Short answer
- Most trusted by top Solana protocols: OtterSec is listed by 10 of the 12 leading Solana protocols we checked, including Kamino, Jupiter, Raydium, Orca, Meteora and Squads.
- Solana specialist: Sec3, listed by 9 of 12. It combines formal methods with manual review and publishes a yearly Solana security review (2025 edition).
- Long Solana track record: Neodyme, listed by 7 of 12. It also audited the SPL stake pool program used by many liquid staking tokens.
- Formal verification: Certora, listed by 5 of 12. It proves code follows written rules rather than only reviewing it.
- Fuzzing your Anchor program yourself: Ackee also makes Trident, a free open-source fuzzer for Anchor programs.
At a glance
| Firm | Top protocols listing it (of 12) | Examples | Known for |
|---|---|---|---|
| OtterSec | 10 | Kamino, Jupiter, Raydium, Orca, Meteora, Squads, Drift | Audits; verify.osec.io build verification |
| Sec3 | 9 | Kamino, Jupiter, Raydium, Orca, Meteora, Marinade | Solana-focused, formal methods plus manual review |
| Neodyme | 7 | Jupiter, Raydium, Orca, Marinade, Squads, Drift | Research, audits, pentests, training |
| Certora | 5 | Kamino, Jupiter, Exponent, Huma, Squads | Formal verification (Certora Prover) |
| Kudelski Security | 4 | Raydium, Orca, Marinade, BlazeStake | Early Solana DeFi audits |
| Offside Labs | 4 | Kamino, Jupiter, Meteora, Exponent | Research team, reports on GitHub |
| Ackee | 3 | Kamino, Marinade, Project 0 | Audits plus Trident fuzzer |
| Halborn | 3 | Raydium, BlazeStake, Huma | Audits and penetration testing |
The 12 protocols are Kamino, Jupiter, Raydium, Orca, Meteora, Marinade, Exponent, BlazeStake, Huma, Project 0, Squads and Drift, chosen from the largest Solana protocols by TVL whose security pages list auditors. None of these firms publish prices; every audit is quoted per engagement.
What an audit does and doesn't cover
An audit is a time-boxed review of a specific version of the code. Auditors look for bugs such as missing signer or owner checks, unchecked arithmetic, bad account validation, oracle manipulation and broken access control, then report findings by severity. The team fixes them, and the auditor usually reviews the fixes.
An audit doesn't cover code changed after the review, the team's keys and upgrade authority, off-chain servers, or economic attacks outside the scope. Many exploited protocols were audited. That's why large protocols use several firms, add formal verification, run bug bounties and audit again after major changes.
Formal verification goes further for the most critical logic: a tool such as the Certora Prover proves the program satisfies rules like "total deposits always cover total borrows" for every possible input, not just the cases a reviewer thought of.
Check a program yourself
- Read the audit list. Most protocols link reports from their docs. Check the date and the program version audited.
- Verified builds. Tools like verify.osec.io confirm the deployed program matches its public source code.
- Upgrade authority. An upgradeable program can be changed after the audit. Prefer a multisig or timelock over a single key; see authority tools.
- Bug bounty. A live bounty shows the team pays for bugs found after launch.
- For tokens, not programs, use a rug checker. Most memecoins use standard token programs and don't need an audit.
How to choose an auditor
- Solana experience. Ask for public Solana reports, ideally on programs like yours (AMM, lending, perps, staking).
- Book early. Top firms are often booked weeks ahead. Freeze the code you want reviewed.
- Combine methods. A manual audit plus fuzzing (Trident) or formal verification for core math catches different bugs.
- Budget for a re-audit after major changes, and for a bug bounty after launch.
The firms
OtterSec
Audits Layer 1s, wallets, DeFi, bridges and infrastructure. Listed by Kamino, Jupiter, Raydium, Orca, Meteora, Exponent, BlazeStake, Project 0, Squads and Drift. Runs verify.osec.io for verified Solana builds.
Sec3
A Solana-focused firm combining formal methods with manual review by competitive security researchers. Listed by Kamino, Jupiter, Raydium, Orca, Meteora, Marinade, Exponent, Huma and Project 0.
Neodyme
Audits, penetration testing, training and consulting backed by its own vulnerability research, with sample public reports. Listed by Jupiter, Raydium, Orca, Marinade, BlazeStake, Squads and Drift, and audited the SPL stake pool program.
Certora
Formal verification with the Certora Prover and custom rules written by its team, plus audits and an agentic AutoProver. Listed by Kamino, Jupiter, Exponent, Huma and Squads.
Kudelski Security
A cybersecurity company with a blockchain audit practice. Listed by Raydium, Orca (including the first Whirlpools audit in January 2022), Marinade and BlazeStake, and audited Save.
Offside Labs
A security research team that publishes reports on GitHub. Listed by Kamino, Jupiter, Meteora and Exponent.
Ackee
Audits Solana and EVM programs and builds open-source testing tools: Trident, a fuzzer for Anchor programs, and Wake for Solidity. Listed by Kamino, Marinade and Project 0.
Halborn
Smart contract audits, penetration testing and key ceremony audits. Listed by Raydium, BlazeStake and Huma, and audited the SPL stake pool program.
How we ranked
We read the audit or security pages of 12 leading Solana protocols in October 2026 and counted how many list each firm. Firms are ordered by that count; ties go alphabetically. It measures who top Solana teams hire, not the quality of any single audit. Editorial policy.