Guvenkaya Is Now an Avalanche Vetted Audit Firm
Published
Ava Labs has added Guvenkaya to its audit whitelist. Teams building on Avalanche can now find us on the vetted audit firms page of the Avalanche Builder Hub and request a quote there.
What the listing means
Ava Labs reviews each firm before adding it to the page and removes firms that leave the program. Teams use the page to send one quote request to every listed firm or to a shortlist.
Where Avalanche projects need a closer look
Avalanche lets each L1 control its validators, gas token, and cross-chain messaging. That control lives in contracts and chain configuration, and it is where we look first.
- ICM
Cross-chain messages
- Risk
- A contract that receives Interchain Messaging calls acts on whatever arrives. If it does not check the source chain and sender, an attacker can trigger its logic from a chain they control.
- We check
- Source chain and sender checks, replayed messages, and what the contract does when a message arrives late or fails to execute.
- ICTT
Token transfers between L1s
- Risk
- Interchain Token Transfer locks tokens on a home chain and mints them on remote chains. If the two sides fall out of step, tokens can be minted without backing or stay locked for good.
- We check
- Supply accounting on each side, decimal scaling between chains, and transfers that hop through more than one chain.
- ACP-77
Validator management
- Risk
- Each L1 manages its validator set through a validator manager contract. Whoever controls that contract decides who secures the chain.
- We check
- Owner and admin roles, staking and reward logic, and how validator weight changes are registered.
- Subnet-EVM
Precompile admins
- Risk
- Precompiles such as the Native Minter and Fee Manager let allowlisted addresses mint the native token or change fees.
- We check
- Who holds admin and manager roles, how their keys are protected, and what the genesis and upgrade configs turn on.
- Custom VM
Custom virtual machines
- Risk
- An L1 that runs its own VM carries consensus, state, and networking code that a contract audit does not cover.
- We check
- Block validity rules, state transitions, and denial-of-service paths in the VM code.
How we help teams on Avalanche
These services cover the contracts, chain, keys, and apps of an Avalanche project.
- Smart Contract ReviewsSolidity and Vyper contracts on the C-Chain and Avalanche L1s, from logic and permissions to accounting and upgrades.Explore
- Blockchain & Infrastructure ReviewsAvalancheGo nodes, custom virtual machines, consensus, and bridges, in Go and Rust.Explore
- Cryptography ReviewsReview ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.Explore
- Signing & Custody ReviewsReview key generation, signing approvals, key use, and recovery across MPC, HSM, multisig, and custody platforms.Explore
- Secure Code ReviewsFind security flaws in critical code, including authorization, business logic, and state changes.Explore
- Penetration TestingTest the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.Explore
- AI & Agent SecurityReview models, data, tools, memory, identity, permissions, approval gates, and high-impact actions.Explore
- Secure Architecture & Process DesignDesign or assess critical systems, workflows, integrations, and operating controls before implementation or a major change.Explore
More than two years of reviews with Sweat Economy
Sweat Economy runs on NEAR, not Avalanche, but it shows what working with us looks like after launch. We reviewed its contracts again with each new feature, refactor, and migration.
- public reviews
- 7
- review period
- 2024–2026
- findings fixed, all critical and high
- 36 of 37
“They understand that security is a continuous process rather than a one-off contract audit.”
