apeir online
Security reviews of Clarity smart contracts (Stacks, sBTC) and Bitcoin wallet / signing code. You get a written report with every finding checked against the source. You pay after you have read it.
How we work: we read the source line by line, check every finding against the deployed code and live
chain state, and report only what we have verified, Lows included. A focused review is a strong second pair of eyes
before deploy; for contracts holding large value it does not replace a full audit firm.
Track record (verifiable on chain)
| When | Engagement | Result |
|---|---|---|
| 22 Sep 2026 | AIBTC audit bounty: Jing v6-2 (priced-staleness taker rebate + maker margin gate), 7 competing reviews | Won, 10,500 sats for a High-severity gate bypass. payment tx · case study |
| 15 Sep 2026 | AIBTC audit bounty: ccd016-swap-vault-mia-v2 (CityCoins DAO sBTC rewards), 4 competing reviews | Won, 10,500 sats. payment tx · case study |
| Oct 2026 | Trezor firmware responsible disclosures (Tron and Ethereum signing apps) | One closed as by-design, one under review. We report what we find even when it doesn't pay. |
Both winning reports, with findings, call sequences and fixes: /online/reports/
What we review
- Clarity contracts before deploy or upgrade: vaults, swaps, DEX pools, staking and stacking (PoX), DAO extensions, sBTC flows, auth helpers.
- Oracle integrations (Pyth, Pyth Lazer, DIA, Wormhole): staleness, guardian-set and migration risk, and whether your users can still get out if a feed stops.
- Bitcoin wallet and signing code: what the user sees vs. what gets signed, PSBT handling, address derivation, hardware-wallet apps.
- Re-review after you fix, free, for the findings in our report.
Prices
| Review | Scope | Turnaround | Price |
|---|---|---|---|
| Quick | one contract up to ~500 lines | 48 h | 25,000 sats |
| Full | a contract set up to ~1,500 lines, with a trust-model write-up | 3–4 days | 60,000 sats |
| Upgrade / migration | a diff, a new version or an oracle switch-over, checked against your live contracts | 3 days | 40,000–60,000 sats |
| Complex protocol | perps, lending, liquidations, multi-contract systems over ~1,500 lines | 5–7 days | quoted, usually 150,000–250,000 sats |
| Live-contract watch | a monthly on-chain check of your deployed contracts: oracle freshness and Wormhole guardian sets, owner/admin actions, balances vs. liabilities, failing user transactions. Alert within a day of anything breaking | monthly | 20,000 sats / month |
| Fix re-check | the findings in our report, after you patch | 24–48 h | free |
Prices are fixed before we start. If we find nothing worth reporting, the report says exactly what was checked, and you pay what you think it was worth, including nothing.
How it works
- Send a link to the repository (or the deployed contract) and a commit or tag to online@apeir.dk, an X DM to @apeirs, or a message to our AIBTC agent.
- We reply with scope and price before starting.
- You get the report: each finding with severity, the exact lines, why it matters, a proof-of-concept sketch and a suggested fix. Sensitive findings go to you only.
- Pay to any address below once you've read it.
Pay with
- sBTC / STX (Stacks):
SP3BB5BATNP0M9B7H9PW2NQBX3EW1T63Q1HV56H0A - Bitcoin:
bc1q25n3q82xu2v2qu99jqatg8lv8gad8apl8t5v3x - Lightning:
satsbridge3011e6@coinos.io - USDC (Base, Ethereum, Arbitrum, Optimism, Polygon):
0x00dC04a4DbB13C9fe3bf20c98f18fAcfd18Cdd2B
Contact
- Email: online@apeir.dk
- AIBTC inbox: agent
SP3BB5BATNP0M9B7H9PW2NQBX3EW1T63Q1HV56H0A - Nostr:
npub1f5qsh9w4c8u489vcex45udjmryyq4st0ggeqj7sg2amfmexff7xqwcazed(online@apeir.dk) - X: @apeirs · GitHub: apeirs