What Zellic does

Zellic is a private security audit firm founded in 2020 and headquartered in an undisclosed Commonwealth-style jurisdiction (legal entity Verabit Labs Ltd., with a US Zellic Inc. entity also referenced). It specializes in security assessments for emerging technologies, with a primary focus on Web3 and blockchain: EVM smart contracts, Move (Aptos/Sui), Solana programs, Cosmos SDK appchains, ZK circuits, applied cryptography, cross-chain bridges, DeFi primitives, and L1/L2/rollup infrastructure. The firm operates a consultative, quote-based engagement model staffed by multiple engineers plus a dedicated Engagement Manager, with daily client communication. Engagements span one-off file/contract reviews, comprehensive security assessments, and long-term retainer relationships, priced per engagement via a 'Request a quote' flow.

Its core product is the Zellic Security Audit, delivered using a combination of manual code review, formal verification (Lean, Rocq), static analysis, fuzzing, and an in-house AI-agentic software auditing tool publicly credited with discovering CVE-2026-46300 (Fragnesia) and co-discovering CVE-2026-31635 (DirtyDecrypt) in the Linux kernel. Supporting proprietary technology includes Forky (a fork-vs-parent diff tool hosted at forky.zellic.io), the Zellic GitHub App for repository access, and a Zenith sub-brand for traditional private audits. In August 2024, Zellic acquired Code4rena — a competitive audit-contest marketplace with 10,000+ registered auditors — and in June 2025 committed to running all Code4rena competitions at zero platform fee as a public good. Zellic also operates as the #1 validator by voting power on Injective, recycling staking rewards into audit credits for the Injective ecosystem.

Zellic's customers span marquee crypto-native clients (Mysten Labs/Sui, LayerZero, Solana Foundation, Aptos Labs, StarkWare, Wormhole, Hyperliquid, Wintermute, Pyth Network, Uniswap Foundation, Ondo Finance, 1inch, Yuga Labs, Cosmos SDK) and smaller startups (Axiom, Scroll, Ambient Finance, Ante, Omni, Succinct, Polymarket, Monad, Morpho, Ethena, Berachain, Biconomy, Mantle, Privy, Protocol Guild, Pharos). The company describes itself as profitable and was reported by TechBullion among the top AI auditing tools for Web3 smart contracts in 2026.

Name

Zellic

Legal name

Verabit Labs Ltd.

Website

https://zellic.io

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

Zellic is a private security audit firm specializing in Web3 and emerging technologies. It delivers manual review, formal verification, fuzzing, and AI-assisted vulnerability discovery across EVM, Move, Solana, Cosmos, and ZK ecosystems, serving crypto-native clients from marquee L1s to early-stage startups.

Ownership category

akta.pro rank

Product category

Blockchain / Web3 Security Audits

NAICS

Custom Computer Programming Services (541511)

SIC

Services-Computer Programming Services (7371)

akta.pro primary industry

Smart Contract Auditing & Formal Verification (FSAPAJAA)

akta.pro secondary industries

Smart Contract Security Tooling (static/dynamic analysis, formal verification) (FSAPABAI), Security Testing Tooling (SAST/DAST for smart contracts, fuzzing) (FSAPAJAK)

Keywords

• Smart contract audits
• Blockchain security services
• Zero-knowledge circuit audits
• Formal verification security
• Web3 protocol audits

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Traditional private security audits: Primary revenue stream: bespoke, paid private audits sold to clients via Zellic and a related brand 'Zenith'. Pricing is quote-based; engagements can be one-off assessments or long-term retainer-style relationships.
2. Code4rena audit competition platform: Marketplace for competitive audit contests with a 96% conditional prize pool, 4% QA pool, and a separate judging fee paid to independent judges. Platform fee is currently zero; revenue is not extracted from contests themselves but the platform is positioned as a talent pipeline for Zellic/Zenith private audits.
3. Pro-bono audits: Selective free audits (e.g., for Protocol Guild) used as community-goodwill marketing rather than a revenue stream.
4. Validator operations on Injective: Zellic operates a validator on the Injective network, converting staking rewards into audit credits spent on Injective Core and ecosystem-project reviews — an indirect, value-recycling revenue model tied to its audit business.

