Ginger Security

Free consultation

Learn web3 hacking!

White-hat web3 security

Get the security peace-of-mind you and your users deserve.

Ex black-hat hackers at your service - all worked for state intelligence agencies in their past (ask us about it!) 🕵️
Incentivized security - only pay if we successfully hack your app! Your app got hacked after our audit? Our revenue is slashed. Read more 🤝
Full stack protection - smart contracts, tokenomics, web2, and anti-phishing 🛡

Core services

Security advisory

End-to-end penetration testing

Smart contract
audits

Zero-knowledge, automations, & MEV bot development

Trusted by

Iron Fleet

Starkswap

Revelator

NFTPort

Art Gobblers

Peranto

Alienverse

VTVL

Argent

Testimonials

"Working with Ginger Security was a true pleasure. As one of the only auditors native to StarkNet, they brought unparalleled knowledge and expertise to the table, and it showed in the quality of their work. Their thorough understanding of the platform allowed them to delve deeper and uncover any potential security vulnerabilities, making sure that Starkswap was fully prepared for a successful launch. Their comprehensive approach, combined with the unique tools and resources available to them as a native StarkNet auditor, made for a seamless and highly effective audit process. We're extremely grateful for their support and highly recommend Ginger Security to anyone looking for a top-notch security audit in the StarkNet space.” — @brandthebuidler, StarkSwap co-founder

"We recently engaged Ginger Security to perform a comprehensive security audit of our digital wallet and we couldn't be happier with the results. The team at Ginger Security is made up of experts in the field and they provided us with thorough and actionable recommendations to improve the security of our platform. Their unique incentivized security model ensured that they had a vested interest in finding and reporting any vulnerabilities. We have been impressed with their professionalism and expertise and we are looking forward to continuing our partnership with them. I highly recommend Ginger Security to any organization looking to improve their security posture." — Bruno Guez, Revelator CEO

Publications

Cairo Uint256: How and Why Most StarkNet Contracts are Hackable
Read more on Medium ->

Reentrancy Exploits: Simplified and Formalized
Read more on Medium ->

Hack Replay: Harvest Finance $24M Price Manipulation
Read more on Medium ->

Our blog ->

Our Twitter ->

Our YouTube ->

Team

ggballas
Senior hacker

JohnnyTime
Senior hacker

duliba
Senior hacker

0xluminita
Hacker

rav3n
Intern hacker

0xCleaner
Hacker

I've got more questions...

How can I trust you?

Simple, don't trust - incentivize.

We abide by what we call "incentivized security". We achieve that through pay-per-vulnerability and our partnership with hats.finance.

Pay-per-vulnerability - all of our audits are paid based on performance and whether we are able to find new issues and vulnerabilities in your codebase. We weren't able to find anything? You don't pay anything extra.

Partnership with hats.finance - 50% of your audit costs goes to your project's bug bounty vault on hats.finance. In short - hats.finance is a bug bounty platform where 3rd parties can put money into projects' bug bounties. In order to give you and your users even more peace-of-mind, we put our money where our mouth is. If a project that was audited by us gets hacked - we lose 50% of the money that we received for that audit.

Opening such a vault will also help gain users' trusts in the safety of your dApp.

You may rest assured knowing that we will do our absolute best to hack your app, much before any hacker in the wild will.

Schedule a call with us to hear the finer details of our incentivized security model.

Why is it important to secure my whole stack? How can you help me with it?

Axie Infinity's smart contracts were perfectly secured and audited. Their logic and tokenomics were sound. Yet they got hacked for a mind-boggling $650M because their web2 security measures were lacking (private keys were leaked).

Countless crypto projects (including big ones like BAYC) are and were targets for simple phishing attacks and scams that resulted in loss of millions of dollars of users' funds.

An attacker will always look for the weakest link. Having had real-world black-hat experience, we know how real hackers think. Your stack is only as secure as your weakest link. When we do audits we make sure to look at EVERYTHING. Money lost is money lost. Doesn't matter if it's due to a smart contract security bug, a web2 flaw, or a simple scam run on trusting users.

How can I prove to my users, beyond a shadow of a doubt, that my app is secure?

Bad news: You can't. Nothing in security is ever beyond a shadow of a doubt.

Good news: You can get to a point where you'd be 99.99999...% certain in your security stance. How is that achieved? By diversifying and incentivizing.

