Vertox OnchainOperated by Vertox Onchain LTD Talk to us
Home Services How we work Past work About Contact Talk to us

The on-chain part of your product, built by people who've shipped it before.

We write, test and review the smart contracts your business depends on, and we help you make the decisions that come before them: which chain, which token model, how to handle keys, who audits it. The scope is agreed in writing before we start. One of us leads the job from the first call to the last invoice. Here's how that works in practice.

Talk to us about your project What we do
Deployment monitor — illustrativeEthereum mainnet
Finalised0
Contract calls0
Avg gas (gwei)—

This one’s a simulation. The real thing gets set up for you as part of a build.

Three kinds of work we take on

If yours doesn't fit neatly into one of these, tell us anyway. Most projects touch two.

More detail on each

Building contract systems

Tokens, vaults, staking, vesting, escrow, marketplaces, settlement. We write the contracts, the tests, and the scripts that deploy them, and we hand over a spec that explains why it's built the way it is. This is the bulk of what we do.

  • Solidity, Vyper, Rust on Solana
  • Upgrade paths that don't leave a back door
  • Gas measured, not guessed

Reviewing code before it goes live

You've got contracts (yours or someone else's) and a mainnet date. We go through them properly, write up what we find in order of how much it matters, and check the fixes. Good preparation for a formal audit, or a second pair of eyes after one.

  • Manual read-through, static analysis, fuzzing
  • Where the money could leak

Helping you decide

Sometimes the useful thing isn't code, it's a senior engineer in the room while you work out what to build. Chain choice, token design, how the indexer fits, how users get a wallet without noticing. Retained monthly, minimum three months.

  • Written decisions you can hold us to
  • Key management and signer policy
  • Honest about what shouldn't be on-chain

How a job runs, start to finish

Nothing here is unusual. We just actually do it every time.

The full version

It starts with a conversation about what you're building and where it has got to. We read your code and docs before that call, not during it. Then comes the Statement of Work: the deliverables, the milestones, the price, and what "done" means. Both sides sign it, and nothing is billed before that.

Then the build, deployed to testnet at each milestone, with a written update every week and a proper review before anything touches mainnet. At handover you get the verified contracts, the repo, the runbooks and the monitoring. You sign it off, and we send the last invoice.

Things we'd want to know before hiring us

We're a real UK company

Vertox Onchain LTD is registered in England and Wales. There's a company number and an office address at the bottom of every page.

Nothing starts without a signed SOW

Scope, price, timeline and mainnet criteria go in writing first. If the scope changes, that's a written amendment, not a phone call.

You get one person, not a queue

Every engagement is led by a named senior engineer who stays with it. You'll know who to ring.

We don't touch your money

No custody, no treasury management, no tokens issued on your behalf. Deployment keys stay with you or a custodian you choose.

Built so an auditor can pick it up cold

Every build ships with the threat model, the invariants and the test coverage written down, which makes an auditor's quote cheaper. Contracts are verified on the explorer, the repository is yours, and we keep the discovery notes, SOWs and sign-offs on file.

Got something you're trying to put on-chain?

The first conversation is free and there's no obligation after it.

Talk to us

What we do

Three types of engagement, each with a clear deliverable. Anything outside these gets scoped on its own after we've talked.

Building contract systems

Usually takes4 to 12 weeks
You getVerified contracts, tests, deploy scripts, a written spec

This is the bulk of what we do. We start from a spec you've approved, build on testnet in milestones, and finish with a verified mainnet deployment and everything you need to run it without us.

  • Token contracts (ERC-20, 721, 1155, SPL) with vesting, permit and controlled minting
  • Staking, vaults, escrow, settlement and revenue-share logic
  • Marketplaces, auctions and order flow
  • Upgradeable contracts where they're justified, with the governance written down
  • Cross-chain messaging and bridges (LayerZero, CCIP, Wormhole)
  • Foundry or Hardhat test suites, fuzzing, gas reports, CI wired into your repo

Reviewing code before it goes live

Usually takes1 to 4 weeks
You getA findings report ranked by severity, then a re-check of your fixes

We read the contracts line by line, run the tooling, and try to break the economics. What you get back is a plain-English report of what we found and how much each thing matters. It's not a replacement for an independent audit where you need one, but it means you go into that audit with the obvious problems already gone.

