Affordable code security scans. Pay Only After Results.
function withdraw(uint amt) {
require(balance[user] >= amt);
user.call{value: amt}("");
balance[user] -= amt;
}
function withdraw(uint amt) {
require(balance[user] >= amt);
user.call{value: amt}(""); // sent before the balance is updated
balance[user] -= amt;
}
RedMirror models your critical subsystems as state machines and exhaustively explores every reachable state, returning either a concrete, reproducible vulnerability — the exact path that triggers it — or, when none surfaces, a precise account of what was verified and how far. Across nine languages and smart contracts.
A short call to understand your stack and agree on what matters most.
Grant read access to the repositories or subsystems in scope.
RedMirror models each subsystem and explores its full state space.
Every finding ships with a concrete, reproducible attack path.
No upfront cost. You pay only when the results are worth it.
We can patch each finding and re-verify that the fix holds.
Tell us what you want verified. We will reply to set up a session.
Fixes and findings RedMirror surfaced in major OSS projects:
Beyond the public fixes above, many findings have been disclosed privately through HackerOne, Bugcrowd, and Cantina.xyz, on programs including Polymarket, Mattermost, and Reserve Governor, among many others.