Trail of Bits
Security research firm that audits blockchains, smart contracts, cryptography and AI systems.
No project pays to be listed. How we rank
Trail of Bits key facts
| Category | Security and compliance |
|---|---|
| Platforms | Web |
| Launched | 2012 |
| Open source | Yes, 200+ open-source repos including Slither and Echidna |
| Company | Security research and audit firm; public reports on GitHub |
| Pricing | Not published; engagements start through the contact form |
| US availability | Available: US firm with a New York, NY mailing address |
What is Trail of Bits?
Trail of Bits is a security firm working since 2012 that reviews smart contracts, nodes and bridges, cryptography and AI systems. Its site lists 620 audits and 946 publications, and it hosts public reports in a GitHub publications repository. Its blockchain work uses its own open-source tools Slither, Echidna and Medusa.
How Trail of Bits works
Trail of Bits scopes each engagement before the review starts.
Its services page shows a sample security review report of 64 pages produced by 4 engineers over 10 person-weeks. The about page says every finding is reproduced and explained by a person with the root cause and a fix, the team returns to verify fixes, and engagements leave behind CI guardrails such as Semgrep and CodeQL rules and fuzzers so the same bug class is caught later.
Blockchain reviews lean on the firm's own tools. Slither is a Python static analyzer for Solidity and Vyper that runs a set of vulnerability detectors, works on Hardhat and Foundry projects with a single slither . command, and needs Python 3.10 or later. Echidna is a Haskell fuzzer that takes invariants written as Solidity functions starting with echidna_ and searches for a call sequence that breaks them; it also has assertion and Foundry test modes.
Most reports are published at github.com/trailofbits/publications under a CC-BY-SA-4.0 license. The repository sorts security reviews by chain, including Ethereum/EVM, Solana, Starknet, Substrate, Cosmos, Algorand and TON, and also holds case studies, papers and a dataset of smart contract audit findings. The about page calls this public by default, so you can read a firm's past findings on code similar to yours before you hire it, and check whether a project's claimed audit exists.
How to start with Trail of Bits
- Teams reach the firm through the contact form on trailofbits.com, which needs JavaScript; for sensitive material the page offers SendSafely and PGP instead.
- The mailing address is 228 Park Ave S #80688, New York, NY 10003.
- If you are not ready for a full review, the services page offers a free office hours session of one hour with an engineer on a specific problem, such as an architecture question or a finding you cannot reproduce.
- You can also run Slither and Echidna yourself before an audit, since both are free on GitHub.
Trail of Bits fees and limits
Trail of Bits does not publish prices. Each engagement runs under a statement of work and a project plan agreed with the client, and the services page says the team is sized to your threat model rather than a fixed template. The one free offer is office hours: a one-hour working session with an engineer on a specific technical problem, with no pitch and no sales engineer. The firm's main blockchain tools cost nothing to use: Slither and Echidna are open source on GitHub under the AGPL-3.0 license.
Risks to know before using Trail of Bits
- A Trail of Bits report is not a guarantee that the code is safe.
- The test coverage disclaimer in its published reports says assessments are time-boxed and often rely on information supplied by the client, so the findings should not be read as a complete list of issues in the codebase.
- The same notice says its automated tools have limits: a fuzzer may not generate the edge case that breaks a property, or may not finish its analysis in the allotted time.
- Reports name the exact commit reviewed, and the firm says the only authentic copy is the one on its publications page, so check a claimed audit there rather than trusting a PDF hosted by the project.
Trail of Bits alternatives
Other projects people compare with Trail of Bits.
Prague audit firm for Solana and EVM smart contracts, maker of the Wake and Trident testing tools.
Security platform with AI agents, researcher bug bounties and Spearbit onchain audits.
Web3 security company offering smart contract audits, formal verification, on-chain monitoring and the Skynet rating.
Blockchain analytics company selling investigation, compliance and monitoring tools to agencies and businesses.
Security firm for blockchain and financial companies: smart contract audits, pentesting, red teaming and advisory.
Tool to inspect and revoke token and NFT approvals your wallet has granted to smart contracts.
Where Trail of Bits ranks on DappAtlas
Listed next to Trail of Bits
- OpenZeppelin Smart contract tool
- Sigma Prime Security and compliance
- Sherlock Security and compliance
Trail of Bits pros and cons
- 620 audits listed on its homepage
- Public reports hosted on GitHub (trailofbits/publications)
- Builds open-source tools used in audits: Slither, Echidna, Medusa
- No published pricing; engagements are scoped per project
- Blockchain is one of several practices, next to AI and app security
Trail of Bits FAQ
What is Trail of Bits?
Trail of Bits is a security firm working since 2012 that reviews smart contracts, nodes and bridges, cryptography and AI systems. Its site lists 620 audits and 946 publications, and it hosts public reports in a GitHub publications repository. Its blockchain work uses its own open-source tools Slither, Echidna and Medusa.
How much does Trail of Bits cost?
Not published; engagements start through the contact form, according to Trail of Bits’s own page (checked Oct 1, 2026).
Is Trail of Bits available in the US?
Available: US firm with a New York, NY mailing address, according to Trail of Bits’s own page (checked Oct 1, 2026).
Sources
How this page works
Sources: Trail of Bits: official site, Trail of Bits: Services, Trail of Bits: Homepage. Data as of Oct 1, 2026.
Not affiliated with any project listed. Educational content, not financial advice.