Overview
No Witness Labs Audit is a security review service that checks smart contracts, the programs that hold and move funds on a blockchain, along with wallet apps, for flaws before people rely on them. Project teams hire it much as a builder hires an inspector. Auditors read the code, report weaknesses, and check the fixes. Final reports approved for public release go into a public portfolio on GitHub that anyone can read1.
No Witness Labs Audit is the review arm of No Witness Labs, a Cardano engineering firm that also does smart contract development and Hydra scaling work2. Most public reports cover Cardano contracts written in Aiken, a programming language built for Cardano, for clients such as FluidTokens, Danogo, Pondora and YaadLabs1. On Midnight, a privacy-focused partner chain, the firm assessed the Lace wallet's Midnight Preview browser extension in two reviews, the second a re-audit3.
Key Features
- Reports anyone can read. The No Witness Labs portfolio on GitHub holds approved final reports for completed engagements, covering lending, price oracle feeds that bring off-chain information onto the blockchain, DAO groups that vote on-chain, and wallet projects1.
- A fingerprint for each report. Each report is stored exactly as delivered, with a SHA-256 checksum, a digital fingerprint that lets a downloaded copy be checked against the file stored in the portfolio4.
- A step-by-step review process. In a CIP-113 programmable-token audit for the Cardano Foundation, No Witness Labs moved through planning, discovery, manual code review, checking the client's fixes, and a written report5.
- Findings ranked by seriousness. The CIP-113 report rates each issue on a five-level scale, from critical down to informational, based on how much harm it could cause and how likely it is5.
- Clear limits on each review. The CIP-113 report lists what was in and out of scope5. The portfolio states that a report covers a bounded review, not a certification that no bugs remain1.
What to Expect
Project teams building on Cardano can request an audit through the contact page on the No Witness Labs website2. The CIP-113 report shows what an engagement produces: a fixed review window, a list of findings with severity ratings, recommended fixes, and a record of which fixes the auditors checked5.
For people deciding whether to trust a Cardano app or wallet, the portfolio is a place to see whether a project was reviewed and what turned up. Reports come as downloadable PDFs grouped by client. The Lace wallet team, part of Input Output Group, says its three No Witness Labs audits of the browser extension and mobile app produced 50 findings, each fixed or accepted with a written reason6. Lace publishes its own response document listing how it handled each finding3.
Readers comparing firms can browse other audit companies and weigh their public reports side by side. Developers interested in formal verification, meaning mathematical proof that code behaves as intended, will find No Witness Labs named as one of six delivery partners in Input Output's Cardano High Assurance proposal, which aims to make that kind of checking available to Cardano developers7.
