Overview
Invariant0 is a security firm that checks the code behind blockchain apps for flaws. That code is made of smart contracts, programs that run on a blockchain and move funds on their own. Project teams hire Invariant0 to review that code, explain each problem it finds, and hand over a written audit report1.
Invariant0 works mainly on Cardano. It is the former Vacuumlabs Auditing team under a new name, with the same people doing the work2, and the reports from its Vacuumlabs years remain public on GitHub3. The firm appears in the list of Cardano auditors kept in CIP-0052, the community guideline for smart contract audits4.
Key Features
- Problems flagged while the audit is still running. Invariant0 reports each vulnerability as soon as it finds one, so developers can start fixing code while the auditors keep looking, and late code changes are folded into the same review1.
- A review of the design, not only the code. The Pondora v2 audit for Pond Labs describes a design review followed by a deep manual read of the code, with findings and fix suggestions passed to the team as work progressed5.
- Reports written for two audiences. Invariant0 reports open with an executive summary and then give the detail technical readers need, and clients comment on a draft before the final version is delivered1.
- A public track record. Reports issued under the Invariant0 name sit in its own GitHub repository6, while the Vacuumlabs Auditing archive covers Cardano projects such as Liqwid, WingRiders, FluidTokens, and Iagon3.
- A free game for learning contract security. The Cardano Capture the Flag game hands players deliberately broken smart contracts to exploit, with a set of original challenges and a gentler Bank Series whose levels build on each other7.
What to Expect
For project teams, an Invariant0 engagement starts with the contact form on its website. The team offers to sign a simple non-disclosure agreement before seeing private code. It then sends an estimate with options and timelines, runs the audit, and shares a draft report for feedback before the final version. Re-audits are available when the code changes later1.
A withdrawal for a DeFi liquidity program from Cardano's on-chain treasury, a shared fund whose spending the community votes on, allocated funding for an independent security audit by Invariant0 LLC, covering a design review, a code audit, re-checks of fixes, and public and internal final reports8.
For developers and curious readers, the free material is the main draw. The Capture the Flag game was paid for by Project Catalyst, Cardano's community grant program9. Players run their attacks first on their own computer and then on Cardano's Preview test network, a practice network where tokens have no real value7. The official Cardano Developer Portal bases a lesson in its security course on Invariant0's article series about common Cardano vulnerabilities10.
The firm has also published design research on programmable tokens, with a whitepaper and proof-of-concept code11. Programmable tokens run extra checks each time they move, such as blocking listed addresses, a feature that regulated assets like stablecoins often need12.
