NEWMethodology v3.3 is open for public comment.Read the draft →
About Press Ratings Partners Compare Watchlist Advertise
Onyx
07 · Marketplace

Vetted providers for serious Web3 projects.

Compliance, smart-contract audits, tokenomics design, legal counsel, founder training. We don't deliver any of these services — we connect projects with providers reviewed against the same independence standards as our ratings.

Browse providers Apply to be listed ↑ 14d to list · 22% acceptance rate
Vetted providers
182
5 service categories
Mandates completed
1,408
via Onyx leads · 12 mo
Jurisdictions served
41
across 6 regions
Avg client rating
★ 4.68
verified buyers only
Service categories

Five disciplines. One vetting standard.

Every provider is reviewed for independence, work-product quality, jurisdictional fit, and past-client outcomes before being listed.

Smart contract audits
Pre-deploy & ongoing review of Solidity, Move, Rust, Cairo. Critical-finding remediation included.
48 providersFrom $42k
→
Compliance & legal
VARA, MiCA, MAS, FinCEN. Licensing, structuring, ongoing counsel for token-issuing entities.
36 providersFrom $18k
→
Tokenomics design
Token model design, simulation, agent-based market modeling, launch parameter selection.
29 providersFrom $24k
→
Training & education
Founder bootcamps, operator programs, compliance training for token issuers.
18 providersFrom $4k
→
Marketing & growth
Onyx-vetted growth firms with declared independence policies. No ghostwritten "research."
51 providersFrom $12k
→
How vetting works

Provider listing is editorial, not commercial.

Providers pay a fixed application fee that does not affect outcome. Acceptance rate is published quarterly. Currently 22%.

01

Application & documentation

Firm credentials, sample work product, jurisdiction of practice, conflict-of-interest disclosures, three past-client references.

02

Independent review

Onyx editorial reviews submissions against published criteria. Two reviewers per file; dissents recorded.

03

Reference verification

We contact each named past client directly. The provider does not see what was said. Quotes published with permission, attributed when authorized.

04

Quarterly re-vetting

Listings expire annually. Active complaints, jurisdictional changes, or new public actions can trigger immediate review.

Featured · this month

The providers we'd hire ourselves.

All 182 providers →
Halborn Security
✓Vetted
Smart-contract audits · USA · since 2019
"Worked with our team for the v3 audit. The remediation document alone was worth the engagement. They challenged us where we needed it." — vitalik.eth · Lead, EthSign · verified buyer
Mandates
142
From
$42k
Response
< 48h
★ 4.9 · 142 reviews
Request consultation
Outlier Ventures Legal
✓Vetted
Compliance & legal · UAE · since 2017
"They handled our MiCA filing end-to-end. Comprehensive, with realistic timelines from day one. No surprise scope creep." — Anonymous · CFO, top-50 protocol · verified buyer
Jurisdictions
31
From
$18k
Response
< 24h
★ 4.8 · 89 reviews
Request consultation
Gauntlet
✓Vetted
Tokenomics & simulation · Global · since 2018
"Their agent-based simulation framework caught issues with our liquidity-mining design we hadn't even modeled for. Cost paid back many times over." — stani.eth · Co-founder, Aave · verified buyer
Launches
86
From
$48k
Response
< 72h
★ 4.9 · 64 reviews
Request consultation

Are you a Web3 service provider?

Vetting accepts about one in five applications. We don't optimize for volume — we optimize for the kind of reputation that makes a Halborn or Gauntlet referral mean something.

Apply to be vetted Read criteria
08 Screen — Category · Smart Contract Audits onyx.dev/marketplace/audits
Marketplace / Smart contract audits
48 vetted providers

Smart contract audits.

Pre-deploy and ongoing review for Solidity, Move, Rust, Cairo. Filter by jurisdiction served, deal size, language, and specialization. Every provider is reviewed against our independence standards before listing — no provider has equity, advisory, or token relationships with their listed clients.

Avg engagement$84k
Median lead time4 weeks
Avg client rating★ 4.71
Mandates completed via Onyx · 12 mo418
Showing 1 – 4 of 48 providers
Halborn Security ✓Vetted · since 2024 USA · since 2019

Full-spectrum smart-contract security: pre-deploy audits, ongoing retainer, incident response. 142 mandates across L1/L2 contracts and bridge infrastructure. Specialization in cross-chain messaging. Founding team from former offensive-security backgrounds.

Solidity Bridges DEX Lending Move +6 more
Rating
★ 4.9 · 142 reviews
Engagement from
$42,000
Lead time
3–4 weeks
Responds < 48h
Request consultation
Threadbits Research ✓Vetted · since 2024 USA · since 2012 (Web2) · since 2018 (Web3)

Veteran security research firm with bench depth in formal verification, fuzzing, and adversarial testing. Best-fit for protocols handling > $100M TVL or with high blast-radius if exploited. Selective acceptance — runs at ~40% of submitted RFP capacity.

