Hey community!
This is Stefan from Oak Security. Oak Security has performed over 600 audits since 2017. Over the last year, we have performed numerous security audits of various projects in the Polkadot ecosystem, for teams such as Hydration, KILT, Zeitgeist, Mythical Games, Bifrost, Snowbridge, and of several ink! smart contracts. We also have deep experience auditing various virtual machines and low-level technologies, e.g., Filecoin’s EVM, CosmWasm, the Gno language and virtual machine, and Stellar’s Soroban language and virtual machine.
We are now proposing an 8-week security audit of ink! v6 for a total fee of 244,800 USD.
We truly value the thoughts and perspectives of the community, as they help guide the direction of the entire ecosystem. Before moving this proposal forward to the referendum stage, we wanted to share it openly here. Your feedback and insights are essential in ensuring we align with the broader needs of the ecosystem!
As we finalize our treasury proposal for the ink! v6 security audit, we wanted to share more about the direction this initiative is taking. ink! v6 will introduce a shift to RISC‑V execution, migration from pallet‑contracts to pallet‑revive, and integration of PolkaVM compatibility and Solidity ABI support. These changes expand the attack surface and could introduce vulnerabilities not seen in earlier releases, so an independent security review is critical.
Over the past 6 months, we’ve had several iterations with members of the ink! Alliance and R0GUE teams - including Michi Müller and David Semakula. What we present here reflects the outcome of these discussions and the alignment between our teams.
We believe a focused 8-week audit, executed by two teams in parallel, is the best way to ensure depth and coverage. The audit will be executed by two teams of three senior security researchers each, using Oak Security’s signature blinded review process.
Here is how the audit is structured:
-
4 two‑week sprints, executed by two teams in parallel.
-
Each sprint is staffed with 3 senior security researchers.
-
Sprint planning to prioritize items from a backlog provided by the ink! Alliance.
-
Blinded code review: auditors independently review the codebase, ensuring each line is covered by multiple researchers.
-
Interim report at the end of each sprint detailing findings and recommendations.
-
Remediation review: Auditors are available for five weeks to discuss and verify fixes.
-
Final report published under a Creative Commons licence in Oak Security’s public audit repository, with findings presented to the community.
We believe this audit will strengthen trust in ink! v6, mitigate ecosystem‑wide risks and provide actionable security improvements for developers. Please read our full proposal for details on budget and scope, and share your feedback and questions so we can prioritize the areas that matter most to you.
Many thanks!
Stefan
.