Overview
Midgard Labs Audit is a security review service that checks smart contracts, the programs that run blockchain apps and hold their funds, for weaknesses. Teams building on a blockchain hire Midgard Labs to read their code by hand, run controlled attacks against it, and report each problem with its impact and a recommended fix1.
The service belongs to Midgard Labs, a blockchain security and engineering firm that calls itself the next chapter for the team behind Anastasia Labs, with a record that includes work delivered under both names2. On Cardano, Midgard Labs audits and writes smart contracts for other teams, and the team behind Plutus, the platform Cardano developers use to write and run smart contracts, moved to it from Input Output's IO Labs3. Midnight, the privacy-focused partner chain, is a named audit target alongside Cardano, Ethereum, Solana and Sonic1. Under the Anastasia Labs name, the team also ran one of the Hydra Heads that processed Midnight Glacier Drop token claims off the main chain and settled them on Cardano2,4.
Key Features
- Reviews that go beyond one contract. Midgard Labs audits single contracts, full applications and the inner parts of base blockchains, such as ledgers, bridges, oracles and wallets, using a risk-based approach1.
- Simulated attacks on agreed targets. Adversarial testing covers penetration testing and attack simulation, with the scope and the testing window set for each engagement1.
- Logic-based checks of key rules. Formal verification checks agreed security properties against an explicit model and stated assumptions, using logic rather than sample test runs1.
- Ongoing coverage after launch. The Continuous Security Partnership adds scheduled scans, repeat adversarial tests, reviews of upgrades and direct access to auditors, with coverage set in the engagement agreement1.
- Evidence behind each finding. Midgard Labs reports describe each issue, its impact and a recommended fix, with supporting analysis or steps to reproduce the problem where they apply1.
What to Expect
A team with code to review starts by sending project details and a deadline, or by booking a call from the Midgard Labs website1. Engagements range from public bounty programs, where outside researchers are paid for finding bugs, to confidential reviews under a non-disclosure agreement (NDA), a contract that keeps the code private2.
Auditors read the agreed code and architecture by hand, looking at security boundaries, assumptions and the ways the system could fail. Depending on scope, they add property-based testing (automatically generated test cases that check a rule holds across many inputs), custom checks and AI-assisted analysis. An auditor reviews any tool output before it goes into a report1.
Client reports are published only with the client's approval, and they state the status of each finding, including any left unresolved. Midgard Labs notes that publishing a report does not certify a system as secure2.
Readers checking the track record can open earlier reports from the same team under the Anastasia Labs name, such as the final audit of the FluidTokens Aquarium protocol, whose contracts are written in Aiken, a Cardano smart contract language5. Input Output's announcement lists audits for Liqwid, Minswap, SundaeSwap, FluidTokens and Genius Yield in the team's security work3.
Midgard Labs is one of six partners in Cardano High Assurance, an Input Output program that aims to make formal verification available to Cardano developers6. Its assigned part is bringing Blaster, Input Output's automated verification engine, to the Aiken language6.
Security researchers who find a flaw in the Midgard Labs website can report it to security@midgardlabs.io under a published disclosure policy with a 90-day coordination window7.