  • A threat model and a list of what the system assumes to be true
  • Manual review plus Slither, Aderyn, Echidna and Foundry fuzzing
  • Oracle, liquidation and MEV exposure
  • Who can do what, and how upgrades and keys are controlled
  • A signed letter confirming which findings were fixed

Helping you decide

Usually takesMonthly retainer, three months minimum
You getA senior engineer on your team, decisions in writing

For teams that need judgement more than hands. One of us sits in on your planning, argues for and against things, and writes down what was decided and why, so nobody has to remember it later.

  • Which chain or L2, with the real trade-offs on cost, finality and who else is there
  • Token and incentive design (the mechanism, not the marketing)
  • Indexers, subgraphs, relayers and how the backend hangs together
  • Wallets, account abstraction and onboarding for people who've never used either
  • Multisig policy, signer rotation, what to do at 3am when something's wrong
  • Picking auditors and vendors, without taking a cut from any of them

What we're comfortable with

LayerRegular useNotes
ChainsEthereum, Arbitrum, Base, Optimism, Polygon, Solana, AvalancheOther EVM chains are fine; ask
LanguagesSolidity, Vyper, Rust (Anchor), TypeScriptMove depends on the project
ToolingFoundry, Hardhat, OpenZeppelin, Slither, Echidna, TenderlyWe'll use your CI if you have one
InfrastructureThe Graph, Ponder, Alchemy, QuickNode, Safe, Fireblocks integrationsWe integrate with custodians; we aren't one
Front-endviem, wagmi, ethers, Solana web3.js, RainbowKit, PrivyWallet and onboarding flows only; full front-ends are a separate scope

Things we'll say no to

Holding or moving your funds. Running a token sale. Giving investment or legal advice. Issuing a token in our name for your project. If a job strays into territory that needs a regulator's permission, we'll tell you and point you at someone who has it.

Not sure which one you need?

Half an hour on a call usually sorts that out.

Talk to us

How we work

Every job goes through the same stages. Each one ends with something written down that you sign off before we move on. It's not glamorous, but it's why nobody's surprised at the end.

  1. 01

    Discovery

    We talk about the product, who it's for, what's already built, what chain constraints you have, whether there's a regulator in the picture, and what a good outcome looks like. If there's existing code, we read it before the call.

    You get: our notes and a first recommendation within five working days.
  2. 02

    Statement of Work

    Scope, deliverables, testnet and mainnet milestones, what counts as accepted, the fee and when it's paid. Both sides sign it. Nothing is billed before that.

    You get: a signed SOW and engagement letter.
  3. 03

    Spec

    Interfaces, state, who can do what, how upgrades work, and what could go wrong. You approve it before we write any production code. It's the document an auditor reads first.

    You get: an approved spec and a record of the design decisions.
  4. 04

    Build and testnet

    Milestones deployed to testnet as they're finished, with tests, fuzzing and CI. Every week you get a written update: what's done, what's next, anything that's changed.

    You get: testnet deployments, access to the repo, weekly updates.
  5. 05

    Verification

    An internal review against the spec, a fix cycle, and coordination with a third-party auditor if the SOW calls for one. We go through the mainnet checklist from the SOW item by item.

    You get: a review report and a signed mainnet checklist.
  6. 06

    Mainnet and handover

    Deployed from your keys or your custodian's, verified on the explorer. You get the repositories, the runbooks, the monitoring, and a plan for what to do if something breaks.

    You get: the deployment record and the handover pack.
  7. 07

    Sign-off and invoice

    We check the deliverables against what the SOW said, you sign off, we send the final invoice. If you want ongoing support afterwards, that's a separate, short SOW.

    You get: an acceptance record and the last invoice.

