Languages & contract stacks
Solidity
Rust
Move
DAML
Cairo
Stylus
CosmWasm
Tact
FunC- Tolk
Vyper
Sway
ink!
Go
C
C++
TypeScript
JavaScript
Java
Kotlin
C#
Python
Find flaws in contract logic, permissions, and accounting.
We review how contracts move funds, enforce permissions, and handle upgrades and integrations.
Technology coverage
Languages and ecosystems we review.
Language support depends on the target chain and contract SDK.
Ecosystems
EVM chains
Starknet
NEAR
Solana
Sui
Aptos
Canton
Polkadot
Cosmos
Casper
Stellar- TON
This list is not exhaustive.
Discuss your smart contracts.
Share the target chain, contract language, and the assets or permissions at stake.
What we review
A contract is only as secure as the assumptions around it.
Logic & state
Expected behavior, state transitions, edge cases, invariants, and failure conditions.
Assets & accounting
Balances, rounding, precision, settlement, fees, rewards, and value conservation.
Roles & upgrades
Authorization, governance, admin paths, initialization, proxies, and upgrade controls.
Integrations & oracles
Cross-contract calls, tokens, callbacks, price feeds, and dependency failures.
Economics
Incentive failures, front-running, MEV, manipulation, griefing, and insolvency.
Deployment & operations
Configuration, privileged actions, recovery paths, monitoring, and release controls.
Timing
When to schedule a review
Before launch
When code, tests, and expected behavior are stable enough for focused review.
Before an upgrade
When changed state, permissions, accounting, or integrations could invalidate earlier assurance.
Ahead of a major integration
Review how a new bridge, oracle, or counterparty changes the system’s trust assumptions.
After an incident
When the system needs independent review of the failure path and remediation.
Our approach
How we review your contracts.
Build the threat model
Agree the scope and target commit. Map assets, roles, trust boundaries, and the ways an attacker could reach them.
Trace flows and define invariants
Follow how funds and permissions move through the contracts. Document the security properties each flow must preserve.
Review the code and write tests
Examine attack paths through manual review and targeted testing. Add security tests to your repo so your team can rerun them.
Verify fixes and document conclusions
We always verify fixes through retesting, record unresolved findings, and tie the principal’s signed opinion to the reviewed commit and supporting evidence.
What you receive
What your team receives.
Findings report
Findings ranked by impact and likelihood, with affected code, evidence, and remediation guidance.
Threat model
Actors, trust boundaries, and attack scenarios, including those blocked by existing controls.
Record of flows and security properties tested
Contract flows showing how funds and permissions move, with the security properties each flow must preserve.
Invariant register
Each security property, its test result, and the evidence your team can use to check future changes.
Security tests in your repo
Regression tests alongside the code, so your engineers can verify fixes and check future changes.
Signed opinion on a reviewed commit
The principal’s conclusions, tied to the reviewed commit, scope, and evidence.
Your review team
Meet the specialists
A principal leads each engagement. Your proposal names the specialists assigned to the scope.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Łukasz Mikuła
Specialist Advisor
Offensive security specialist with 10+ years of experience, 100+ public audits across 8+ ecosystems, and OSCP, OSCE, eWPT, and eWPTX certifications. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
José C. Ramírez
Specialist Advisor
Security engineer and trainer with around 10 years of experience across application and protocol security. At ZKsync, reviewed Solidity and Rust code, including account abstraction, then built AI-assisted vulnerability-analysis workflows.
Published reports
Reports from related reviews
Each report includes the full findings and severity ratings.
Sweat Economy
SWEAT NEP-141 Token Security Review
High LookupMap adapter can undercharge storage for selected accounts
NEAR
Smart contract
Rust
Spin Finance
Onchain Orderbook and Perpetual Trading Security Review
Critical Order Placement with Negative/Zero Margin Ratio Is Possible
- NEAR
- Smart contract
- Rust
NEAR / Defuse Labs
NEAR Intents Security Review
Medium Potential Funds Stealing From Users Via Repeating Failed Intents
- NEAR
Intents- Rust
FAQ
Frequently asked questions
What do you need to scope the review?
To scope the review, we need access to the contract code alongside its purpose, target commit, planned launch date, and your main concerns. Documentation, tests, and details of integrations help us define the scope and estimate the effort.
Which languages and ecosystems do you cover?
We review Solidity, Rust, Move, DAML, Cairo, Stylus, CosmWasm, Tact, FunC, Tolk, Vyper, Sway, ink!, and other smart-contract stacks across EVM chains, NEAR, Solana, Sui, Aptos, Canton, Polkadot, Cosmos, and TON.
Does the code need to be final?
The review is most efficient when critical behavior, documentation, tests, and the target commit are stable. Design questions can be reviewed earlier.
Can you review only a change set or upgrade?
Yes, when the surrounding system and inherited assumptions can be understood.
Do you verify fixes?
Yes. We always provide remediation guidance and verify fixes through retesting. The final report distinguishes fixed, partially fixed, accepted, and unresolved findings.
What determines the price and duration?
Code size is one factor. Contract complexity, integrations, documentation, and the testing needed to check the system’s behavior also affect the effort. Fix verification and retesting are always included. The proposal defines the review scope and retesting schedule.
Related services
Other ways we can help
Blockchain Protocol & Infrastructure Reviews
Review custom chains, runtimes, nodes, consensus, and bridges beneath the application layer.
Explore 
Cryptography Reviews
Review ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.
Explore 
Secure Code Reviews
Find security flaws in critical code, including authorization, business logic, and state changes.
ExploreDiscuss your contract review.
Describe your contracts, planned changes, and launch date. We will propose a review scope.
Discuss your scope