Formal verification Rust / SVM ZK circuits Adversarial testing
Rating
★ 4.9 · 68 reviews
Engagement from
$84,000
Lead time
6–10 weeks
Responds 3–5 d
Request consultation
Quartzlab Auditing ✓Vetted · since 2025 Germany · since 2020

EU-based audit firm with deep MiCA-compliance awareness — useful for projects that need both a security review and structural recommendations on how the contract design fits within the EU regulatory perimeter. Particularly strong on token-issuance contracts.

Solidity MiCA-aware Token issuance Lending
Rating
★ 4.7 · 42 reviews
Engagement from
$36,000
Lead time
2–4 weeks
Responds < 24h
Request consultation
Sparrow & Co. ✓Vetted · since 2025 Remote · since 2022

Three-person boutique. Practical-economics-of-attack approach over checklist auditing. Best fit for projects between $5–50M TVL that want a substantive review without paying enterprise rates. Founder, ex-Sigma Prime.

Solidity DEX DeFi primitives NFT
Rating
★ 4.8 · 18 reviews
Engagement from
$22,000
Lead time
2–3 weeks
Responds < 24h
Request consultation
09 Screen — Provider detail · Halborn Security onyx.dev/marketplace/provider/halborn
Marketplace / Smart contract audits / Halborn Security

Halborn Security

✓Vetted · since 2024 · Smart-contract audits · Florida, USA · Founded 2019 · halborn.com ↗
4.9/5
★★★★★
142 verified reviews

About

Halborn Security is one of the most active independent audit firms in Web3. They combine offensive-security DNA (the founding team comes from Web2 penetration testing) with deep smart-contract specialization, and they offer the only credible bench for cross-chain bridge work outside of in-house teams at L1s.

What we like: their remediation document — the deliverable that comes back after the initial audit — is consistently the best in the industry for actionable specificity. Their findings are paired with proof-of-concept code, and they will follow up post-deployment for an additional fee to verify that fixes hold under production conditions.

What to know: Halborn is a premium-priced firm. Engagements rarely come in below $50k. If your contract is sub-$5M TVL or stateless, you may not need them — boutique providers in the same category cover that volume capably for less.

Specializations

Cross-chain bridges
Messaging · liquidity · finality
42 mandates
DEX & AMM
Order routing · MEV protection
38
Lending protocols
Liquidation logic · oracle risk
28
Restaking & AVS
Slashing semantics · validator security
12
Token issuance
Vesting · governance · upgrade paths
14
Incident response
Post-exploit forensics · recovery
8

Team

Halborn maintains a bench of 32 auditors. The five named below typically lead engagements; you will know who is assigned to your audit at scope signing.

Steven Walbroehl
Co-founder · CTO
Rob Behnke
Co-founder · CEO
David Schwed
COO
Roberto Reigada
Audit Lead · Bridges
Alex Mota
Audit Lead · DeFi
+ 27 other auditors
Full bench at halborn.com

Sample work

Halborn publishes all engagement reports with client consent. Selected recent reports below — full archive at halborn.com/reports.

Uniswap v4 — hooks audit · Mar 2026
2 medium · 5 low · all resolved · 4-week engagement
Public report ↗
EigenLayer — slashing module · Jan 2026
1 high · 3 medium · 4 low · all resolved · 7-week engagement
Public report ↗
Anonymized · top-10 L2 bridge · Q4 2025
Pre-deploy · 2 high reported · client requested anonymization
Summary only
Phantom — extension wallet · Aug 2025
0 high · 2 medium · 6 low · all resolved · 5-week engagement
Public report ↗

Past clients

Selected clients whose engagements have completed and who consented to disclosure. Plus a number of anonymized engagements per client confidentiality.

UN
Uniswap
EL
EigenLayer
PH
Phantom
CB
Coinbase Wallet
AV
Aave
CP
Compound
MK
MakerDAO
+ 134 anonymized engagements

Client reviews · 142

4.9/5
★★★★★
142 verified buyers · all reviews wallet-signed
vitalik.eth
Lead · EthSign · verified buyer · engagement Q3 2025
★★★★★
"Worked with the bridge team for our v3 audit. The remediation document alone was worth the engagement — they challenged us where we needed it and didn't waste time on the wrong things. The auditors had clearly read the protocol before kickoff, not during it. Would hire again."
Sep 18, 2025· 84 helpful· $128k engagement
Anonymous
CTO · top-10 DEX · verified buyer · engagement 2024
★★★★★
"What set Halborn apart from the four other firms we evaluated was their willingness to engage on protocol-level design choices, not just on contract correctness. Two of their suggested architectural changes saved us a refactor 18 months later."
Mar 04, 2024· 62 helpful· $84k engagement
stani.eth
Co-founder · Aave · verified buyer · engagement 2023
★★★★★
"Strong technical work. One process complaint: the timeline for our v3 engagement slipped by three weeks against the scope agreement, with weekly status updates that didn't surface the slippage until late. Final product was excellent — just plan for some elasticity."
Nov 12, 2023· 48 helpful· $96k engagement