Dodu Security
Smart contract security review. Fixed fee, fixed date.
Andrei Dodu
Sweden
andrei@dodu.se
dodu.se
What I do
I review smart contracts and the systems around them before they hold money. The work is attacker-side: I find the path someone would actually take, prove it, and rate it by what it costs you. Solidity on EVM chains, Rust programs on Solana and Anchor, and the Rust and web layers around a protocol. One engagement at a time, and the person who scopes the work does the work.
Who it is for
Protocols with code about to ship and value about to arrive: a pre-launch token, vault, staking, lending market, perp venue or RWA settlement layer; a module that changed after a firm signed off; a team that wants a second opinion this week after a neighbour was exploited.
What you get
- Findings ranked by severity, with a runnable proof of concept for every High and Critical.
- A coverage statement naming the reviewed commit, the files and integrations covered, and what was out of scope.
- Fix verification by me. Each finding is marked Fixed, Partially fixed, Acknowledged or Not fixed, and I retest rather than take your word.
- A severity-rated report in PDF and Markdown, plus a 45 minute exit call with your engineers.
How an engagement runs
1 Scope and authorization
Day 0. Repo access, commit pinned, written scope, written permission to test, fee and dates fixed.
2 Review
Days 1 to 5, or 1 to 10. Manual review, threat model, invariant and stateful fuzzing where the code warrants it. One-line status each day.
3 Report
Day 5 or day 10. Findings ranked by real impact, with reproductions, recommendations and the coverage statement.
4 Fix review and retest
Up to 5 working days after your fixes land. Each fix verified and an addendum issued. A fix that moves the bug is marked as such.
What it costs
| Engagement | Scope | Delivery | Fee |
|---|---|---|---|
| Tier 1, pre-launch review | Up to 1,500 nSLOC, 1 to 3 contracts, 1 integration | 5 days | $6,500 |
| Tier 2, full protocol audit | Up to 4,000 nSLOC, up to 6 contracts, 2 integrations | 10 days | $18,000 |
| Security retainer | Monthly review window, deploy diffs, advisory | Monthly | $4,500 |
| Rust audit or web-app pentest | Quoted per scope from the same floor | Per scope | from $5,000 |
Non-EVM runtimes add 25%. Rush starts add 40%. The floor is $5,000. Scope and fee are fixed before kickoff. Payment is 50% on signature, 50% on delivery.
What I need from you
The repository and the commit you want reviewed, an architecture note, any prior audits, and one named technical contact who answers within a day. Kickoff is within 24 to 72 hours of the signed scope and repo access.
Who you are hiring
Andrei Dodu, security researcher and systems engineer in Sweden. I reported CVE-2026-28840, a local privilege escalation in macOS PackageKit that let an unprivileged app gain root, CVSS 7.8, fixed in macOS Tahoe 26.4. I build Hugin, 1.84 million lines of Rust offensive tooling, at hugin.nu. My background is bug bounty, where I learned to look for the chain rather than the checklist item.
How to start
Send the repository, the commit and your target date to andrei@dodu.se, or use dodu.se/contact. You get a one page scope with a fixed fee and a delivery date, usually within one working day.
Dodu Security is the trading name of Andrei Dodu. Every engagement is done by me, start to finish.