Trail of Bits

# Trail of Bits > Trail of Bits is a cybersecurity research and engineering firm, founded in 2012. The site is a research portal: open-source tools, public audit reports, academic papers, conference talks, and podcasts, organized by security domain. Library totals: 1020 publications — 620 reports, 133 talks, 40 papers, 44 catalog tools. 200+ public repositories across the Trail of Bits, Crytic, and Lifting Bits organizations. Content spans six security domains: AI/ML Security, Blockchain Security, Cryptography, Systems Security, Application Security, Software Supply Chain. Any of these can be used as a filter on the library. ## Key pages - [Explore — full library](https://trailofbits.com/library/): every report, paper, talk, podcast, and policy comment, searchable. - [Open-source tools](https://trailofbits.com/tools/): the tool catalog, organized by the problem each solves. - [Reports](https://trailofbits.com/reports/): security reviews with cover thumbnails. - [Talks](https://trailofbits.com/talks/): conference talks and presentations. - [Services](https://trailofbits.com/services/): how engagements work. - [Team](https://trailofbits.com/team/): the people and the firm's history. ## Services - [Software Assurance](https://trailofbits.com/services/software-assurance/): Multi-disciplinary security reviews across the whole SDLC, with a team sized to your threat model rather than a fixed template. - [AI/ML Security](https://trailofbits.com/services/ai-ml/): We review AI systems end to end, from training data and MLOps pipelines to model artifacts, inference hardware, and deployed agent loops. - [Application Security](https://trailofbits.com/services/application-security/): Deep code, cloud, and architecture review that finds the root cause and the fix that retires the whole bug class. - [Blockchain](https://trailofbits.com/services/blockchain/): We review every layer of a blockchain system, from smart contracts to nodes and bridges, backed by Slither, Echidna, and Medusa. - [Cryptography](https://trailofbits.com/services/cryptography/): PhD-level cryptographers who build and break real protocols, from zero-knowledge proofs and MPC to post-quantum migrations. - [Security Engineering](https://trailofbits.com/services/security-engineering/): An embedded team that builds custom security tooling and remediates vulnerabilities across your pipeline, from development through deployment. - [Research & Development](https://trailofbits.com/services/research-and-development/): Multi-year research that uncovers Internet-scale vulnerabilities and turns the findings into open-source tools, papers, and standards. ## Open-source tools - [Slither](https://trailofbits.com/tools/slither/): Static analysis for Solidity and Vyper with built-in detectors and an API for custom checks. - [Echidna](https://trailofbits.com/tools/echidna/): Property-based fuzzer that throws grammar-driven inputs at Ethereum contracts to falsify your invariants. - [Medusa](https://trailofbits.com/tools/medusa/): Parallel smart-contract fuzzing built on go-ethereum and designed for large-scale test campaigns. - [Etheno](https://trailofbits.com/tools/etheno/): JSON-RPC multiplexer and test-integration layer for contract analysis tools. - [Tealer](https://trailofbits.com/tools/tealer/): Static analysis for Algorand TEAL programs with CFG construction and vulnerability detectors. - [Circomspect](https://trailofbits.com/tools/circomspect/): Static analysis and linting for Circom circuits, aimed at catching risky patterns in zero-knowledge code. - [Remill](https://trailofbits.com/tools/remill/): Machine-code lifter that translates instructions into LLVM bitcode for later analysis and transformation. - [Anvill](https://trailofbits.com/tools/anvill/): Lifting primitives that aim for Clang-like bitcode quality so decompiled output is easier to reason about. - [VMill](https://trailofbits.com/tools/vmill/): Snapshot-based process emulator for executing lifted binaries and instrum […gekürzt]