Security Engagements

What this work is

41Swara runs security engagements for fintechs, exchanges, and financial institutions across East Africa: penetration tests against web and mobile platforms, smart contract audits, and incident response when something has already gone wrong. Client identities are confidential without exception — so this page describes methodology and patterns, not logos.

How an engagement runs

• Scoping against the real threat model. A Nairobi fintech's attacker is not an abstract APT — it's SIM-swap rings, insider mule recruitment, and USSD/mobile-money fraud patterns. Scoping starts from the fraud that actually happens in the market, not from a compliance checklist.
• Testing the seams. The findings that matter are rarely in one system. They live between systems: the mobile app that trusts the gateway, the gateway that trusts the telco callback, the reconciliation job that assumes webhooks arrive once. We test integrations as primary attack surface, not as an afterthought.
• Smart contract audits with an economics pass. Beyond reentrancy and access control, every audit includes incentive analysis — what does this contract make profitable? Several of our highest-severity findings were economically exploitable designs that no static analyzer flags.
• Reports engineers can execute. Every finding ships with reproduction steps, a severity argument tied to business impact, and a concrete fix — often a patch sketch. A report that doesn't change the codebase is a failed engagement.

Recurring findings, anonymized

Patterns we've seen enough times to name:

• Webhook handlers that verify signatures but not replay — valid yesterday means valid today.
• Mobile apps that pin certificates but log bearer tokens to third-party crash reporters.
• Smart contracts that are individually sound but composable into a drain via an approved-spender pattern nobody revoked.
• Admin panels protected by VPN but indexed by an internal search appliance that wasn't.

Outcomes

• 40+ engagements led, spanning pre-launch audits to live-incident response.
• Findings from this work seed the malicious-address database behind Wallet Intelligence — consulting and product compound each other.
• Zero public attributions, which is exactly what clients pay for.