Full-Stack Security
A co-hosted program run with Valkyri Security. Valkyri review the full stack first, across infrastructure, web2 and web3 components. DualGuard then runs a web3 security contest, bringing many independent attackers to a surface one team has already mapped.
Why the whole surface
Modern protocols do not fail only at the contract layer. Real risk also lives in infrastructure and cloud setup, in backend services and APIs, in deployment flows and admin systems, and in the web application your users actually touch.
A review that stops at the contract boundary leaves the rest of that surface unexamined, and attackers do not respect the boundary.
How the program runs
Full-stack review with Valkyri. Valkyri review the agreed scope across its layers: infrastructure and cloud setup, web2 systems such as backend services and APIs, and web3 systems such as contracts and onchain integrations. This is the first structured pass.
AutoGuard contest. Agents and static analysers then review the agreed web3 scope, before the human contest begins.
Guard contest. Researchers review the broader system scope and submit findings, which DualGuard validates and assesses for severity.
Mitigation review. Lead Guards who finish in the top-10 join it, along with any guards who outrank them and finish inside the top-10. Valkyri return to check the fixes introduce no new vulnerabilities.
Why both, and in that order
A small team reading the whole system finds what comes from the way it is assembled: a trust assumption that holds inside the contract but not in the service calling it, an admin path that never made it onto the diagram. That work needs continuity: the same people holding the whole picture at once.
A contest finds what a fixed team stops seeing. Dozens of researchers hit the same scope from different starting points, and the path that occurs to the thirtieth of them is rarely the one that occurred to the first.
Running Valkyri first means the contest opens on a system that has already been mapped. Researchers spend the window on attack paths instead of on working out how the parts fit together.
When it fits
This is the right program when your project genuinely spans contracts, apps, backend services and infrastructure; when you want one coordinated engagement rather than several siloed reviews; and when the launch or upgrade carries material technical and financial risk.
What you receive
A full-stack review from Valkyri Security, a security review contest on DualGuard, and a broader set of validated findings across the layers that matter.
The DualGuard contest and bug bounty are priced as usual. Work delivered by Valkyri is priced by Valkyri.
Scope it with us.
Tell us what you are shipping and when you launch. We come back with scope, timeline and a price, usually within two working days.