When the scope changes

It usually does. We write it up as a numbered amendment with the effect on fee and timeline, and both sides sign before the extra work happens. We don't take scope changes over the phone, mostly because that's how every bad project we've heard of started.

Keys

We'd rather never hold a deployment or admin key at all. Deployments run from your multisig or your custodian. Where we absolutely must sign something, the key is created for that one purpose and rotated out straight after.

Records

Discovery notes, SOWs, specs, review reports, sign-offs and invoices are kept for six years. Ask and we'll send you a copy.

Staying in touch

One named engineer. A shared channel of your choosing, plus the weekly written update. Check-ins go in the SOW so nobody's chasing anyone.

Confidentiality

Happy to sign a mutual NDA before discovery. Repos stay private until you decide otherwise, and we don't mention client work publicly without asking first.

Past work

A few jobs that give a fair picture of what we do. Names are left out under NDA and some details have been rounded off. Happy to go into more depth on a call.

Invoice finance, Arbitrum

Settling invoices on-chain without touching the money

A UK invoice-finance platform wanted funders and SMEs to settle directly on-chain, but couldn't be in the middle holding anyone's money. We wrote the escrow and settlement contracts, put stablecoin rails behind them, and set up role-based access so the compliance team could see everything and change nothing. The back office reads from an indexer we built for it.

Ten weeks to mainnet. They came away with verified contracts, a Foundry suite at 96% branch coverage, a subgraph and an ops runbook, and their auditor came back with nothing critical.

Consumer loyalty app, Base

Moving 400,000 users' points on-chain without them noticing

A consumer app wanted its closed loyalty scheme to become real, tradeable tokens. Its users had never heard the word "gas" and weren't going to learn it. So: ERC-1155 reward contracts, embedded wallets with sponsored gas so nobody had to buy ETH, a claim flow, and anti-sybil controls less annoying than a captcha.

Eight weeks, then three months of advisory. We left them the contracts, the paymaster policy, the migration tooling and the dashboards. Ninety-two percent of migrated users made a first claim.

Lending protocol, Ethereum

Four weeks before the audit, a codebase written in a hurry

The team had booked a good auditor, the slot was fixed, and they knew the code had been rushed. They wanted to not waste the slot. Three weeks: a threat model, manual review, fuzzing on the liquidation and interest-accrual paths, and a look at oracle and MEV exposure. Two highs, five mediums, eleven lows. All the highs and mediums were fixed and re-checked before the audit started, and the audit found one medium.

Game studio, Solana

Tradeable items for a game that mints a lot of them

A studio wanted in-game items players could actually own and sell, with royalties, and minting that the game server controlled rather than the player. We wrote Anchor programs for the minting and the marketplace, used compressed NFTs so the volume didn't cost a fortune, and designed the server-side signer, including how to rotate it.

Twelve weeks. Programs, a TypeScript SDK, the signer service spec and its runbook, load-tested to 1,200 mints a minute on devnet.

Sound familiar?

Tell us about yours. The first call is free and we'll write up what we think afterwards.

Talk to us

About

Vertox Onchain LTD is a small UK consultancy doing smart-contract and protocol work, after a few years spent auditing and fixing other people's cloud infrastructure.

Why we split it out

Vertox Onchain started as a cloud and infrastructure practice: audits, API work, DevOps, that sort of thing, mostly for regulated and fast-growing businesses in the UK. Over time more of those clients started asking us about putting bits of their products on-chain, and the honest answer was that it's a different job. The tooling is different, the failure modes are different, and the mistakes cost more and can't be rolled back.

So we set up Vertox Onchain to do that work properly, with the same rules we already had: scope in writing, one accountable person, and a paper trail you can show your board or your auditor.

How we're set up

Everything is contracted through Vertox Onchain LTD, registered in England and Wales, under English law. We're a small group of senior engineers rather than a big team, and each job is led by one of us the whole way through. We don't hand things to juniors and we don't outsource.

We don't hold client funds, run treasuries, issue tokens, or take a position in anything we build. We invoice in pounds or dollars against the milestones in the SOW.

