# Guvenkaya Is Now an Avalanche Vetted Audit Firm

> Ava Labs added Guvenkaya to its vetted audit firms. Teams building on Avalanche can request a review from us through the Avalanche Builder Hub.

Published 2026-10-12. Canonical page: https://www.guvenkaya.co/blog/guvenkaya-avalanche-vetted-audit-firm

Ava Labs has added Guvenkaya to its audit whitelist. Teams building on Avalanche can now find us on the [vetted audit firms page](https://build.avax.network/audits/firms) of the Avalanche Builder Hub and request a quote there.

## What the listing means

Ava Labs reviews each firm before adding it to the page and removes firms that leave the program. Teams use the page to send one quote request to every listed firm or to a shortlist.

## Where Avalanche projects need a closer look

Avalanche lets each L1 control its validators, gas token, and cross-chain messaging. That control lives in contracts and chain configuration, and it is where we look first.

### Cross-chain messages (ICM)

**Risk:** A contract that receives Interchain Messaging calls acts on whatever arrives. If it does not check the source chain and sender, an attacker can trigger its logic from a chain they control.

**We check:** Source chain and sender checks, replayed messages, and what the contract does when a message arrives late or fails to execute.

### Token transfers between L1s (ICTT)

**Risk:** Interchain Token Transfer locks tokens on a home chain and mints them on remote chains. If the two sides fall out of step, tokens can be minted without backing or stay locked for good.

**We check:** Supply accounting on each side, decimal scaling between chains, and transfers that hop through more than one chain.

### Validator management (ACP-77)

**Risk:** Each L1 manages its validator set through a validator manager contract. Whoever controls that contract decides who secures the chain.

**We check:** Owner and admin roles, staking and reward logic, and how validator weight changes are registered.

### Precompile admins (Subnet-EVM)

**Risk:** Precompiles such as the Native Minter and Fee Manager let allowlisted addresses mint the native token or change fees.

**We check:** Who holds admin and manager roles, how their keys are protected, and what the genesis and upgrade configs turn on.

### Custom virtual machines (Custom VM)

**Risk:** An L1 that runs its own VM carries consensus, state, and networking code that a contract audit does not cover.

**We check:** Block validity rules, state transitions, and denial-of-service paths in the VM code.

## How we help teams on Avalanche

These services cover the contracts, chain, keys, and apps of an Avalanche project.

- **[Smart Contract Reviews](https://www.guvenkaya.co/services/smart-contract-security-review):** Solidity and Vyper contracts on the C-Chain and Avalanche L1s, from logic and permissions to accounting and upgrades.
- **[Blockchain & Infrastructure Reviews](https://www.guvenkaya.co/services/blockchain-protocol-security-review):** AvalancheGo nodes, custom virtual machines, consensus, and bridges, in Go and Rust.
- **[Cryptography Reviews](https://www.guvenkaya.co/services/cryptography-security-review):** Review ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.
- **[Signing & Custody Reviews](https://www.guvenkaya.co/services/signing-custody-security-review):** Review key generation, signing approvals, key use, and recovery across MPC, HSM, multisig, and custody platforms.
- **[Secure Code Reviews](https://www.guvenkaya.co/services/secure-code-review):** Find security flaws in critical code, including authorization, business logic, and state changes.
- **[Penetration Testing](https://www.guvenkaya.co/services/penetration-testing):** Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.
- **[AI & Agent Security](https://www.guvenkaya.co/services/ai-agent-security):** Review models, data, tools, memory, identity, permissions, approval gates, and high-impact actions.
- **[Secure Architecture & Process Design](https://www.guvenkaya.co/services/secure-architecture-process-design):** Design or assess critical systems, workflows, integrations, and operating controls before implementation or a major change.

## More than two years of reviews with Sweat Economy

Sweat Economy runs on NEAR, not Avalanche, but it shows what working with us looks like after launch. We reviewed its contracts again with each new feature, refactor, and migration.

- [Read the case study](https://www.guvenkaya.co/case-studies/sweat-economy)

## Requesting a review

Select Guvenkaya when you request quotes on the vetted firms page, or contact us directly. Tell us what you are building, which chain or L1 it runs on, and your deadline. We will reply with scoping questions and a proposed next step.

- [Request quotes on Avalanche](https://build.avax.network/audits/firms)
- [Contact us](https://www.guvenkaya.co/contact)