Senior Smart Contract Auditor, Solidity (contract)

Remote, contract-based, per audit engagement. You lead EVM audits from scoping to the remediation report and run AI-assisted audits with tools you built yourself. You stand behind every finding you sign.

What You’ll Do:

• Lead audits from start to finish: scoping, kickoff, threat model, review, report and remediation review.
• Act as the client's main technical contact on calls, questions, findings walkthroughs and severity discussions.
• Report everything that matters, from Critical to Informational: exploits, design risks, code quality and documentation gaps.
• Run and improve your AI-assisted workflow on live audits. Check every model claim against the code before it reaches a report.
• Write PoCs for High and Critical findings.
• Review other auditors' findings and mentor less experienced auditors.
• Turn your methods into skills, prompts and tools the team can reuse.

It’s a Match If You Have:

Portfolio (must have, links required)

• Public audit reports with your name on them, including audits you led.
• Part of your portfolio from before 2025. We want auditors who were strong before AI tools, and who are stronger with them.
• 4+ years in smart contract security, with 3+ of those years auditing.
• High-paid Critical or High bug bounties and strong contest results count in your favour. They do not replace audit reports.

Audit leadership

• You have led engagements and owned the client relationship.
• Developers and managers alike can follow your findings: root cause, impact, severity reasoning and a minimal fix.
• You can defend a severity rating, and you change it when the client shows you something you missed.

AI-native audit practice

• You use AI coding agents (Claude Code, Codex or similar) on every audit, not only in chat.
• You have built your own audit pipeline, orchestrator or set of agent skills. A full pipeline that takes a codebase through context building, bug hunting, false-positive checks, PoCs and report drafts is a strong plus.
• You write reusable agent skills or prompts with clear inputs and outputs and a way to check the output.
• Your workflow has a check for each common model failure:
  • invented behaviour of external contracts
  • trusting mocks
  • one root cause reported as several findings
  • inflated severity
  • PoCs that pass for the wrong reason
  • lost context on large scopes
• You pick models and split scopes with cost and context limits in mind.
• You know what your tools find that you would miss, and what they miss that you find.

EVM depth

• Solidity and EVM internals: storage layout, call contexts, delegatecall, proxies, Yul and gas.
• Signatures: ECDSA, EIP-712, EIP-1271, permit, and replay across chains.
• DeFi: AMMs, lending, vaults, oracles, liquidations, bridges, and economic and MEV attacks.
• Standards: ERC-20, ERC-721, ERC-1155, ERC-4626, ERC-4337 and EIP-7702.
• Foundry (fork tests, fuzzing, invariants) and Hardhat.

Nice to Have:

• Audit tools, agent skills or MCP servers you have published, or security research.
• Certora, Halmos, Echidna or Medusa.
• L2s, cross-chain messaging and account abstraction.
• Experience outside the EVM: Solana, Move or TRON.