Engagement & Pricing
We find your zero-days. If we don't, you get your money back. No other security firm on the planet offers this guarantee.
In Q1 2026, BlackHart research identified 25 critical and 31 high severity vulnerabilities across 15 protocols, with $28.7B+ in TVL at risk. Every finding is fork-validated with a passing PoC.
Protocols Audited
Findings
Critical Vulnerabilities
TVL at Risk
See how we validate findings with working exploits on mainnet forks.View Demo →
Zero-Day Hunt
The Money-Back Guarantee
We get 30 days to find a zero-day in your protocol. If we don't find a Critical or High severity vulnerability with a passing fork-validated PoC, you get your entire deposit back—minus the non-refundable audit fee that covers our operational costs.
No other security firm offers this. We can, because we find what others miss.
How It Works
Deposit
Upfront deposit held in escrow. Includes the non-refundable audit fee that covers 30 days of dedicated operations.
Hunt
30 days of dedicated adversarial research. 14 parallel attack models running against your codebase simultaneously.
Prove
Every finding is demonstrated on a mainnet fork with a passing PoC. Verified exploit value is calculated.
Settle
Zero-day found? Success fee is due. Nothing found? Full refund minus the audit fee. No disputes. No ambiguity.
TVL-Based Pricing
Pricing scales with the value we're protectingPrecision
For growth-stage protocols that need to validate their security posture before scaling.
Vanguard
Most CommonFor established protocols with significant TVL that demand the highest level of adversarial testing.
What Qualifies as a Zero-Day
A finding qualifies for the success fee when it meets all three criteria. This protects both sides—we only get paid for real, demonstrable vulnerabilities.
The vulnerability must result in direct loss of funds, protocol takeover, permanent freezing of assets, or equivalent economic impact. Medium and below do not qualify.
The exploit must be demonstrated in a Foundry test running against a mainnet fork at the current block. No theoretical findings. The PoC must pass.
The exploit value must be calculated and mutually verified. The finding must demonstrate real economic impact against deployed contracts with actual TVL.