For banks, exchanges, custodians, and protocol teams
Six senior specialists you can look up before you sign. A principal on the work from scope to fix.
Clients and ecosystems we have worked with.
Client feedback
“Timur is one of the most competent auditors, specialising in Rust-based smart contract environments. He has assisted several teams in the NEAR ecosystem over the past few years and it’s been a pleasure seeing him work with teams across many stages and domains.”
“We worked with few known security ‘brands’ in the past. Timur Güvenkaya and his team are different. They understand that security is a continuous process rather than one-off contract audit, they think about a wider perimeter and work in an extremely agile fashion. Most of our work now goes to them.”
“Guvenkaya are The Auditors. Deep expertise in Rust and smart contracts combined with hands-on, iterative approach make them a go-to partner for serious projects. They don’t just look for bugs, they help to build robust systems from the ground up. We’ve trusted them with multiple audits across different stages, and continue to rely on their judgment and precision.”
The team
Every specialist on your engagement is named in the proposal, with a LinkedIn you can check and published reports you can read.
OSCP · OSWE · CREST CRT · CISM · AWS Security · CVE disclosures · U.S. patents
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Growth & Marketing Partner
Leads growth through performance marketing, data-led strategy, and audience planning. Agency experience with major healthcare and e-commerce brands across different markets.
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Currently
Head of Security, Agora
$45B+ in volume
Specialist Advisor
Head of Security at Gauntlet, with depth across product security, IAM, cloud, DevSecOps, and blockchain. Previously held security roles at Tensor, EY, Broadcom, and ADP.
Currently
Head of Security, Gauntlet
$1.6B+ TVL
Specialist Advisor
Secured funding, custody, APIs, and on-chain systems at Kraken. Has reviewed 60+ Web3 projects across DeFi, L1s, bridges, oracles, and other critical infrastructure.
Specialist Advisor
Offensive security specialist with 10+ years and 100+ public audits across eight ecosystems. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
Specialist Advisor
Security engineer and trainer with around 10 years across application and protocol security. At ZKsync, reviewed Solidity, account abstraction, and Rust, then built AI-assisted vulnerability-analysis workflows.
A principal scopes the work, QAs the findings, and stays reachable for the whole engagement.
2 of the team are Heads of Security at other companies today. Others came from exchanges, protocols, and security product companies.
A custody review gets the custody specialist. The named team changes with what you are building.
What an engagement looks like
| Stage | Principal | Specialists |
|---|---|---|
| Scope | Leads the stage | Assists |
| Review | Assists | Leads the stage |
| Report | Assists | Leads the stage |
| QA | Leads the stage | Assists |
| Remediation | Leads the stage | Leads the stage |
| Retest | Assists | Leads the stage |
One principal, plus the specialists the system needs. Specialists write the report; the principal QAs it before it reaches you.
Public work
Full reports, not summaries. Most contain critical or high severity findings.
Highlighted findings from published reports, not the reports themselves. Each card opens the full report it came from, where every finding and its severity is listed.
NEAR Intents Security Review
Potential Funds Stealing From Users Via Repeating Failed Intents
SWEAT NEP-141 Token Security Review
LookupMap adapter can undercharge storage for selected accounts
Onchain Orderbook and Perpetual Trading Security Review
Order Placement with Negative/Zero Margin Ratio Is Possible
Solana Trading Bot Security Review
Incorrect Use of Async in Reward Distribution
NEAR Smart Contract Security Review
Race Condition in Borrow Functionality
Pallet Pass Security Review
DoS of The Main Functionality Through Session Key Hijacking
Services
Show us the code, system, workflow, or planned change. We will recommend the right review, test, or design work.
Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.
Explore service →Review custom chains, runtimes, nodes, consensus, and bridges beneath the application layer.
Explore service →Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.
Explore service →Review how keys are generated, approved, used, and recovered across MPC, HSM, multisig, and custody platforms.
Explore service →Send the repo or the architecture and we will tell you.
Banks, asset managers, fintechs, payment firms, and financial infrastructure.
Exchanges, custodians, wallets, stablecoin operators, and asset platforms.
L1 and L2 systems, ecosystems, bridges, DeFi protocols, and onchain products.
Web, mobile, cloud, backend, AI, and other critical software systems.
Contact
Share the system, repository, architecture, target date, and your main concerns. We will reply with the next questions, a likely scope, and the engineers who would join the first call.