QuillAudits

Scan your smart contracts before attackers do.

We are opening beta access to QuillShield, our multi-agent auditor for EVM smart contracts, for the first 50 teams.

October has made it clear that waiting is no longer an option. In the last few days alone:

• PHP: pre-auth remote code execution, CVSS 9.2
• GitLab: CVSS 10, self-hosted servers back to 2014
• Node.js: 10 CVEs in one release
• Railway: customer secrets accessed
• LiteLLM: credential stealer shipped on PyPI

AI helped find some of these bugs, and attackers have the same tools.

A bug in a deployed smart contract can drain funds in a single transaction, so we built QuillShield to find them first. Here's what it has done so far:

> 25 Critical or High vulnerabilities caught across 155 projects

> 497 findings, with 85% of auditor-reviewed ones confirmed valid

> 350,000+ lines of Solidity reviewed

> 83.8% on EVMBench, against 45.6% for the best published model

Here's the beta link: shield.quillaudits.com

We are hiring at @EFDevcon.
Booth is set up at the Career Fair today,

Roles in security, BD and marketing. Interns, juniors and mid level folks all welcome.

Building something onchain?
Come by and grab QuillShield access for your team too.

Binance lost $6.34B last week without a single private key leaking, because its MPC signers signed what a compromised laptop asked them to sign.

Bybit lost $1.5B the same way in February 2025, when its multisig signers approved a transaction that did something very different from what their screens showed.

In both cases the multi-party setup protected the keys exactly as designed, and in both cases nobody was checking what was being signed.

The weakness sat in day-to-day operations, in questions that most teams never write down: who can reach the signer, what gets checked before a signature goes out, where the signers devices live, and how quickly you can revoke access when something goes wrong.

Our auditor @phoenix244001 breaks down how to set this up properly, today at @EFDevcon:

Multi Sig OPSEC in Decentralized Infrastructure

📍Wed, Nov 4 · 10:00 IST · Security Hub DevCon

If you run a multisig and you're at Devcon, come say hi after the talk.

In Mumbai this week? So are we 👋

Catch QuillAudits across @IBWofficial, @summit_defi, @SolanaSummitOrg, Security Hub and Ready for the Run.

We’re also hosting The Institutional Table on 5th Nov.

Come say hello. Full schedule:
meet.usepulse.club/devcon8/events

🚨 @Polymarket has been exploited for ~$2.7M, drained from 700+ user accounts on Oct 29.

The international platform (Polymarket.com) was hit. Polymarket US was unaffected and the smart contracts were untouched. Funds were pulled in about an hour (17:10–18:10 UTC) before the exchange went into cancel-only mode.

Attacker: polygonscan.com/address/0x3F99…