Protocol and application development where a deployment cannot be rolled back and a defect is a withdrawal. Contract engineering, security review, upgradeability design and the on-chain boundary decision.
Every delivery practice that assumes you can ship a fix breaks here. The response is not to slow everything down — it is to move the iteration upstream, where it is cheap, and make the irreversible step the smallest and best-verified thing you do.
What we build
Protocol contracts, token systems, vaults, registries and settlement logic, written to a defensive standard with invariants stated explicitly and checked mechanically rather than assumed.
Threat modelling, invariant and property-based testing, fuzzing, static analysis and adversarial review. Not a replacement for an independent audit — preparation that makes the audit cheaper and its findings less alarming.
Proxy patterns, timelocks, multisig and role design, emergency pause paths. Every one of these trades immutability guarantees for operational flexibility, and the trade should be a deliberate decision with a written rationale.
Deciding what genuinely needs to be on-chain versus what is there because it sounded good in a pitch. Indexers, oracles, relayers and the off-chain services that carry most real systems.
Signer topology, hardware and HSM-backed custody, deployment procedure, incident runbooks. The failures that cost the most in this space are operational far more often than they are cryptographic.
The hard parts
A vendor who cannot tell you where their own discipline is difficult has either not done it or is not going to tell you the truth about your project either.
In ordinary software a bug costs you a patch and some goodwill. Here it can cost the contents of the contract, permanently, in a single transaction. That asymmetry has to shape the whole delivery design, not just the test suite.
Reputable audit capacity is scarce and booked out. Treating the audit as a stage gate at the end reliably produces a schedule collapse; it has to be scheduled as a dependency with a lead time, and the code frozen to meet it.
A proxy that lets you fix bugs also lets you — or whoever compromises your signers — change the rules. Every upgrade mechanism is a trust assumption you are asking your users to accept, and it should be documented as such.
Stack
The full stackThis is what we reach for when the decision is ours. When you already have an estate, we work in it — the stack is part of the engagement, not a precondition of it.
Roles we staff
The reasoning, published
Every capability has a matching domain in the knowledge library. Read it before you talk to us — it is the fastest way to tell whether we know what we are doing.
An external audit is a scarce dependency with a lead time, not a stage gate. How to book it, scope it, prepare for it, survive the freeze, triage findings, and plan the re-review as cost rather than surprise.
Practitioner · 10 minContinuous delivery assumes you can ship a fix. On-chain, you cannot, and a defect is a withdrawal of funds. The answer is not waterfall — it is moving iteration upstream and making the irreversible step as small as possible.
Foundational · 10 minSecurity fails when it is an end-stage gate. How to make threat modelling, stated invariants, fuzzing, forking, static analysis and adversarial review part of the ordinary development loop, and where formal methods earn their cost.
Advanced · 10 minDeciding what genuinely belongs on-chain and what is there for narrative reasons. Cost, latency, privacy and immutability as the four axes, the trust that oracles reintroduce, and the ordinary software that makes up most of a working system.
Practitioner · 10 minEvery upgrade mechanism is a trust assumption imposed on users. Proxy patterns and their trade-offs, timelocks and signer topology, emergency pause, and how to document honestly what you are and are not guaranteeing.
Advanced · 10 minHow to buy it
Capability answers who works on it. The engagement model answers what we are accountable for, how it is priced and how it ends.
Other capabilities
Probabilistic systems
LLM applications, retrieval systems, agents and applied ML built to a standard you can put in front of a regulator — with evaluation harnesses, cost controls and failure behaviour designed in rather than discovered in production.
Software that acts
Systems that choose their own next step — tool-using agents, orchestrated workflows and automation that spans your existing systems — designed so that what they are permitted to do, and what happens when they are wrong, are decided up front.
Gated releases
iOS, Android and cross-platform applications delivered continuously despite a third party sitting between your merge and your users — staged rollouts, feature flags, release trains and a native-versus-cross-platform decision made on economics.
The paved road
The substrate the other three stand on: cloud infrastructure, deployment pipelines, observability, data platforms and the internal paved road that determines how fast every team above it can move.