What smart contract audit firms use in 2026 for Telegram deal flow and code review

Key takeaways

• crmchat turns Telegram folders, founder DMs and client group chats into one deal pipeline, and its Starter plan is free for 50 CRM leads.

• CodeAlive maps client repositories as a call graph with semantic search and serves that context to Cursor, Claude Code and Codex over MCP.

• Slither ships 100 detectors in its README table, and Aderyn adds a Markdown report.

• Foundry proves bugs with exploit tests, while Echidna and Medusa run stateful fuzzing campaigns.

• Solodit and GitHub cover prior findings, findings tracking and fix review.

Smart contract audit firms in 2026 split their tools between deal flow and code review. crmchat wins at Telegram lead capture, and CodeAlive wins at understanding unfamiliar code during scoping. Slither and Aderyn clear known patterns, Foundry, Echidna and Medusa prove and fuzz bugs, Solodit researches forks, and GitHub carries the findings.

We included tools that cover one step between a founder's first Telegram message and the final audit report. We checked each one's own site or GitHub repository on 21 October 2026, and every open-source tool here has a tagged release from 2026.

How does crmchat keep audit leads from Telegram in one pipeline?

Folder sync is the main difference: crmchat turns the Telegram folders your team already uses into a deal pipeline, where each founder chat gets a stage, an owner and a next step. Forwarding a Telegram message also adds a lead. Client group chats, where a protocol's whole team talks to your auditors, can sit in the pipeline too. Custom properties hold quoting details such as chain, code size, launch date and referral source.

For outbound, the Web3 decision-makers database lists 7,000+ verified Telegram contacts collected at events such as Token2049 and Devconnect. Sequences run from several accounts into one inbox. The crmchat API can push won deals into your own scheduling sheet. The Team plan costs $49 per seat a month and adds multiple Telegram accounts in a centralized team workspace. For the groups worth joining, see where audit clients gather.

Fits: firms whose leads arrive in Telegram DMs and groups across several team accounts. Does not fit: firms that win most work by email or procurement portals, since leads from those channels must be added by hand.

How does CodeAlive help auditors scope an unfamiliar client codebase?

CodeAlive's main difference is a relationship graph of files, symbols, calls, dependencies and tests, combined with semantic search over the same code. During scoping, an auditor can ask CodeAlive how funds move from deposit to withdrawal, or which contracts can call a privileged function. Questions about where an inherited fork differs from upstream get answers that point to the actual code instead of the client's README. CodeAlive describes itself as a context engine for codebases of 1M+ lines, which suits protocols spread across several repositories. The index refreshes on every push, so answers stay current through fix review.

How does CodeAlive give AI coding agents the full context of an audit?

CodeAlive exposes MCP tools named semantic_search, grep_search and chat, plus an API. Cursor, Claude Code, Codex, Windsurf, Zed, Continue and Cline can all call them, as can VS Code and JetBrains. An agent tracing an attack path then starts from the call graph instead of opening files one by one. CodeAlive says this targeted context also cuts the tokens an agent spends. A Code Review Agent runs on pull requests and posts its results back to the Git provider.

• Connects to GitHub, GitLab, Bitbucket, Azure DevOps and Gitea.

• Offers self-hosted deployment for NDA-bound code, which the site says keeps code inside your network.

• Has a free plan with 25 MB of repository size, and Pro at $50 per month includes AI code review.

• Accepts your own LLM in self-hosted setups, including any OpenAI-compatible endpoint.

CodeAlive fits scoping and the first days on large or multi-repo protocols. On a short token contract the gain is smaller, and bug detection itself still belongs to static analyzers, fuzzers and the auditor.

What does Slither catch on the first static analysis pass?

Slither catches known Solidity and Vyper bug patterns such as reentrancy, unprotected functions, shadowing and dangerous delegatecall, using the 100 detectors listed in its README. The framework is written in Python and published under the crytic GitHub organization. Its printers draw call graphs, inheritance graphs and function summaries, so the same run also helps with scoping. Firms run it at the start of each engagement to clear known patterns before manual review begins. In CI, it can rerun on every fix the client pushes. The latest release is 0.11.6, published on 28 July 2026. Slither does not fit as a final verdict, because pattern-based detectors flag issues that are not exploitable in context. Every result needs triage by an auditor. The AGPL-3.0 license also matters to firms that build commercial tooling on top of it.

Why do audit firms run Aderyn next to Slither?

Aderyn writes its findings straight into a Markdown report, which gives firms a second static analysis opinion already formatted for a findings draft. Cyfrin builds the analyzer in Rust. Runs need no configuration and work on Foundry and Hardhat projects, with JSON and SARIF output available as well. A VS Code extension shows results in the editor, and a GitHub Action runs the same checks in CI. Custom detectors let a firm encode the patterns it keeps finding across clients. The last tagged release is aderyn-v0.6.8 from 22 January 2026, though commits to the repository continued into October 2026.

• Fits: firms that want detector output ready to paste into a report, and teams on Foundry or Hardhat.

• Does not fit: Vyper projects, since Aderyn analyzes Solidity only and Slither has to cover them.

How do auditors use Foundry for proof-of-concept exploits?