Diversifying - the more security measures and precautions you take, the better your security stance will be. Got an audit with Company A? You can always get one with Company B as well. Why not launch a bug bounty? How about auditing your web2 components as well? Live dashboards can do no harm either... Security is an never ending endeavor. Let us help you navigate the security maze and offer you a plethora of security solutions - smart contracts and tokenomics audits, web2 pen-testing, a bug bounty vault on hats.finance, live security dashboards, and anti-phishing solutions. We will diversify your security measures to the fullest extent.

Incentivizing - most security firms would charge you a flat fee for a measly audit. You're essentially paying $20-30k for a PDF. If a security firm is charging you a flat fee, how do you know they're not simply letting their most junior auditor run some scripts on your codebase? Your auditors need to have skin in the game. At Ginger Security, we swear by incentivized security and work with other projects to make that an industry-wide practice. We only charge you based on our performance with our pay-per-vulnerability policy, and we stake 50% of the audit revenue into your project's vault on hats.finance (which we open for you). Read more about our thoughts on incentivized security above ("How can I trust you").

What are the prices for your audits and penetration tests?

You may contact us to get the exact details at hello@gingersec.xyz.

Get your free consultation

Email, Zoom, pigeon-mail... it doesn't matter to us. Contact us now and get your free consultation in whichever way you prefer.

Free consultation

Learn web3 hacking!

> How can I trust you?Simple, don't trust - incentivize.We abide by what we call "incentivized security". We achieve that through pay-per-vulnerability and our partnership with hats.finance.Pay-per-vulnerability - all of our audits are paid based on performance and whether we are able to find new issues and vulnerabilities in your codebase. We weren't able to find anything? You don't pay anything extra.hats.finance - 50% of your audit costs goes to your project's bug bounty vault on hats.finance. In short - hats.finance is a bug bounty platform where 3rd parties can put money into projects' bug bounties. In order to prove our commitment to our clients, we put our money where our mouth is. If a project that was audited by us gets hacked - we lose 50% of the money that we received for that audit.Opening such a vault will also help gain users' trusts in the safety of your dApp.You may rest assured knowing that we will do our absolute best to hack your app, much before any hacker in the wild will.Schedule a call with us to hear the finer details of our incentivized security model.

> Why is it important to secure my whole stack? How can you help me with it?Axie Infinity's smart contracts were perfectly secured and audited. Their logic and tokenomics were sound. Yet they got hacked for a mind-boggling $650M because their web2 security measures were lacking (private keys were leaked).Countless crypto projects (including big ones like BAYC) are and were targets for simple phishing attacks and scams that resulted in loss of millions of dollars of users' funds.An attacker will always look for the weakest link. Having real-world black-hat experience, we know how real hackers think. Your stack is only as secure as your weakest link. When we do audits we make sure to look at EVERYTHING. Money lost is money lost. Doesn't matter if it's due to a smart contract security bug, a web2 flaw, or a simple scam run on trusting users.

> How can I prove to my users, beyond a shadow of a doubt, that my app is secure?Bad news: You can't. Nothing in security is ever beyond a shadow of a doubt.Good news: You can get to a point where you'd be 99.99999...% certain in your security stance. How is that achieved? By diversifying and incentivizing.Diversifying - the more security measures and precautions you take, the better your security stance will be. Got an audit with Company A? You can always get one with Company B as well. Why not launch a bug bounty? How about auditing your web2 components as well? Live dashboards can do no harm either... Security is an endless endeavor. Let us help you navigate the security maze and offer you a plethora of security solutions - smart contracts and tokenomics audits, web2 pen-testing, a bug bounty vault on hats.finance, live security dashboards, and anti-phishing solutions. We will diversify your security stance to the fullest extent.Incentivizing - most security firms would charge you a flat fee for a measly audit. You're essentially paying $20-30k for a PDF. If a security firm is charging you a flat fee to ensure your safety, how do you know they're not simply letting their most junior auditor run some scripts on your codebase? Your auditors need to have skin in the game. At Ginger Security, we swear by incentivized security and work with other projects to make that an industry-wide practice. We only charge you based on our performance with our pay-per-vulnerability policy, and we stake 50% of the audit revenue into your project's vault on hats.finance (which we open for you). Read more about our thoughts on incentivized security above ("How can I trust you").

> What are the prices for your audits and penetration tests?You can read about all our prices and terms here.