servers you have published, or security research.