Overview
MLabs Audit is a security review service that checks smart contracts, the programs that run decentralized apps and hold their funds, for flaws before real money depends on them. Development teams hire it to read their contract code, find mistakes, and prove each one with a working test that stays in the team's code after the audit ends1.
MLabs Audit is the audit service of MLabs1, a software consultancy that specializes in the Haskell programming language and formal methods, meaning mathematical ways of checking that code does what it should2. The service covers Cardano contracts written in Aiken, Plutarch and Plinth, three of the languages developers use for them, and MLabs maintains Plutarch itself1. MLabs is listed among the Cardano auditors in CIP-0052, the community's audit best-practice guidelines, and took part in the discussions that produced them3.
Key Features
- Proof for each problem found. MLabs Audit backs each reported vulnerability with one or more tests that show it happening, and those tests stay in the client's test suite once the audit is over1.
- A written plan for how the code should behave. The audit opens by reviewing the project's specification, a document describing what each contract should and should not allow; if none exists, MLabs writes one with the team and hands it over1.
- Problems flagged while the review runs. Findings go into the client's code repository as issues while the review is still underway, so developers can start fixing serious ones before the report is written1.
- A fixed price tied to the amount of code. MLabs measures effective lines of on-chain code (the contract logic left after comments, blank lines, imports, tests and off-chain code are removed) with its own tooling, shares the per-file count, and holds the quote at an agreed version of the code, absorbing growth of up to 10%1.
- A match between reviewed and deployed code. Where the setup details are available, the final report certifies script hashes, the unique fingerprints of deployed contracts, tying the audited source to what runs on the network1.
What to Expect
For a team with contracts to review, the process starts with a call about what the protocol does and how much code is in scope. Unless the code is already public, both sides then sign a mutual non-disclosure agreement (NDA), a contract that keeps the code confidential. MLabs reads the code and comes back with a fixed price, a duration, and a start date. Senior engineers lead each audit, and clients learn who they are before signing1.
The audit itself runs in five phases: a specification review, a manual read of the code, a draft report ranked by severity that the team can respond to, a re-audit after fixes, and a final report recording how each finding was resolved. The team's own fixing time between the draft and the re-audit usually adds one to two weeks1.
Readers checking the track record can open public reports. The report for MuesliSwap, a decentralized exchange, covers its order contract and records a re-audit of the fixes4. Indigo Protocol lists MLabs audits of its V1, V2 and V2.1 contracts5. MLabs also helped build Indigo, and says a separate team of its auditors, apart from the developers, reviewed the main contract code as part of that work6.
The Sundae Labs treasury contracts were audited by MLabs alongside TxPipe, another Cardano audit firm7.
Developers can study MLabs' Cardano Plutus Script Vulnerability Guide, which describes common contract flaws, the property each flaw breaks, and a test that exposes it8. Projects outside Cardano go through MLabs' separate testing and verification service, which works on any technology stack2.
