About

Every review starts from the deployed, verified source — the exact code running on-chain, not a repository that may have drifted from it. Candidate findings are reproduced on a local fork of mainnet. If an issue can't be demonstrated with a test that actually runs, it doesn't go in the report. That single rule is what separates a finding from a guess.

Automated tools catch shallow, well-known patterns. The issues that actually drain protocols tend to live in the seams — accounting that slowly drifts from reality, oracles that misbehave at the edges, invariants that hold in one contract and break when two interact. That's the territory this practice focuses on:

• ›EVM internals — storage layout, transient storage (EIP-1153), proxy and upgrade mechanics
• ›Lending and CDP systems — liquidations, collateral accounting, interest accrual, bad-debt paths
• ›Oracle behaviour — staleness handling, price decay, manipulation surfaces
• ›Flash-loan and atomicity attack surfaces

Nexus Trinity also runs a free public tool at nexustrinity.io/check. Paste a contract address and it maps every privileged power the owner has — mint authority, transfer restrictions, upgrade paths — each cited to the exact function. Paste a wallet address and it reads real on-chain activity: balance, transaction count, wallet age. It covers 23 chains. It is a pre-screen, not a substitute for a real review.

A single number can't carry what a privilege map can. Nexus Trinity has never shipped a risk score or a "safe" badge — not on the free tool, not in a paid review. A score invites trust in the score-giver, not in the code. Every output here is a function-cited fact you can check yourself, not a grade you have to take on faith.

Honesty is the product. A few lines we hold to, so you know what you're getting:

• ›We work only from publicly available, verified source and local forks. We never touch live systems.
• ›We report findings with proof. We never certify that software is “safe” — no honest reviewer can.
• ›When we disclose an issue to a team, it's private and good-faith, with no pressure attached.

Nexus Trinity is run by Michael S Ross, with Jennifer McCleskey as COO. Every audit record it produces is signed with a real, published key and independently timestamped — see how that works and the current honest self-score against an external standard, not one we wrote ourselves.