Overview
Tweag Audit is the security review service of the software firm Tweag, which checks the code behind blockchain apps for security flaws. Teams building exchanges, stablecoins, lending apps, and governance tools hire it to find ways their smart contracts (programs that run on a blockchain and hold or move funds) could be abused. Each review comes with a written report plus a set of attack tests the client keeps and can rerun1.
Tweag Audit works on Cardano, and Tweag's High Assurance Software group runs the reviews2. Tweag operates as Tweag by Modus Create3. Since its first Cardano audit in late 2021, the group has reviewed decentralized exchanges, stablecoins, lending protocols, oracles (services that feed outside data such as prices to a blockchain), governance rules, and a constitution script4 (code that checks certain Cardano governance actions against limits set in the constitution). Clients named in the register include Input Output, Intersect, and the Midnight Foundation2.
Key Features
- Attacks tested in code, not only read by eye. Tweag Audit reviewers read specifications and code by hand1, then write automated scenarios that try known tricks such as stealing funds sent to a contract or duplicating tokens across many transaction sequences4.
- Tests the client keeps. An engagement delivers audit code built on Tweag's open-source cooked-validators library, which the client's developers can rerun as regression tests (checks that catch old bugs coming back) after changes1,5.
- Findings ranked by severity. Reports sort each concern by type and pair it with suggestions1. Tweag's audit retrospective says every report uses the same five-level severity scale, from Critical down to Lowest4.
- Reports to read before hiring. Full reports covering projects such as Minswap, Djed, Marlowe, and Cerra are published in Tweag's public audit reports repository on GitHub6.
- Support for several contract languages. Tweag's testing library works with Plutus and with any language that compiles to Cardano's low-level script format, such as Plutarch or Aiken5.
What to Expect
For project teams, Tweag's homepage points to hello@tweag.io3. The Cardano audit best-practice guidelines in CIP-0052 list Tweag among the smart contract audit firms that supported them, with sales@tweag.io as its contact7. A project sends its specification documents and code, and the review runs a few weeks with ongoing dialogue between the audit team and the project's engineers1. The Cerra report covers the on-chain validation code (the contract logic that runs on the blockchain itself), not the website or app a user clicks through8. The Marlowe review also checked a formal model of how contracts should behave4.
For users checking a project they plan to use, the audit register lists each review by date, product, client, and contract language, with a link to the full report where one is public2. The Tweag Audit register lets readers confirm whether a project's claimed Tweag review exists.
For developers, Tweag's blog explains the method in depth, including a walk-through of a full audit1 and a post on scheduling attacks along a sequence of transactions9. It also carries a public post-mortem on Tweag's first Minswap audit, which explains a critical flaw the review missed and how the bug worked10. The cooked-validators library is free and open source, so developers can run the same style of attack tests on their own contracts5.