The company

Vertox Onchain LTD
Registered in England and Wales
Company number 17454270
Registered office: 82A James Carter Road, Mildenhall IP28 7DE, United Kingdom

Rules we stick to

  • Scope in writing before any work
  • One engineer accountable per job
  • Keys stay with the client
  • Everything checkable: contracts, tests, records
  • Say no to work that needs a licence we don't have

Independence

We aren't attached to any chain foundation, exchange or token project, and we don't take referral fees from the auditors, custodians or infrastructure companies we recommend. If we suggest someone, it's because we'd use them.

Talk to us

Tell us what you're building and where it's at. We'll reply within two working days, usually to suggest a half-hour call.

We'll need your name.
And the company.
That doesn't look like an email address.
Pick the closest one, or "Not sure yet".
Give us a sentence or two to go on.
We need a tick here to be able to write back.
Your draft stays in this browser until you send it.

Nearly there

Your email app should have opened with the message filled in. If it didn't, send it to hello@vertoxonchain.com yourself; the text is below.

Email

hello@vertoxonchain.com

If you're sending code, encrypted email is better. Please never send us private keys or seed phrases, for anything.

What happens after you send it

We read it, and anything you've linked to.
We set up a half-hour call. No charge.
After that you get our thoughts in writing and, if it makes sense, a draft SOW.

Post

Vertox Onchain LTD
82A James Carter Road
Mildenhall IP28 7DE, United Kingdom
Company number 17454270

Terms of use

These cover the website. Actual work is governed by the Statement of Work and engagement letter we both sign.

1. Who we are

This site is run by Vertox Onchain LTD ("we", "us"), registered in England and Wales, company number 17454270, registered office 82A James Carter Road, Mildenhall IP28 7DE, United Kingdom.

2. What this site is for

It describes what we do. It isn't technical, legal, financial or investment advice, and it isn't an offer. Please don't make decisions on the strength of it alone.

3. When work actually starts

Reading this site or sending us an enquiry doesn't make us your consultants. That only happens under a Statement of Work signed by both of us, which sets out what we're doing, for how much, and on what terms.

4. Money and regulation

We don't hold client funds or digital assets, run treasuries, issue tokens, or carry on any regulated financial activity. Nothing here promotes any token or investment.

5. Ownership

The content and design of this site belong to Vertox Onchain LTD unless it says otherwise. Past-work write-ups are published with client permission and with identifying details removed.

6. Liability

As far as the law allows, we aren't liable for losses arising from reliance on this site. Nothing here limits any liability that can't be limited under English law.

7. Law

English law applies, and the courts of England and Wales have exclusive jurisdiction.

Last updated September 2026

Privacy policy

What we do with personal information that comes through this site and through working with us.

1. Who's responsible

Vertox Onchain LTD (company number 17454270, 82A James Carter Road, Mildenhall IP28 7DE, UK) is the data controller. You can reach us at hello@vertoxonchain.com.

2. What we collect

  • Whatever you put in an enquiry: name, company, email, chain, and what you're building.
  • Emails and messages during discovery and any engagement.
  • Basic technical information your browser sends when you load a page. We don't run analytics or advertising trackers. If you start filling in the contact form, the draft is saved in your own browser's storage until you send or clear it; it never reaches us until you press send.

3. Why

To reply to you, scope and deliver work, meet our legal and accounting obligations, and keep the records described on the How we work page. Legally that's: performing a contract or the steps leading to one, our legitimate interest in running the business, and legal obligation.

4. Who else sees it

Nobody buys it from us. We may share it with our accountants, lawyers, or the IT providers we use under contract, or where the law requires. We don't send data outside the UK except to providers with proper safeguards in place.

5. How long we keep it

Enquiries that don't turn into work are deleted after twelve months. Records from engagements are kept for six years after the job ends, which is what UK accounting and limitation rules expect.

6. Your rights

You can ask to see what we hold about you, have it corrected or deleted, object to or restrict how we use it, and complain to the Information Commissioner's Office (ico.org.uk). Email us to do any of that.

Last updated September 2026

Nothing here

That page doesn't exist, or it's moved.

Back to the start