Skip to content
NamadaSecurity operations

Priced before the work, not after it

Three shapes of engagement, each scoped in writing and quoted as a fixed number before a contract exists. Below the tiers: what each one covers, what it leaves out, how a retainer differs from a one-off audit, and the four things that move a quote.

Book a consultation

Pick the shape that matches how often you ship

No discovery-call funnel and no day-rate surprises. Each tier below is a complete description of the work, including the parts it does not cover.

On-Demand Audit

$12,000per engagement

For protocol launches and pre-mainnet gate reviews.

  • Up to 5,000 lines of in-scope code
  • Manual review plus symbolic execution
  • Runnable proof-of-concept per finding
  • Two-week remediation retest window
  • Signed report for investors and exchanges
Scope an audit
Enterprise ContinuousMost adopted

$4,800per month

For teams shipping to production every week.

  • Unlimited repositories under monitoring
  • Every pull request inspected before merge
  • Auto-generated patch PRs with regression tests
  • Bug bounty triage and duplicate filtering
  • Named researcher and 4-hour critical SLA
  • Quarterly executive posture review
Talk to security
Agency Retainer

Customannual agreement

For consultancies white-labelling our analysis.

  • White-label reports and client portal
  • Volume pricing across engagements
  • API access for your own tooling
  • Co-branded methodology documentation
  • Dedicated Slack Connect channel
Request terms
  • All engagements run under a signed scope and rules-of-engagement document.
  • Source code is deleted 30 days after report delivery unless you ask us to retain it.
  • Findings that cannot be reproduced are never billed as findings.

What each tier includes, and what it does not

The features on a card are a summary. This is the same ground with the edges drawn in, because most of the cost of the wrong engagement is discovered in the gap between what a card implied and what it said.

On-Demand Audit

$12,000 · per engagement

One codebase, one review window, one report you can hand to somebody else.

Included
  • Up to 5,000 lines of in-scope code, across the repositories named in the scope agreement.
  • Manual line-by-line review, supported by symbolic execution and a fuzzing campaign against the invariants declared in scope.
  • A runnable proof of concept for every confirmed finding, in Foundry or Anchor.
  • A two-week remediation window: each fix is re-tested and the report is updated, rather than a second document issued.
  • A signed report with severity, impact and reproduction steps, written for an investor, an exchange or your own engineers.
Not included
  • Continuous monitoring between releases. A second review six months later is a second engagement.
  • Patch pull requests committed into your repository. That work belongs to the continuous tier.
  • Bug bounty triage of inbound reports.
  • Work outside the agreed scope — a second repository, a new chain, or a redesign that lands mid-review is quoted as an increment.

Enterprise Continuous

$4,800 · per month

The risk sits in the diff, so this reviews the diff, every time.

Included
  • Every repository you nominate, monitored continuously rather than reviewed once.
  • Every pull request inspected before merge, with findings attached to the change that introduced them.
  • Auto-generated patch pull requests, each carrying a regression test that fails before the fix and passes after.
  • Bug bounty triage: parsing, CVSS v3.1 scoring and duplicate filtering before a human opens the report.
  • A named researcher, a four-hour response on critical findings, and a quarterly posture review with your team.
Not included
  • A from-scratch audit of a codebase we have never seen. Continuous review follows your changes; a standing manual review of 5,000 lines is the on-demand tier.
  • Merging the patches. We open the pull request; your team reviews and merges it under your own process.
  • A guaranteed number of findings. The report reflects what is there, which is sometimes very little.
  • White-labelling. Reports are written for your team to use directly, not to carry another brand.

Agency Retainer

Custom · annual agreement

Your name on the report, our engines and reviewers behind it.

Included
  • White-label reports and a client portal delivered under your identity.
  • Volume pricing that moves as your engagement count rises.
  • API access to the same engines the reports are produced from.
  • Co-branded methodology documentation you can show to your own clients.
  • A dedicated Slack Connect channel with the researchers on your account.
Not included
  • Your client relationship. The work is delivered to you; we do not contract with your client directly.
  • Resale of the engines or the rule packs as a product of your own.
  • Our name on work we did not perform, or on findings we have not seen.
  • A fixed price per client engagement. Retainer terms are set against your volume, so we need your pipeline to quote them.

A retainer is not a bigger audit

They answer different questions, which is why they are priced differently rather than at two points on one scale. Most teams run a one-off audit first and move to a retainer once they are shipping every week.

