Overview
TxPipe Audit is a security review service that checks smart contracts, the self-running programs that hold and move money inside blockchain apps, for bugs and loopholes. Teams building those apps hire it to find ways an attacker could steal funds, lock them up, or halt the app1. The same review also looks for ways to make the code run more efficiently2.
The service is run by TxPipe, a software company that builds open-source developer tools for Cardano and describes itself as the original home of Aiken, a programming language for writing Cardano smart contracts1. TxPipe Audit reports carry a "TxPipe Shop" label on the cover1. The TxPipe reports listed in Input Output's Cardano audit index cover contracts written in Aiken3.
Key Features
- A hunt for the ways money can be lost. Reviewers examine each validator, the piece of code that decides who may move funds, for theft, protocol halts, and corrupted data. They also test for known Cardano traps such as double satisfaction, where one payment is used to fool several checks at once1.
- Human review backed by automated testing. TxPipe's audit offer combines manual code reading with automated tests, and it covers performance as well as security2.
- Advice while the design is still flexible. Sundae Labs brought TxPipe in to review its SundaeSwap v3 contracts before they were finalized. TxPipe suggested concrete changes, such as a cheaper way to handle square roots when creating a new trading pool, that cut costs4.
- Graded, trackable reports. Each finding gets a severity grade of Critical, Major, Minor, or Info, along with a recommended fix and its resolution status1. TxPipe writes its reports as code with Typst, a typesetting tool, so report revisions are tracked on GitHub1,5.
- Reviewed code behind Cardano treasury programs. Intersect, which administers the Cardano Critical Integrations program, lists a TxPipe audit among the independent audit reports for the smart contracts that hold treasury funds6.
What to Expect
For project teams, the TxPipe homepage lists audits under Professional Services, next to smart contract development. A "Book a meeting" button leads to a contact page with a message form, an email address, and a Discord invite2,7. TxPipe offers three ways to structure the work: a fixed budget, time and materials (paying for the hours worked), or team augmentation, which adds TxPipe engineers to a client's own team2.
During an engagement, TxPipe shares findings with the client over Discord as they come up. The final report records which files were reviewed, explains each problem with a recommended fix, and includes diagrams of how transactions must be built to use the contracts correctly1.
For users and researchers, Input Output's index names clients such as Splash, SundaeSwap, Strike Finance, Masumi, and Nuvola, and it links the SundaeSwap report from txpipe-shop/sundae-swap3. Andamio, a platform for issuing digital credentials that can be verified anywhere, publishes its V2 protocol report in its own documentation1.
