Which findings in that report are real?
You are holding a list of findings from a scanner, an AI audit tool, a contest or a reviewer, and every row arrives at the same weight. We adjudicate it. Each finding comes back with a verdict and the on-chain read or the runnable test that settles it, and the list comes back ordered by what to fix first. $900 flat, up to 25 findings, within 3 business days of scope confirmation.
It reviews the report, not the protocol. It is not a security audit, not a certification, and not assurance. The full framing is below, because it matters.
The document that looks like an audit and is not one
An automated pass returns a severity-sorted report with critical and high rows at the top. It is formatted like an audit, it costs a fraction of one, and it is the reason it exists. What it does not come with is any way to tell which rows survive contact with your actual code. So a team either ships past findings it never checked, or spends the engineering week it was trying to save chasing rows that were never real.
Neither is the interesting failure. The interesting one is the row that describes something that genuinely happens and attaches a consequence to it that does not follow. It reads as a real finding because half of it is one, and it is the row a team is most likely to either panic about or dismiss for the wrong reason.
Four verdicts, one per finding
Every row in your report leaves with one of these attached, plus the evidence for it. Nothing is graded on our confidence: a verdict you cannot check yourself is not worth paying for.
The finding holds and the consequence attached to it holds. You get the reproduction, the conditions it needs, and where it sits in the fix order.
The behaviour described genuinely happens. The consequence claimed for it does not, or does not reach the thing it says it reaches. Worth fixing, not worth a launch delay, and we say which.
We tried the sequence the report describes and it does not do what the report says. You get what we ran and where it stops, so you can check the refusal rather than take it.
The code, a modifier, a deployment parameter or something you already publish covers it. This is the largest bucket in an automated report and the one that wastes the most engineering time.
One of them, rendered in full
Reentrancy in claim() lets a caller drain the reward pool
The external transfer is the last statement in claim(), and the function carries a reentrancy guard applied at the contract level rather than on the function line. The pass that produced this flagged the call-then-write shape without resolving the modifier, which is the single most common false high in automated Solidity output.
A Foundry test that deploys the contract as configured in your scope, calls claim() from a receiver that re-enters on receive, and asserts the revert at the guard. It runs on a clean checkout of your repo and ships with the report.
The same function emits its event after the transfer rather than before. That is not the reported issue and it is not exploitable here, but it will confuse an indexer, so it is written up separately as informational rather than dropped.
This one is written for this page as an example of the format. It is not a client's finding and not a redaction of one: the pattern it describes is a textbook false positive that belongs to no particular protocol, and nothing from a real engagement is published without that team's agreement.
Why we are the ones to ask
Because we do it in public, on ourselves, and you can read the results before you pay for any of it. 18 people outside Kerne have sent us a finding and had it adjudicated. The ones who agreed to be named are on the acknowledgments wall with the finding class, the date and what came of it, including ones accepted with no live impact and a rediscovery of a defect that was already known. The counts that cover everybody, including the reports that fell outside scope, are on the supply page, and Kerne's own open bugs are on the findings tracker.
We also know what the document in your hand looks like, because one was run against our contracts. An automated pass asserted 57 findings, 2 critical and 15 high. After a real review none of the criticals and none of the highs survived; ten mediums did. That triage was done by the outside team who ran it, unpaid, and not by us. What we did was re-read every live figure in their report against the chain, and then reject one of their impact claims on evidence and say so in public. The whole account is here, including what those reviewers still have open about us.
That is the argument for hiring us and it is also the argument against overpaying us: 47 of those 57 rows died under review by somebody who was not the vendor that produced them. A second opinion is worth what it costs precisely because the first opinion was cheap.
What is in scope, exactly
- One report, one codebase, one commit. Up to 25 findings. If your report is longer we tell you before anything starts and either agree a subset with you or requote, rather than reading 25 of 60 and calling it done.
- Delivered within 3 business days of scope confirmation, which is when we have your report, the commit it was run against, and the price agreed in writing. Not from the moment you pay.
- Every verdict carries either a command that reproduces a public on-chain read or a test that runs on a clean checkout of your repository. A verdict we cannot support with one of those is marked as such and is not billed.
- We review the findings you were given. We do not go looking for what your report missed, and this cannot tell you what neither of us found. If we hit something new while reading, we tell you and it costs nothing extra.
- It is delivered privately to you. Nothing about your report, your code or the findings is published by Kerne, ever, without your written agreement.
What this is not, stated first
- This is not a security audit. It reviews a document, it does not review your protocol. A clean second opinion means the rows in that report did not hold up; it says nothing about the rows nobody has written yet.
- It is not a certification and not assurance. Nothing produced here should be shown to a counterparty, an exchange or an investor as evidence that your code is safe, and we will not write you a letter that says it is.
- It is not a verdict on whoever produced the original report, and we will not write you one of those either. Automated passes over-report by design, and a human reviewer can be right about a mechanism and wrong about its impact. The report is the subject, not the author.
- It is not legal, investment, tax or accounting advice, and it makes you compliant with nothing.
Book one
Who does the work, and what we have not done yet. This one is delivered by Kerne, not by the independent researchers who take Whitehat Desk sweeps, and no researcher share is paid out of it. That is deliberate: we publish how much delivery capacity the Desk actually has and it does not yet include anyone committed to paid work, so this is scoped to work that needs nobody else's time. Nobody has bought a second opinion from us yet either. What stands behind it is the published record above, not a client list.
What paying does, and how to get it back. Paying books the work; it does not buy it yet. We confirm the scope with you in writing first, which is when we have your report and the commit it was run against, and the 3 business days start from that confirmation rather than from your payment. Until scope is confirmed you can ask for the whole amount back for any reason, including changing your mind, and we return it without a fee and without a discussion. If your report turns out to be longer than 25 findings we tell you then, and you take the refund or agree a requote.
$900
Flat, one time, up to 25 findings. Paid in USDC on Base; the on-chain transaction is your receipt.
After paying, send the report and the commit to kerne.systems@protonmail.com, or just answer the question on the receipt panel.
Rather send the report first?
The $900 fee is self-serve above. If you would rather confirm the report fits before you pay, or you cannot pay by wallet, leave your email and tell us what you are holding. We reply from kerne.systems@protonmail.com.
If this is not the thing you need
This reviews a list somebody already produced. If what you actually want is somebody looking for what nobody has found yet, or a check of whether your public claims match your chain, those are different products and they are priced separately.
An adversarial pre-mortem on your contracts by an independent researcher, run before you commit to a full audit. A fresh pass, not a review of an old one.
Whether the yield, addresses and oracle posture you publish match what the chain says, with a signed findings summary you can republish.
Every fixed price and delivery window Kerne publishes is on one page.
Kerne is infrastructure and a service provider, not an auditor, a rating agency, a registered public accounting firm, or an investment adviser. A second opinion is a review of a findings report the buyer supplies, against that buyer's own code and public on-chain data. It is not a security audit, not a certification, not a solvency or credit opinion, not a rating, and not investment, legal, tax or accounting advice. It does not make any protocol safe or compliant, and a favourable verdict on a report says nothing about issues no report has raised. The fee is $900 fixed, refundable in full until scope is confirmed and earned on delivery.