Working inside the client's own test suite is Foundry's main difference, since many audited codebases already ship with it. An auditor can write an exploit test next to the client's tests and run it against a fork of live network state. A Foundry proof of concept for each high-severity finding settles any debate about whether a bug is real. Fuzz and invariant corpora can be saved, replayed and minimized. Cheatcodes such as bound and assume keep fuzz inputs meaningful. The project shipped v1.8.6 on 21 October 2026. Clients on Hardhat alone need some setup first. Long stateful campaigns are where Echidna and Medusa add depth. The Foundry toolkit has four parts:

• Forge runs unit, fuzz and invariant tests.

• Anvil runs a local node that can fork live networks.

• Cast reads chain data from the command line.

• Chisel is a Solidity REPL for quick checks.

When is Echidna worth the time it takes to write properties?

Echidna pays off on stateful DeFi bugs, where a specific sequence of deposits, swaps and withdrawals breaks an invariant you defined. The Echidna fuzzer is written in Haskell and generates call sequences from a contract's ABI. Before each campaign it uses Slither to extract information about the contracts. Coverage maps back to source, and failing sequences shrink to a short reproduction that is easy to triage. Modes include property, assertion, overflow, optimization and exploration testing. Foundry, Hardhat and Truffle projects work through crytic-compile. Releases continue, with v2.3.3 published on 27 July 2026.

Fits: protocols that hold user funds and have accounting invariants worth stating. Does not fit: a tight quote with no time for property writing, because good properties take skill and the hours must be priced into the engagement.

What does Medusa add to Echidna for long fuzzing campaigns?

Medusa adds parallel fuzzing across multiple workers, so a long campaign can use every core of a dedicated machine. The crytic organization built it on go-ethereum, and the design draws on Echidna. The fuzzer mutates a stored corpus with coverage guidance and supports assertion and property tests. Value generation draws on values collected at compile time and at runtime. Property style is close to Echidna's, so many firms write properties once and run both fuzzers on the same suite. The latest release is v1.5.1 from 11 March 2026. Medusa suits multi-week audits where a campaign runs overnight on spare hardware. Firms that plan to script custom tests in Go should expect changes, because the Medusa README marks the Go-level testing API as under development and subject to breaking changes. Its community is also younger and smaller than Echidna's.

How does Solodit help research a forked protocol before an audit?

Solodit's forked-from filter lists past findings on the protocol a client's code was forked from, so an auditor starts with known failure points. Cyfrin runs Solodit and describes it as the largest open source database of blockchain and smart contract security vulnerabilities. Other filters cover impact, quality, rarity, programming language, protocol category, source, protocol name and author. A checklist section supports structured review, and an account adds notes and bookmarks for a personal research trail. Firms also use the database to train junior auditors on real findings before they join a live engagement. The limitation is scope. Solodit shows what went wrong in other codebases, not what is wrong in this one. Findings also vary in depth, so filtering by quality rating saves reading time.

How do audit firms run findings and fix review on GitHub?

GitHub carries the delivery side of an audit: each finding becomes an issue in a private repository shared with the client, and fixes arrive as pull requests against a frozen commit. Issues support labels, sub-issues and custom fields, and Projects sorts findings by severity and status in a table view. For public client repositories, repository security advisories let maintainers fix a vulnerability in a temporary private fork before disclosure. Cyfrin's open report generator template, forked from Spearbit's, fetches issues from a repository and sorts them by severity label. The template then builds a Markdown file and a PDF report from them. The Free plan costs $0 with unlimited private repositories, and Team costs $4 per user per month.

GitHub fits client collaboration during the audit and fix review, since CI can rerun Slither and Aderyn on every fix. Deal history and quoting do not live there, so each findings repository should link back to the deal in crmchat.

Which audit stack fits a solo auditor, a small shop or a firm with a BD team?

1. Solo auditor: crmchat on the free Starter plan with 50 CRM leads to capture founders from Telegram folders, Foundry and Slither on every engagement, Solodit for fork research, and a private GitHub repository per client.

2. Shop of two to four auditors: add Aderyn for Markdown drafts and Echidna for any protocol that holds user funds. CodeAlive on the Pro plan for 1 to 3 developers lets the person scoping map the codebase quickly and gives each auditor's agent the full context.

3. Boutique firm with several engagements in parallel: move to the crmchat Team plan, so BD and lead auditors share one deal history. Run Medusa on dedicated machines and adapt Cyfrin's report template to your severity scale.

4. Firm with a BD team: feed won deals into scheduling through the crmchat API and use the Web3 database for outbound, following tested audit pitch templates. Run CodeAlive self-hosted for NDA-bound code and keep custom Aderyn detectors for patterns your firm finds again and again.

If referrals are your only channel today, read how to reach contract signers at protocols that need an audit.

FAQ

Which static analyzer should an audit firm run first, Slither or Aderyn?

Run both, because their detector sets overlap only in part and each run is fast. Slither covers Solidity and Vyper and has printers for mapping a codebase. Aderyn writes a Markdown report you can paste into a findings draft.

Can an AI tool replace manual smart contract review?

No. CodeAlive speeds up scoping and flow tracing and gives AI agents the full context of a codebase. Finding and validating exploitable bugs still takes an auditor, fuzzing and proof-of-concept tests.

Should an audit firm use Echidna or Medusa for fuzzing?

Echidna is the more mature fuzzer with a larger community. Medusa runs workers in parallel, which helps on long campaigns on multi-core machines. Both come from the crytic organization and use a similar property style, so many firms run both.

How do audit firms stop losing leads in Telegram?

Move every lead out of personal chats into a shared pipeline on the day it arrives. crmchat syncs Telegram folders and group chats into deals with an owner and a reminder. For ongoing client groups, see managing audit client groups.