The Challenge
Security used to be the last box before launch. A team finished the code, booked an audit, fixed what came back, and shipped. That worked when less was at stake, and it holds up less well now that a single design flaw in shared infrastructure can reach every project built on top of it.
Particle CS builds security-focused blockchain infrastructure, including Bloxchain Protocol, an open-source, EVM-compatible framework for approvals, time-locks, role-based controls, and transaction governance. Because Bloxchain is designed as a component library that external developers adopt directly in their own EVM stacks, a weakness in the framework would not stay contained to one deployment. That raised the bar for how the code needed to be reviewed before a formal audit, and it is why Particle CS ran security through the whole build rather than saving it for the end.
Bloxchain Protocol ran through our full security pipeline end to end. AuditAgent scanned the code, an AgentArena competition put independent agents against it, and our auditors then reviewed what remained. The team fixed issues after every stage, so the code improved as it moved through the layers.
Key Technical Aspects
Reusable security primitives. Bloxchain is built for other developers to adopt, so a subtle flaw in a shared control could propagate across every downstream integration rather than affecting a single protocol.
Multi-phase workflow logic. The framework governs high-stakes actions through multi-step workflows with time-locks and staged approvals, where the security of the whole depends on state transitions holding correctly across every phase.
Dynamic role-based access control (RBAC). Permissions are assigned and revoked at runtime, which widens the surface for privilege-boundary mistakes compared with static access control.
Meta-transaction handling. Support for meta-transactions introduces signature verification and replay considerations that have to hold under adversarial conditions.
How the Pipeline Works
The Particle CS team described the engagement as a three-layer pyramid, and it matched how we intended the workflow to run.
Layer one is AuditAgent. Particle CS ran both scan modes: the Developer scan to clear noise and standardize the code during development, then the deeper Auditor scan for a closer inspection. After each run the team fixed what it surfaced, so the codebase tightened before reaching the next stage.
Layer two is AgentArena. A multi-agent competition then went after what remained and caught the harder issues, including a critical bug the earlier passes had not. The team resolved those before the manual audit began.
Layer three is human review. Our auditors picked up code the first two layers had already cleaned up, so there were fewer bugs to chase and more of their time went into design and algorithmic optimization instead.
Two things made the layers work together. The team fixed issues after every step rather than banking them for the end, so each stage started from cleaner code than the last. And because the agent runs are non-deterministic, repeating them produced better coverage through redundancy.
This engagement reflects how Nethermind Security combines automated tooling with human expertise across the development lifecycle, so security knowledge compounds from one stage to the next rather than resetting at the audit.
Findings That Mattered
Each layer caught what the one before it left, so the issues that mattered were found and fixed early.
Gaps worth catching early. AuditAgent surfaced gaps the team had not caught internally, which Particle CS described as valuable and non-trivial, and they fixed them before formal review.
A critical bug caught before the audit. The AgentArena competition surfaced the remaining high and medium severity issues, including a critical bug, which the team resolved ahead of the formal audit.
A clean formal pass. With those issues already handled, the manual audit found no high or medium severity issues, which let our auditors spend their time on design and algorithmic optimization rather than basic fixes.
Our Process
Particle CS is a security-first team that runs substantial validation in-house, so the pipeline added layers of scrutiny rather than standing in for their internal review. We worked with the team through a kickoff call and weekly sync calls, which kept triage and remediation moving in step with each stage, and the team updated the codebase after every one.
This outcome is not the typical one. Agents will not clear every codebase this cleanly, and most engagements still surface high or medium severity issues at the manual stage. When the earlier layers do clear the way, though, human auditors can go further, improving efficiency and recommending design optimizations rather than just hunting bugs.
Findings summary: the formal audit returned only low and informational severity findings, with no high or medium.
The Outcome
The result speaks to what the workflow was for. By the time the formal audit ran, the high and medium severity issues were gone, resolved across the earlier layers, so the deepest and most expensive stage of review went to the work only people can do: design judgment and algorithmic optimization.
For a framework built to be reused by external developers, that carries beyond a single deployment. Teams that adopt Bloxchain inherit code that was cleared by repeated automated scanning, stress-tested by an adversarial competition, and then reviewed by auditors who had room to think about how to make it better rather than only whether it was broken.
Particle CS described the process as a natural flow that made sense, and said the progression from AuditAgent to AgentArena to human review worked very well.
“Our experience is very positive with AuditAgent. The findings were carefully reviewed and helped us identify gaps in our code that were very valuable and non-trivial to find. The progression from AuditAgent to AgentArena to human review worked very well, each layer caught what the last one left, and we fixed as we went. A natural flow from start to finish, and we were very happy to work this closely with Nethermind.”
Jacob, Particle CS