Skip to content
Infrastructure security reviews

Security reviews for your Web3 infrastructure

The systems around your nodes, validators, cloud and private keys.

Get infrastructure review quotesSee what it covers
in RFP budgets posted
$1.2M
saved, 44.5% vs single direct quotes
$525K
vetted firms quoting on the platform
70+
first quotes typically land within the hour
<1 hour

What an infrastructure security review covers

Select a layer of your infrastructure
Layer 01

Cloud and hosting

Cloud accounts, identity and access, network exposure and secrets. The blast radius of one leaked credential is set here.

What gets reviewed

IAM policies, network exposure, secrets storage, logging, account separation

  • Over-privileged roles and long-lived keys
  • Secrets in code, images or environment variables
  • Services exposed to the internet by mistake
Layer 02

Nodes and RPC

Your own nodes and the RPC providers you trust. Bad data from a node becomes bad decisions in every service that reads it.

What gets reviewed

Node hardening, RPC exposure, provider trust, failover

  • Admin RPC methods exposed publicly
  • A single RPC provider trusted for critical reads
  • Unpatched clients
Layer 03

Validators and staking

Validator keys, signing setup and redundancy. Mistakes here cost slashing, downtime or stolen stake.

What gets reviewed

Validator and withdrawal keys, remote signers, slashing protection, redundancy

  • Double-signing from a bad failover
  • Withdrawal keys stored with validator keys
  • Remote signers reachable from outside
Layer 04

Key management and signing

HSMs, MPC, KMS and multisig signing flows. Review covers how keys are generated, stored, used and recovered.

What gets reviewed

Key generation and storage, MPC and HSM setup, signing policies, recovery

  • Keys or shares stored together
  • Signers who can't see what they're approving
  • No policy limits on automated signing
Layer 05

CI/CD and deployment

Build pipelines, deploy keys and dependencies. Whoever controls the pipeline controls what users and contracts run.

What gets reviewed

Pipeline permissions, deploy and upgrade keys, dependency pinning, artifact integrity

  • Deployer keys stored in CI secrets
  • Malicious or hijacked dependencies
  • Pipelines anyone in the org can edit
Layer 06

DNS, domains and frontend hosting

Registrar accounts, DNS records and the hosting your frontend is served from. A hijacked domain serves a malicious app under your name.

What gets reviewed

Registrar security, DNS records and DNSSEC, CDN and hosting access

  • Registrar account takeover
  • DNS records changed without detection
  • Hosting or CDN credentials leaked

45firms on Procur3 offer cloud and infrastructure reviews, penetration testing or multisig and key reviews.

  • Hacken
  • Slot Zero Security
  • Hexens
  • AuditWare
  • Shred Security
  • Egis Security
  • Adevar Labs
  • Valkyri
  • Quantstamp
  • Paladin
  • Macro Security Audits
  • Codespect
  • HYDN Security
  • Guardian
  • Coinspect
  • +30 more

How it works

Get infrastructure review quotes
  1. 01

    Post

    Describe the systems in scope once.

  2. 02

    Compare

    Matched firms quote with method, timeline and named team.

  3. 03

    Select

    Award the review and track delivery in one place.

Who needs an infrastructure security review

If any of these is true, your risk sits partly outside your contracts.

  • You run validators or your own RPC nodesTheir keys and uptime are your responsibility.
  • You hold keys in MPC, HSMs or a cloud KMSThe setup around the key matters as much as the key.
  • You deploy or upgrade contracts from CIThe pipeline effectively holds the upgrade key.
  • You run bridges, keepers, relayers or oraclesOff-chain services make on-chain decisions.

Security isn't an afterthought for TermMax. Thanks @procur3 for helping us run a clean RFP to find specialized Daml auditors ahead of our Canton Network launch.

TermMax

Procur3 fills a gap no other platform serves: matchmaking between protocols and audit firms. No rounds of calls just to get a quote — for our Base contracts we compared multiple high-quality providers at once and weighed their strengths per project. We'll keep doing business with them.

Antonio ViggianoRheo (prev. Size Credit)
Keep exploring

Frequently asked questions

What is a Web3 infrastructure security review?

An assessment of the off-chain systems a protocol depends on: cloud accounts, RPC nodes, validators, key management, deployment pipelines and DNS. Reviewers check configuration and access, and can test the setup the way an attacker would.

How is it different from a smart contract audit?

A smart contract audit reviews on-chain code. An infrastructure review covers the systems that hold keys, deploy code and serve your app. Most teams need both, because a compromised key or pipeline can bypass audited contracts entirely.

Is an infrastructure review the same as a penetration test?

Not always. A configuration review inspects your setup against good practice; a penetration test actively tries to break in. Many reviews combine both. Each quote on Procur3 states which methods are included.

Do validators need a security review?

Yes, if you operate them. Key storage, remote signers, failover and slashing protection all carry risk that the chain's own audits don't cover.

Does an infrastructure review help with SEAL certification?

It overlaps with SEAL's infrastructure, DNS and multisig modules, but it isn't a certification. If you need the certification itself, request a SEAL assessment.

Is it free to request quotes?

Yes. Posting a request and comparing quotes is free. You agree the price and terms with the firm you choose.

Review the systems your contracts depend on.

Post your infrastructure scope once and compare quotes from vetted firms.

Get infrastructure review quotes