Overview
Anastasia Labs runs a security audit service that checks smart contracts, the self-running programs behind blockchain apps, for mistakes that could let someone steal or lock up funds1. Teams building exchanges, lending tools, stablecoins, and bridges that move funds between blockchains hire the firm to review their code and hand back a written report1.
Anastasia Labs focuses on Cardano, and its website lists audits for Minswap, Genius Yield, Splash, Optim Finance, and the Cardano Foundation1. The same team also builds developer tools, listed separately as Anastasia Labs.
Key Features
- Hands-on code review. Anastasia Labs reviewers read the code against a checklist of known Cardano attack patterns, such as tricks that mint unlimited tokens or let one payment count toward two separate obligations2.
- Testing and mathematical proofs. The firm's website lists property-based testing, which throws large numbers of generated inputs at the code, and formal verification, a method for proving that certain rules always hold, using a proof tool called Agda1.
- Plain severity labels on each finding. The Anastasia Labs report for PBG Capital ranks findings on five levels, from Critical (funds could be stolen or permanently locked) down to Informational (notes with no immediate financial risk, such as style, design, or documentation issues), each with a recommended fix and its resolution status2.
- Support for several contract languages. Anastasia Labs' public audit reports cover code written in Aiken, Plutarch, and Helios, languages used to write Cardano smart contracts. The Minswap exchange report, for example, covers code written in Aiken3.
- Audits of the languages themselves. Anastasia Labs also reviewed OpShin, a tool for writing Cardano smart contracts in Python, and published its analysis of the compiler that turns OpShin code into code Cardano runs, and of its edge cases, on GitHub4.
What to Expect
For project teams, the first step is an email or the booking form on the Anastasia Labs homepage to talk through scope1. The PBG Capital report lays out the work in four phases: planning, searching the code for weak spots, testing whether those weak spots can be exploited, and writing up the results. That report also names the exact version of the code it reviewed, so readers know which code the findings apply to2.
For people who use Cardano apps, the reports are the useful part. Clients publish them on their own sites. Splash, a trading app, lists its two Anastasia Labs reports in its documentation5. Optim Finance states that its OADA system, which puts deposited ADA to work to earn yield6, was audited by the firm7. And Minswap keeps its full report inside its code repository3.
The reports are technical PDFs, but you don't need to read every page. The PBG Capital report, for example, includes a short table that counts how many issues it found at each severity level2.
For developers and researchers, the firm has a grant proposal on Project Catalyst, Cardano's community-run grant fund8. The proposal describes a framework that uses Coq, another proof tool, to show that smart contracts follow set rules8. Anyone comparing reviewers can browse other audit companies in the directory.
