Overview
FYEO is a security firm that checks the code behind blockchain apps for flaws, using both an automated scanner and human auditors. Development teams connect their code to the FYEO Scanner, which reviews each proposed code change and dependency update, then bring in human auditors for a deep review before a launch or major release1.
FYEO audits projects on many blockchains2, and its Cardano work is documented by its clients. The Lace wallet team at Input Output hired FYEO to run a series of audits and code reviews of the wallet3. Iagon lists an FYEO security assessment of its staking and rewards contract4. The firm also appears in the list of auditors in CIP-0052, a proposed Cardano guideline on audit best practice5.
Key Features
- Checks on each code change. The FYEO Scanner automatically reviews each pull request (a proposed change to a codebase) and each update to outside code libraries a project relies on1.
- Findings that explain the fix. Scanner results are ranked by severity and point to the exact file and line, with the likely attack path and a suggested fix for each issue6.
- Code that is not kept. The scanner sees only the repositories a team chooses to connect, holds code in temporary storage for the length of a scan, and FYEO states that client code is never used to train its models1.
- Human audits with a second pass. FYEO audits pair automated analysis with a manual deep dive and simulated attacks, and auditors re-check the fixes after the team makes changes7.
- Published audit reports. FYEO keeps a public list of many of its audit reports on GitHub, covering projects on Ethereum, Solana, XRP Ledger, Cosmos, Avalanche and other networks2.
What to Expect
For development teams that want ongoing checks, the scanner is self-serve. Teams sign in, connect a GitHub repository, and run a scan of the whole codebase or of only the parts that changed. A free starter allowance of credits lets teams try it without a card, and monthly plans or one-off credit packs cover regular use. The exact price of each scan appears before it starts, and failed scans are refunded8.
Teams preparing a launch or major release describe their timeline, codebase and concerns through the contact form, and FYEO proposes a scope within one business day9. Audits cover smart contracts, programs stored on a blockchain that run automatically when set conditions are met, written in languages such as Solidity, Rust and Move7. The report includes an executive summary for non-technical readers, steps to reproduce each issue, and fix recommendations7. FYEO also offers fuzz testing, which feeds code large numbers of unexpected inputs to expose hidden flaws, and audits of AI agents that act on blockchains9.
FYEO offers developers who work with AI assistants a connector that lets Claude, ChatGPT and similar tools request scan estimates and read results. An assistant cannot start a scan until the account owner turns that option on and approves the quoted price10. Other products can build FYEO scanning into their own services through a partner API, a connection point for outside software, which comes with a free test environment that returns sample findings11.
