Kerne Security
Whitehat Desk
A fixed-price pre-audit adversarial sweep, for teams that are not ready to justify a full audit engagement but do not want to ship blind. It is run by the independent researchers who have reviewed and disclosed to Kerne, and coordinated through us.
To be direct about what this is: an adversarial review, not an audit and not a guarantee. The terms below say exactly what you are and are not getting.
Who it is for
Early teams and solo builders whose contracts hold, or are about to hold, real value, and for whom a twenty-five thousand dollar audit is months away. A focused adversarial pass now catches the obvious and not-so-obvious ways funds get lost, and it does it at a price that fits a pre-revenue protocol. It buys down the worst of your risk while you get to a full audit, not instead of one.
Where the researchers come from
Kerne runs its own bug bounty in public. 7 independent researchers have responsibly disclosed findings to us, and 7 of them are publicly credited by name on our acknowledgments wall, with the finding class, the date, and the current status of each report. That wall is the evidence that this group exists and that we handle disclosure properly. It is the same wall, and the same standard of write-up, that a sweep report is delivered against.
To be precise about what that does and does not mean: being credited on the wall is recognition for a disclosure to Kerne. It is not a statement that the person is on staff, on retainer, or available for your sweep. Researchers are engaged per sweep, with their consent, and each one is free to pass on any piece of work. We do not keep a bench sitting idle, and we will not pretend otherwise to make this page look bigger.
How it works
1. Scope
You send the contracts you want looked at (a repo link or verified addresses) and what you are most worried about. We agree a fixed scope and a fixed price in writing before anyone starts. No open-ended meter.
2. Sweep
One or more independent researchers from the group that has disclosed to Kerne run an adversarial pass against the scoped contracts inside a short, agreed window. They look for the classes of issue that actually lose funds: accounting and supply drift, access-control gaps, oracle and slippage manipulation, reentrancy, and upgrade and admin risk.
3. Report
You get a written report in the same template Kerne uses for its own disclosures: each finding with a severity, a class description, a reproduction where one exists, and a suggested direction. Clear enough to act on, honest about what was and was not covered.
4. Re-check (optional)
If you fix and ask, a researcher will re-check the specific findings against your patched code once, so you can show the fix was verified by the person who found the issue.
Price
Two fixed tiers. Which one applies is settled during scoping, in writing, before any work starts. There is no hourly meter and no scope creep: if the surface turns out to be wider than it looked, we tell you and requote rather than quietly billing more.
Focused sweep
$2,500
A small, self-contained contract set: a vault, a staking path, a token and its minter, or a single well-bounded mechanism. This is the common case for a pre-launch protocol.
$1,750 of that goes to the researcher.
Extended sweep
$5,000
A wider or more intricate surface: several interacting contracts, an oracle or accounting path with real subtlety, or a system where the interesting failures live between components rather than inside one.
$3,500 of that goes to the researcher.
What is included, and how long it takes
- The adversarial pass itself, against the exact contract set named in the written scope.
- A written report: every finding with a severity, a class description, a reproduction where one exists, and a suggested direction.
- One re-check of those specific findings against your patched code, if you fix and ask.
- Coordinated disclosure throughout. Nothing is published without your agreement.
A sweep runs in days, not weeks. The exact window is agreed in writing when we scope the work, alongside the price, and it depends on the size of the surface and who is free to take it. We would rather agree a date we can hold than name a faster one here that we cannot. Payment is on delivery of the report, in stablecoin or by invoice.
Seventy percent of the fee goes to the researcher who does the work. Kerne keeps thirty percent for coordinating the engagement, standing behind the process, and handling scoping, payment, and delivery. The split favors the researcher on purpose: the work is theirs, and good researchers are the scarce thing.
If you need a full audit instead, we will route you
Sometimes the honest answer is that a sweep is not what you need. In that case we can make a warm introduction to the firm running Kerne's own audit, rather than selling you the thing we happen to have. If that introduction turns into an engagement, Kerne may receive a referral fee from the firm. You pay us nothing for the introduction, and the fee does not change your price with them.
When a researcher is the one who sourced that lead, Kerne splits its referral fee with them fifty-fifty. And any researcher who approaches a team on our behalf is required to disclose the referral relationship up front, before anything else. We would rather lose a lead than have someone find out later that a recommendation was paid.
Terms, in plain language
Read these before engaging. They are the whole deal, and they are written to be honest rather than reassuring.
- This is an adversarial sweep, not an audit. It is a time-boxed, best-effort review by independent researchers. It is not a formal audit, not a certification, and not a substitute for one. Teams handling real user funds should still get a full audit.
- A clean sweep is not a guarantee of safety. Finding nothing, or finding only what is listed, does not mean the code is free of vulnerabilities. Security reviews reduce risk; they never eliminate it. No result from this Desk should be presented as proof that a protocol is safe.
- No warranty and no liability for missed issues. The sweep is provided as is. Neither Kerne nor any participating researcher warrants that the review is complete or that all issues have been found, and neither is liable for any loss arising from an issue the sweep did not surface. Scope, price, and these terms are confirmed in writing before any work begins.
- Independent researchers, coordinated by Kerne. Kerne introduces and coordinates the work and handles payment; the review is performed by independent researchers. Kerne is not vouching for, employing, or warranting any individual researcher's work, and no researcher is named publicly without their consent.
- Coordinated disclosure. Findings are shared privately with the requesting team first. Nothing is published by Kerne or the researcher without the team's agreement.
- We book only what we can staff. A sweep is confirmed once a researcher has accepted the specific scope, not when you submit the form. If nobody suitable is free in your window we will tell you that instead of taking the work and being late.
Where Kerne itself stands
Kerne is not an audited protocol. An external audit is underway: the initial report has been received and remediation is in progress, and we will not describe Kerne as audited until the final report is published. We say this on every surface, and it would be absurd to leave it off the one where we sell security work.
We think it is the reason to take the Desk seriously rather than a reason not to. Our own findings, including the ones that were embarrassing, are published with dates and status on the acknowledgments wall and the findings tracker. You can judge how we handle a disclosure before you trust us with yours.
When you should skip this and get a full audit
If you are about to hold serious user deposits, if a counterparty or listing requires an audit, or if your design is novel enough that it needs weeks of scrutiny rather than days, get a full audit. We would rather tell you that than sell you a sweep you should not buy. If a full engagement is the right call, we can point you to the firm running Kerne's own audit.
Request a sweep
Tell us what the contracts do and what worries you. We come back with a scope, a fixed price, and a window, and nothing starts until you agree to those in writing. If you are a researcher who wants to take sweeps through the Desk, switch the first option and send us a sample of prior work.