Pricing tiers

Go-to-market motion4 records

Distribution channels5 records

Marketing channels7 records

Core offering

Zellic sells bespoke security audits for emerging-technology codebases, with a primary focus on Web3 protocols: EVM smart contracts, Move (Aptos/Sui), Solana, Cosmos SDK, TON, Zero-Knowledge circuits, cross-chain bridges, DeFi primitives, applied cryptography, wallets, secure enclaves, and web applications. Audits combine manual review, static analysis, dynamic analysis, formal verification, fuzzing, and an internally developed AI-agentic auditing tool, delivered as long-term engagements, comprehensive security assessments, or ad-hoc file/contract reviews via a quote-based, consultative sales motion.

Product overview

Zellic operates a specialized security audit firm for emerging technologies, centered on its core Zellic Security Audits service and augmented by the Forky fork-identifier web tool. The portfolio spans EVM, ZK circuits, Move (Aptos/Sui), Cosmos SDK, Solana, L1/L2/rollups, cross-chain bridges, and DeFi primitives, with the acquired Code4rena competitive audit contest platform enabling the Audits+ integrated service that pairs consultative and competitive approaches. Supporting products include the Zenith private-audit sub-brand and the monthly Zellic Security Roundup newsletter, all underpinned by in-house AI-agentic software auditing tooling (publicly credited with discovering the Fragnesia Linux kernel LPE) and formal verification / static analysis / fuzzing capabilities.

Differentiator

Problem solved

Functional benefit

Brands

• Forky: Online tool that identifies important differences between a fork of a known protocol and its parent, providing plain English annotations for each function to help understand the impact of code changes.
• Zenith
• Code4rena

Products and services

• Zellic Security Audits Quote-based, consultative security audit engagements for emerging-technology codebases (primarily Web3 protocols), with each engagement staffed by multiple engineers and a dedicated Engagement Manager providing daily client communication and a quality-control layer.
• Audits+ integrated service Hybrid audit product pairing Zellic's consultative audits with Code4rena's competitive audit-contest model, giving clients a combined consultative-plus-competitive engagement as a single contracted deliverable.
• Code4rena audit competition platform Marketplace for competitive smart-contract audit contests where independent auditors compete to find vulnerabilities, with prize pools funded by sponsoring protocols; acquired by Zellic in August 2024 and operated independently as a public good at zero platform fee.
• Forky web tool Publicly hosted web tool at forky.zellic.io that identifies important differences between a fork of a known protocol and its parent, producing plain-English annotations for each function so users can understand the impact of code changes; self-developed by Zellic.

Quantifiable outcome

• 247 critical, product-killing vulnerabilities prevented from shipping in 2025
• +5 more outcomes

Named customers31 records

Segments6 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

AI capability7 records

Feature4 records

Partnerships

Seven partnerships are on record, tiered major ecosystem partnership, mid-tier distribution channel, adjunct / ecosystem participation, mid-tier / pre-launch engagement, flagship / core acquisition, flagship / core and advisory / governance role.

