I break DeFi protocols
before attackers do.
Smart contract audits focused on vault logic, LP accounting, and reward flows — where most real capital losses actually occur.
No generic audits. Only protocol-level analysis.
FOR DEFI PROTOCOLS, VAULTS, AND LIQUIDITY SYSTEMS HANDLING REAL CAPITAL.
Typical response time: 24-48 hours
Averin Labs specializes in DeFi protocol security, focusing on vault mechanics, LP accounting, and reward systems. The work includes identifying logic-level vulnerabilities and helping implement production-ready fixes.
Who this is for
DeFi founders
Teams preparing launches, upgrades, or capital-heavy releases that need a DeFi security audit.
Protocol teams
Builders who need smart contract audit coverage around protocol security and production readiness.
Liquidity platforms
Systems with LP accounting, reward distribution, routing logic, and Curve or Convex style integrations.
Vault developers
Teams that need vault security review for share pricing, withdrawals, oracle assumptions, and capital allocation logic.
What I break in your protocol
Focused on real protocol behavior under edge conditions, not ideal scenarios.
How issues actually appear
Example findings
Typical issues appear under conditions most systems are not tested for.
Most vulnerabilities don't come from code alone — they come from system assumptions.
Common risks in DeFi protocols
LP share mispricing
LP accounting drift, rounding issues, and mispriced share issuance that quietly transfer value between users.
Reward leakage
Reward flows that leak value through stale accounting, timing asymmetry, or desynchronized distribution logic.
Oracle manipulation
Protocol security failures caused by stale pricing or manipulable inputs around critical state transitions.
What I do
Vault Review
Validation of share pricing logic, mint and burn invariants, and rounding edge cases.
LP Accounting
Verification of LP positions, pool state, and edge cases around token decimals.
Withdrawal Safety
Ensuring exit liquidity integrity and preventing sandwich attacks on withdrawal queues.
Reward Flows
Auditing incentive distribution systems to prevent double-claiming or dilution exploits.
Oracle Risk
Mitigating manipulation risks from spot-price oracles and stale data feeds.
Attack Simulation
Stress testing protocol invariants and economic assumptions under adversarial conditions.
Focused on protocol-level behavior, not just code patterns.
Most audits stop at code patterns. Real exploits happen in protocol logic.
I analyze how value moves through the system — not just how functions execute — focusing on scenarios where correct code can still lead to capital loss.
- check_circleStress-testing invariants across multiple transaction states.
- check_circleRe-entrancy analysis beyond simple state checks.
- check_circleLiquidity migration and reward accounting integrity.
What most audits miss
Built to be quoted
Most DeFi exploits don’t come from bugs. They come from broken assumptions.
If your protocol handles capital, it will be tested.
Correct code can still lose capital when protocol logic breaks under stress.
DSF.Finance
Full-stack engineering and security lead for a complex yield aggregator integrating Curve and Convex ecosystems.
Built, deployed, and maintained in production without reliance on external audits.
Live system with real capital at risk.
Fix & Build
Beyond auditing, I provide protocol optimization services. This includes gas efficiency refactoring for Curve-style gauges and custom adapter development for Uniswap V3 liquidity management.
Andrey Averin
DeFi Security Engineer
CTO of DSF.Finance
DeFi protocol engineer focused on vault mechanics, LP accounting, and reward systems. Built and operated production systems with real capital and on-chain risk.
Background
Systems Background
Background includes information security, distributed systems, and blockchain architecture.
Focused on how complex systems behave under real conditions — not just how they are designed.
Applied Experience
Experience spans academic research, international programs, and real-world DeFi system development.
Built and operated systems handling real capital, liquidity flows, and on-chain risk.
Research Focus
Research includes blockchain systems, consensus models, and security assumptions.
Published work focused on how systems fail — not just how they function.
Why it matters
This enables analysis beyond code — across architecture, economics, and system behavior.
Most vulnerabilities emerge from system assumptions, not isolated bugs.
Research & Publications
17+ papers · h-index 6 · 175+ citations
Research focused on system-level behavior, security assumptions, and failure modes in decentralized architectures.
Full research profile available on ResearchGatePublic Activity & Media
Speaker on NFT smart contracts (Global Game Jam SUSU 2022)
Participant in international software engineering program (Germany, Erasmus+)
Featured in media on digitalization and blockchain initiatives
Organizer and contributor to tech and art-tech events
Selected talks and workshops available on request.
Notes on DeFi security
Follow for insights on DeFi protocol risks and system failures.
Most teams discover these issues only after users lose money.
Engagement
Pricing reflects protocol complexity and level of analysis required.
Focused on systems with real capital at risk.
Most engagements start with a focused review before deeper analysis.
Final scope depends on protocol complexity.
Limited number of engagements at a time.
Most exploits don't come from obvious bugs. They come from correct code behaving incorrectly under stress.
If your protocol handles real capital, it will eventually be tested.
Questions teams ask before an audit
How much does a DeFi audit cost?
Most teams start with a focused review from $2k, then expand into a standard or deep protocol engagement as scope and capital risk increase.
How long does an audit take?
Response time is typically 24-48 hours. Actual timelines depend on contract count, protocol complexity, integrations, and attack scenario depth.
What risks do you cover?
The review covers smart contract audit issues, vault security, LP accounting, reward leakage, oracle manipulation, withdrawal safety, and protocol-level economic risk.
Your protocol will be attacked. The only question is when.
I'll review your protocol logic, identify weak points, and help implement the fix.