OTA Audit

Know exactly where you're exposed before we write any code.

Starts at

$ 2,500 one-time

  • Full CI/CD pipeline review
  • Signing key management audit
  • CDN and bundle delivery analysis
  • Threat model — ranked by exploitability
  • On-chain verification implementation plan
  • Turnaround 1–2 weeks
Book an audit
All service areas

Five services. All flat-rate.

Every velm engagement has a starting price. Custom scope and deeper builds are quoted after a 30-minute discovery call.

On-Chain OTA Verification SDK

Open source Rust crate. Verifies bundle hashes on-chain before any update is applied.

Starts at

$ 0 free / open source

  • Rust crate published to crates.io
  • keccak256 bundle hashing
  • On-chain registry query
  • React Native JSI wrapper
  • MIT licensed
Get the SDK
Managed Multi-Sig Signing

velm operates the signing quorum. M-of-N hardware wallets sign every publish.

Starts at

$ 2,000 per month

  • Gnosis Safe multi-sig deployment
  • Hardware wallet signing ceremonies
  • Sub-5-minute hash publication
  • On-chain revoke / rollback
  • 99.9% uptime SLA
Start managed signing
OTA Pipeline Audit

Full review of your update delivery chain with a prioritised remediation report.

Starts at

$ 2,500 one-time

  • CI/CD configuration review
  • Signing key management audit
  • CDN and delivery analysis
  • Findings + recommendations report
  • 1–2 weeks delivery
Book an audit
React Native JSI Integration

Wrap the Rust verifier as a native module — outside the JS bundle's attack surface.

Starts at

$ 3,000 starting price

  • JSI native module setup
  • iOS + Android delivery
  • Build pipeline integration
  • Verification before JS engine loads
  • 3–4 weeks delivery
Start JSI integration
Wallet Infrastructure Build

Non-custodial wallet with on-chain OTA verification from day one.

Starts at

$ 5,000 starting price

  • BIP-39/44 key generation
  • Rust transaction signing engine
  • On-chain OTA verification built in
  • Multi-chain RPC integrations
  • 4–6 weeks delivery
Start wallet build
Custom scope

Not on the list? Scoped in 48 hours.

Full wallet builds, multi-chain registry deployments, and team-scale signing governance are scoped after a free 30-minute threat review. We'll tell you where you're exposed on the call — no engagement required. Fixed-price quote within 48 hours.

Book a discovery call
Velm