Languages & contract stacks
- Solidity
- Rust
- Move
- DAML
- Cairo
- Stylus
- CosmWasm
- Tact
- FunC
- Tolk
- Vyper
- Sway
- ink!
SMART CONTRACT SECURITY REVIEWS
Find the flaws that put contract logic, protocol integrity, and funds at risk.
Manual, threat-led reviews of smart contracts and on-chain systems. We examine business logic, permissions, accounting, integrations, economics, and upgrade paths against the ways the system can actually fail.
Technology coverage
Languages and ecosystems we review.
From established smart-contract stacks to emerging runtimes, we review the technology your protocol is built on.
Ecosystems
- EVM chains
- NEAR
- Solana
- Sui
- Aptos
- Canton
- Polkadot
- Cosmos
- TON
Don’t see your stack?
This list is representative, not exhaustive.
Review surface
A contract is only as secure as the assumptions around it.
-
01 Logic & state Expected behavior, state transitions, edge cases, invariants, and failure conditions. -
02 Assets & accounting Balances, rounding, precision, settlement, fees, rewards, and value conservation. -
03 Roles & upgrades Authorization, governance, admin paths, initialization, proxies, and upgrade controls. -
04 Integrations & oracles Cross-contract calls, tokens, callbacks, price feeds, and dependency failures. -
05 Economics Incentive failures, front-running, MEV, manipulation, griefing, and insolvency. -
06 Deployment & operations Configuration, privileged actions, recovery paths, monitoring, and release controls.
Timing
When to schedule a review
Before launch
When code, tests, and expected behavior are stable enough for focused review.
Before an upgrade
When changed state, permissions, accounting, or integrations could invalidate earlier assurance.
Before a major integration
When a bridge, oracle, token, custody flow, exchange, or protocol changes the trust model.
After an incident
When the system needs independent review of the failure path and remediation.
Process
From scoped commits to verified findings.
- 01
Align on scope and intent
Confirm repositories, commits, deployment targets, architecture, roles, critical flows, and expected behavior.
- 02
Map trust and invariants
Identify assets, actors, privileged paths, dependencies, and conditions that must always hold.
- 03
Review adversarial paths
Perform manual analysis and targeted testing appropriate to the codebase and risk.
- 04
Resolve and verify
Work through findings and verify agreed in-scope fixes before final status.
Outputs / What you receive
Clear findings, practical fixes, and a report your team can use.
Prioritized findings
Severity, impact, affected paths, evidence, and practical remediation guidance.
Exploit context
How a weakness can be reached and what an attacker or faulty state could achieve.
Technical report
Scope, system context, methodology, findings, limitations, and final status.
Remediation verification
Where agreed in scope, re-review of fixes and updated finding status.
Typical engagement team
Who typically leads this work
The exact team depends on the scope. Every engagement has a principal who owns it from scoping through delivery, joined by the specialists the system calls for, and whoever is assigned is named in your proposal.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Łukasz Mikuła
Specialist Advisor
Offensive security specialist with 10+ years and 100+ public audits across eight ecosystems. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
José C. Ramírez
Specialist Advisor
Security engineer and trainer with around 10 years across application and protocol security. At ZKsync, reviewed Solidity, account abstraction, and Rust, then built AI-assisted vulnerability-analysis workflows.
Inspectable proof
Relevant public work
Each card shows one highlighted finding, not the full result. Open the report for every finding and its severity.
Smart contract Public report
Sweat Economy
SWEAT NEP-141 Token Security Review
Selected public finding High
LookupMap adapter can undercharge storage for selected accounts
- NEAR
- Smart contract
- Rust
Smart contract Public report
Spin Finance
Onchain Orderbook and Perpetual Trading Security Review
Selected public finding Critical
Order Placement with Negative/Zero Margin Ratio Is Possible
- NEAR
- Smart contract
- Rust
Substrate pallet Public report
Virto Network
Pallet Pass Security Review
Selected public finding High
DoS of The Main Functionality Through Session Key Hijacking
- Polkadot
- Substrate pallet
- Rust
FAQ
Questions before scoping
Is this a smart contract audit?
Yes. Buyers often use audit and security review for the same category. We use review to make clear that the work considers behavior, architecture, integrations, and operations as well as source code.
Which languages and ecosystems do you cover?
We review Solidity, Rust, Move, DAML, Cairo, Stylus, CosmWasm, Tact, FunC, Tolk, Vyper, Sway, ink!, and other smart-contract stacks across EVM chains, NEAR, Solana, Sui, Aptos, Canton, Polkadot, Cosmos, and TON.
Does the code need to be final?
The review is most efficient when critical behavior, documentation, tests, and the target commit are stable. Design questions can be reviewed earlier.
Can you review only a change set or upgrade?
Yes, when the surrounding system and inherited assumptions can be understood.
Do you verify fixes?
We include a remediation check where agreed in scope and distinguish fixed, partially fixed, accepted, and unresolved findings.
Related services
Blockchain & Infrastructure ReviewsReview custom chains, runtimes, nodes, consensus, and bridges beneath the application layer.Secure Code ReviewsFind security flaws in critical code where automated scanners and checklist reviews stop.Security ReviewsSix focused reviews across applications, blockchain systems, custody, and AI workflows, matched to the layer your risk actually sits in.
Next step
Put the contracts in front of named reviewers.
Share the repository, target commit, architecture, documentation, launch date, and known risk areas. We will propose a focused review scope.
Discuss your scope