A one-off audit answers a question with a date on it

You are about to deploy, list, or hand the code to somebody else, and you need a considered answer about a specific commit. The work is scoped in writing and priced before it starts, and it closes with a signed report. That report is a snapshot: it describes the code as it stood on the day it was reviewed, and nothing that lands afterwards is covered by it.

A retainer answers the same question every week

You merge continuously, so the risk sits in the diff rather than in a snapshot, and there is no closing document because the work does not close. Findings arrive attached to the change that introduced them, patches arrive as pull requests your team merges under its own process, and the posture figure moves as the estate changes. It is priced as a subscription because it runs continuously — not because it is a larger audit.

Three commitments that sit behind every price

These hold on every engagement, in every tier. They are commitments rather than features, which is why they are set out here instead of being folded into a card.

All engagements run under a signed scope and rules-of-engagement document.

The document names the targets, the boundaries, the permitted techniques and the window in which testing may happen, and both sides sign it before any work starts. Nothing is touched until it is signed — including in a continuous engagement, where the scope is re-confirmed as repositories are added.

Source code is deleted 30 days after report delivery unless you ask us to retain it.

You do not have to take the retention window on trust: ask for the deletion record at any point and you will get it. If remediation needs the source kept longer, say so in the scope and it is held under the same access controls for as long as you need, and no longer.

Findings that cannot be reproduced are never billed as findings.

A candidate we cannot demonstrate against a running target is dropped from the report and from the count. It is not quietly downgraded to an informational line to keep the report looking substantial. If it is not a finding, it is not in the report.

Four things move the number

A price is an output of four inputs, not a rate card. Naming them is the honest alternative to a list that turns out to be a starting price — you can check each one against your own project before writing to us.

Scope review

We read the target before we quote it. What is in scope, what is explicitly out, and how the code is reached — a repository we can read, a signed archive, or a target list with test credentials. A price produced without reading the scope is a guess with a number on it, and it is the first thing that changes once work starts.

Code size

For a standalone audit the price tracks in-scope lines against the tier volume. 5,000 lines is the ceiling of the on-demand tier; above that we quote the increment rather than rounding you up to the next shape of engagement.

Language mix

Solidity, Vyper and Rust/Anchor are three separate rule packs, three sets of runtime failure modes and three lots of reviewer time. A repository that spans all three is three surfaces to review, and it is priced as three.

Timeline pressure

A window shorter than the work needs is priced one of two ways: extend the window, or put a second reviewer on it. We will tell you which we recommend and what it costs. Rush work is never quietly compressed into the same fee — that is how a review gets thin in exactly the places that matter.

What we do not charge for

  • The scope conversation and the written quote. Reading your scope, asking questions and pricing the work costs nothing and carries no obligation.
  • Retests inside the agreed remediation window. On a standalone audit the re-test after a fix is part of the engagement, not a new one.
  • Work we should not take. If the stack is outside what the rule packs cover, or the timeline cannot be met honestly, we say so and point you at someone who can.
  • Anything outside the signed scope without telling you first. If we find something the scope excludes, you hear about it before we spend your money on it.

The pricing questions people actually ask

The method questions — how the engines work, what the models do — are answered in full on the overview page.

How is this different from running Slither or a linter?

Static analysers are fast and cheap, and we run them. What they cannot do is tell you whether a flagged pattern is actually reachable and exploitable in your deployment. That is the one question the reasoning pass exists to answer, and it answers it in the direction of fewer findings: a candidate that cannot survive an argument for its own unreachability is dropped before it reaches your report.

What do you need access to?

The least that lets us do the work. For a repository audit that is read-only access to a specific repository, or a signed archive. For a web assessment it is a scoped target list and test credentials. We never request production write access, and we will not accept it if offered.

How fast is a typical engagement?

A continuous monitoring deployment is live within 48 hours of signing. A standalone audit of 5,000 lines runs five to ten business days from kickoff to delivered report, depending on how quickly remediation questions come back.

Do you cover Rust and Anchor, or only Solidity?

Both. The Solana rule pack targets the failure modes specific to that runtime — account confusion, arbitrary cross-program invocation, missing signer validation and unchecked lamport mutation — rather than reusing EVM heuristics that do not apply.

What happens after a finding is fixed?

The regression test that failed before your fix stays in the repository as a permanent gate. If the same class of bug is reintroduced later, CI fails and the finding reopens automatically with its original history attached.

The rest are on the overview page.

Send us the scope and we will price it

Tell us the target, the code size and the date you need the report, and you will get a written scope, a fixed price and a named researcher before any contract is signed.

Book a consultationRun the engine first