Sigma Prime

Blockchain security firm that audits smart contracts, protocols and infrastructure and builds the Lighthouse client.

No project pays to be listed. How we rank

Facts checked Oct 1, 2026

Sigma Prime key facts

Category	Security and compliance
Platforms	Web
Launched	2016
Open source	Yes, Lighthouse under Apache 2.0
Company	Blockchain security and infrastructure firm; founder Mehdi Zerouali
Pricing	Not published; audits are scoped through a request form

Official site ↗

About

What is Sigma Prime?

Sigma Prime is a blockchain security and infrastructure firm established in 2016. It audits smart contracts in Solidity, Vyper, Rust and Move, blockchain protocols and infrastructure, and states 400+ projects audited. It also builds Lighthouse, an Ethereum consensus client open-sourced under Apache 2.0.

How Sigma Prime works

Sigma Prime sells eight services, grouped on its services page.

Security audits come in four types: infrastructure audits of cloud, CI/CD, Kubernetes, signers and validators; blockchain protocol audits of consensus, networking, bridge, sequencer and L2 code in Rust, Go and C++; smart contract audits by manual review of Solidity, Vyper, Rust, Move and Cairo; and frontend reviews of wallets, dashboards, APIs and admin panels built with TypeScript, React or Next.js.

For teams that ship often, Rolling Commit Reviews assess scoped changes PR by PR instead of waiting for a code freeze, and an Integrated Security Engineer can sit inside your team for periodic reviews and ongoing security work. The firm also runs operator roles across roughly $0.5B of Lido stake and about 7% of the Aztec sequencer set. Its homepage case study on Reth, a Rust Ethereum execution client, lists 51 findings, 10 of them high risk.

Lighthouse, the firm's Ethereum consensus client, is written in Rust and funded by Sigma Prime, the Ethereum Foundation, Consensys and others, per its README. The project keeps a stable branch for users and an unstable branch for development, and its Lighthouse Book covers running a beacon node, becoming a mainnet validator and querying the REST API.

How to start with Sigma Prime

To request an audit, fill in the contact form on sigmaprime.io/contact with your project name, a contact method (email or Telegram) and the service you need: security audit, rolling commit reviews, infrastructure review, operational security, integrated engineer or training.
The same form holds a waitlist for Secstant, the firm's AI security tool.
Urgent requests can go to [email protected].
Before you engage, you can read past work in the sigp/public-audits repository on GitHub, which lists each report with its date, target commit and scope.

Sigma Prime fees and limits

Sigma Prime does not publish rates. Work starts with a scoping call requested through the contact form, and the page says someone replies within one business day by email or Telegram. Services come in different engagement models: a standard audit covers a fixed commit, Rolling Commit Reviews assess scoped changes as they land instead of waiting for a code freeze, and an Integrated Security Engineer works inside your team. Lighthouse, the firm's Ethereum consensus client, is free to run and open source under the Apache-2.0 license.

Risks to know before using Sigma Prime

A Sigma Prime report covers the code at the commit named in it.
The public-audits table records a target commit for every review, so changes merged after that commit are outside the report unless you book a follow-up or a rolling review.
The same README says clients can publish reports or keep them confidential, so the public list is only part of the firm's work, and a project that says it was audited by Sigma Prime without a linked report cannot be checked against that list.

Security and complianceWeb