RPC & API Exposure
Public RPC endpoints are common attack vectors. We review authentication, authorization, rate limiting, input validation, admin method isolation, and information leakage through debug endpoints.
Service
Node Security
A secure protocol can be undermined by a vulnerable node. We assess RPC exposure, key storage, privilege separation, resource limits, and the attack surface of client software.
Key Storage & Signing
Validator keys are high-value targets. We evaluate whether keys are stored in memory, on disk, in HSMs, or threshold modules, and how signing requests are authenticated before release.
Runtime Hardening
Container escape, privilege escalation, supply chain, and dependency vulnerabilities can compromise a node regardless of protocol correctness. We review hardening, monitoring, and incident response readiness.
Resource Limits
Without resource limits, a node can be crashed by malformed blocks, large transactions, or aggressive peer traffic. We test parsing limits, memory caps, and CPU-bound validation paths.