Crypto investigations and security reviews
Before you commit funds, put your name behind a project or launch a product, get an independent review of the risks. I examine the evidence and explain what it means for your decision. Send me the case to agree on a useful scope, a clear price and a delivery date.
Services at a glance
$ prices are in USD. The Project & Scam Check is $300 USD upfront. Starting prices depend on the agreed scope.
Research and investigations
- Token Risk Snapshot$5
Initial contract, holder and liquidity checks in the $MASTR App. $5 USD per check.
- Project & Scam Check$300 upfront
A focused review before investing or when a project raises scam concerns. $300 USD upfront.
- Deep Project Check$600 upfront
Detailed project review, PDF report and 30-day recheck.
- Counterparty researchFrom $3,500
Due diligence before funding, listing or a partnership.
- Scam investigationFrom $350 USD · scope agreed individually
Trace transfers and investigate a suspected scam.
- Project risk monitoring$750 · per project / month
Track material changes after the initial project review.
Technical security reviews
- External attack surface reviewFrom $2,500
Review websites, APIs, authentication and exposed infrastructure.
- Wallet and signing securityFrom $5,000
Check wallet flows, signatures, permissions and key handling.
- Web3 product assessmentFrom $9,500
Review the application, onchain controls and backend together.
- Remediation retestFrom $1,500
Verify whether previously reported weaknesses have been fixed.
60-minute private chat with MASTR · 200 USD
- Describe the case
Send the relevant transactions, project links and your questions.
- Agree the scope and fee
We confirm the work, delivery date and payment before starting.
- Review the evidence
Transfers, records and claims are examined within the agreed scope.
- Receive the findings
Receive documented results, sources and unresolved questions.
Fixed-scope programmes for users, teams and professional counterparties.
Token Risk Snapshot
Start with a Token Risk Snapshot in the $MASTR App for $5 USD. Check the token contract, holder distribution and liquidity before deciding whether you need a deeper project review.
- Token contract and control permissions
- Holder distribution and concentration
- Liquidity and initial risk indicators
Project & Scam Check
Before you send funds or trust a project’s claims, get an independent look at the evidence. I spend 1–2 hours examining the project and the specific concerns you bring, then explain the warning signs, what checks out and what remains unresolved.
- Project claims, team footprint and available documentation
- Contract controls, holders and liquidity where relevant
- Visible wallet activity and inconsistencies that need explaining
- A written summary with sources, key risks and open questions
Deep Project Check
Find out whether a project’s claims hold up against its onchain activity and actual control structure. Receive a detailed PDF covering the evidence, wallet relationships and key risks, with a recheck after 30 days.
- Everything in the initial review
- Wallet relationships and funding paths
- Team, social accounts and project claims
- PDF report and a recheck after 30 days
Counterparty research
Understand who controls a project and where your exposure would sit before funding, listing or entering a partnership. Receive a private report and decision briefing that bring together contracts, treasury movements, counterparties and documented risks.
- Multiple contracts and blockchains
- Control rights, treasury and counterparties
- Documented risks and supporting evidence
- Private report and a discussion of the findings
Scam investigation
From $350 USD · scope agreed individuallyLost funds, suspicious transfers or a project that has stopped answering? I investigate the available evidence to establish what happened and trace where the money went.
There is no fixed upper limit. The fee depends on the agreed scope, complexity and research time. It can cover transfers, relationships between wallets, project claims and supporting records. You receive documented findings, source links and any questions the evidence cannot resolve.
Email the project name, wallet addresses or transaction IDs, relevant documents and what you want to find out. I will confirm the proposed work, fee and timing before you pay. Work begins once we have agreed and payment has arrived.
Publication on X by agreement
At the client’s request and by prior agreement, documented findings can be published on X. We agree on what is published and when before anything is posted.
Payment covers the research
An investigation may end without conclusive findings or an identified responsible party. The agreed fee pays for the research carried out and remains due even if nothing is found. Recovery of funds is not guaranteed.
6ELa36JmfYL8RFFu5i6WfRAQAykkyVNRqBtpoaTaEwNqPayment in SOL on Solana. Agree on the USD fee and its SOL equivalent by email before paying. Enter the agreed SOL amount and confirm it in your wallet. If no wallet opens, copy the address.
After payment, email your transaction ID and case details to mastr@mastrlabs.com.
Project risk monitoring
Keep track of changes that could affect your exposure after the initial project review. Contract permissions, liquidity, major holders and public claims are monitored through weekly reviews, material-risk alerts and a monthly evidence report.
Scope and ongoing terms are confirmed directly before monitoring starts.For teams that need an external adversarial review before users discover the gaps.
External attack surface review
Find weaknesses in the systems users can reach before they become an incident. I review websites, APIs, authentication and exposed infrastructure, then document the evidence, severity and remediation priorities.
Scope, timing, payment and deliverables are agreed directly before work begins. Request scopeWallet and signing security
Check whether your product asks users to sign what it actually executes. The review covers wallet connections, transaction construction, signature binding, key handling, agent permissions and the information users rely on when approving an action.
Scope, timing, payment and deliverables are agreed directly before work begins. Request scopeWeb3 product assessment
Review the full path from the user interface to the wallet, backend and onchain controls. This assessment examines how weaknesses across those components can combine into an exploitable path, so your team can address the underlying cause.
Scope, timing, payment and deliverables are agreed directly before work begins. Request scopeRemediation retest
Confirm whether a reported weakness has actually been fixed. I retest the original finding, check for regressions and document what is resolved and what still needs attention.
Scope, timing, payment and deliverables are agreed directly before work begins. Request scopeQuestions, deliverables and timing are agreed by email before work begins.
Payment is due upfront where specified in the selected service.
One retest is included where the service explicitly provides for it.
Payment method or invoicing is agreed in advance.
For scam investigations, work starts after the scope and price are agreed and payment has been received.