• Ethereum Foundation (Trillion Dollar Security Initiative)major ecosystem partnershipStrategic or Co-development Partner · 14 April 2026Zellic joined the Areta audit-subsidy marketplace launched by the Ethereum Foundation on April 14, 2026, providing subsidized smart-contract audits (up to 30% of fees covered) for Ethereum mainnet builders as part of the $1M Trillion Dollar Security Initiative.
• Areta (audit marketplace)mid-tier distribution channelChannel Partner/ Reseller/ Distributor · 14 April 2026Zellic is listed as a participating provider on the Areta marketplace, which distributes Ethereum Foundation audit subsidies (up to 30% of audit fees) to Ethereum mainnet builders on a first-come basis.
• Mastercard Crypto Partner Programadjunct / ecosystem participationGTM or Marketing Partner · 10 March 2026Mastercard announced a Crypto Partner Program bringing together 100+ crypto-native companies, payments providers, and financial institutions to integrate digital assets with card rails. Source is the Mastercard announcement; Zellic is named in the program's partner ecosystem.
• Pharos Networkmid-tier / pre-launch engagementStrategic or Co-development Partner · 29 January 2026Pharos announced Zellic (alongside Alibaba Cloud and AWS) as a security partner ahead of its mainnet launch. The partnership covers enterprise cloud security, blockchain audits, penetration testing, and real-time monitoring.
• Code4renaflagship / core acquisitionStrategic or Co-development Partner · 22 August 2024Zellic acquired Code4rena (its competitor) on August 22, 2024 — its first acquisition. Code4rena continues to operate independently. The combined entity introduced 'Audits+', integrating consultative (Zellic) and competitive (Code4rena) audit approaches. Code4rena's 10,000+ registered auditor community serves as a talent pipeline for Zellic/Zenith. Backed by Paradigm.
• Injective Foundationflagship / coreStrategic or Co-development Partner · 1 January 2024Injective enlisted Zellic in 2024 to conduct security audits for Injective Core and ecosystem projects. Zellic has since become Injective's top validator by voting power, converting staking rewards into audit credits for the Injective ecosystem. Zellic was named in the first cohort of Injective's Validator Rebate Campaign (May 2025).
• Uniswap Foundation (Bridge Assessment Committee)advisory / governance roleImplementation/ SI/ Consulting Partner · 1 February 2023Zellic's CTO Jasraj Bedi served on the Uniswap Foundation's Bridge Assessment Committee (convened February 2023) that evaluated six cross-chain bridges and approved two for the DAO's cross-chain governance use case.

Scale indicators10 records

Recent moves6 records

Expansion highlights7 records

Direct peers

• Spearbit: Web3 security firm built around an independent auditor network model conceptually similar to Zellic's Code4rena channel; competes head-to-head on Solidity, Move, and Solana audits.
• Cantina: Audit marketplace and security firm running competitive audit contests; direct competitor to Code4rena and consultative audit work for Web3 protocols.
• Cyfrin: Web3 security firm offering smart contract audits and security education (updraft.cyfrin.com); directly comparable on EVM/Solidity audit services and developer-relations-driven GTM.
• ChainSecurity: Blockchain security firm with strong formal verification and smart contract audit practice, including work on the Ethereum 2.0 spec; comparable to Zellic on technical depth and protocol-level engagements.
• Trail of Bits: One of the most established blockchain security firms, offering smart contract audits, cryptography, formal verification, and applied security research with a comparable marquee client roster across EVM, Cosmos, and ZK ecosystems.
• OpenZeppelin: Major Web3 security firm combining smart contract audits with security tooling (e.g., Defender, Forta); directly comparable to Zellic on customer profile, EVM expertise, and enterprise security services.
• Runtime Verification: Formal verification-focused firm with a dedicated blockchain security practice (incl. Move prover and KEVM work); closely matches Zellic's formal verification, static analysis, and fuzzing stack across L1s.
• Quantstamp: Established Web3 security firm providing audits across EVM, Solana, and Move ecosystems, plus automated security tooling; comparable to Zellic on multi-chain audit coverage and long-standing enterprise relationships.
• Certora: Formal verification tooling and security services firm for smart contracts; comparable to Zellic on its use of proof assistants (Lean, Rocq), SMT solvers, and high-assurance audits for DeFi protocols.

Regional players

• SlowMist: Web3 security firm with deep coverage of Asian crypto projects, offering audits, on-chain threat monitoring, and incident response; comparable service mix to Zellic but primarily focused on Asia-based protocols.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/zellic_io
• GitHubgithub.com/zellic
• LinkedInlinkedin.com/company/zellic

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A1 record

Investments1 record

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Zellic