Implementation languages
Go
Rust
C
C++
Zig
TypeScript
JavaScript
Java
Kotlin
C#
Python
Swift
PHP
Review the chain, runtime, and execution layer beneath the application.
Security reviews for custom chains, rollup stacks, runtimes, and the node and consensus code beneath them. A flaw in these layers can affect the applications that depend on them.
Technology coverage
Languages, stacks, and execution environments we review.
From established protocol SDKs and rollup frameworks to custom chains, we review the code and architecture beneath the application layer.
Protocol stacks & frameworks
Substrate / Polkadot SDK
Arbitrum (Nitro / Orbit)
OP Stack
AvalancheGo- Subnet-EVM
ZK Stack
Cosmos SDK
Reth
Commonware
Tendermint
Custom chain
Virtual machines & execution
EVM-compatible
SVM-compatible
Move VM-compatible
WASM-based
RISC-V-based- Custom VMs
This list is not exhaustive.
Discuss your protocol.
Describe the consensus, execution, or networking components you need reviewed.
What we review
Review the layers that determine safety, liveness, and control.
Consensus & finality
Safety assumptions, liveness failures, validator behavior, fork handling, and recovery.
Runtime & state transition
State-machine logic, invariants, authorization, economics, resource limits, and upgrades.
Virtual machines & execution
Instruction semantics, bytecode validation, metering, determinism, and whether the sandbox holds.
Node & client
Parsing, storage, concurrency, memory safety, validation, and error handling.
Networking & RPC
Peer behavior, message validation, denial of service, exposure, rate limits, and trust boundaries.
Critical operators
Keys, privilege, deployment, monitoring, and failover for validators, sequencers, and relayers.
Bridges & integrations
Message verification, cross-domain assumptions, relayers, oracles, wallets, and off-chain boundaries.
Governance & upgrades
Proposal, approval, activation, rollback, emergency control, and recovery.
Timing
When to bring Guvenkaya in
During architecture
Challenge the threat model while core safety and liveness choices can change.
Before release
Once behavior is stable enough to test, and while a fix is still a code change rather than a migration.
When a critical change lands
A runtime module, a consensus change, or a new bridge alters what the chain guarantees.
During assurance
For an upgrade, migration, incident review, or ongoing assurance program.
Our approach
How we review your protocol.
Build the threat model
Agree the scope and target commit. Document actors, assets, trust boundaries, and assumptions inherited from clients, validators, and other dependencies.
Trace state and message flows
Follow consensus, execution, upgrades, and cross-boundary messages. Record the safety and liveness properties each flow must preserve.
Review the protocol and write tests
Examine implementation and configuration for ways to violate those properties. Add regression tests to your repo and record results against the invariants.
Verify fixes and document conclusions
We always verify fixes through retesting and record remaining risks to safety, liveness, or funds. Tie the principal’s signed opinion to the reviewed commit and evidence.
What you receive
What your team receives.
Findings report
Ranked by whether they threaten safety, liveness, or funds, each with the scenario that sets it off.
Threat model
Who is trusted, where the boundaries sit, and which assumptions you inherited from a dependency rather than chose. The register includes scenarios blocked by existing controls.
Record of flows and security properties tested
Consensus, execution, upgrades, and the bridges between them, each with the safety and liveness properties it is responsible for.
Invariant register
Each security property, its test result, and supporting evidence.
Security tests in your repo
Regression tests for the reviewed runtime, client, or module, ready to rerun after fixes and future changes.
Signed opinion on a reviewed commit
The principal’s conclusions, tied to the reviewed commit, scope, and evidence.
Your review team
Meet the specialists
A principal leads each engagement. Your proposal names the specialists assigned to the scope.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Michal Bajor
Specialist Advisor
Security specialist with 60+ Web3 reviews across DeFi, L1s, bridges, oracles, and other critical infrastructure. At Kraken, worked on the security of funding services, custody, APIs, and on-chain systems.
Piotr Cielas
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Published reports
Reports from related reviews
Each report includes the full findings and severity ratings.
Virto Network
Pallet Pass Security Review
High DoS of The Main Functionality Through Session Key Hijacking
Polkadot
Substrate
Rust
NEAR Intents
NEAR Intents Security Review
Medium Potential Funds Stealing From Users Via Repeating Failed Intents
NEAR
Intents- Rust
Enjin
Relaychain and Matrixchain Security Review
Critical DoS of Fuel Tank Mutation
- Polkadot
- Substrate
- Rust
Enjin
Claims Pallet Security Review
Critical DoS of Claiming Functionality
- Polkadot
- Substrate
- Rust
FAQ
Frequently asked questions
Do you verify fixes?
Yes. We always provide remediation guidance and verify fixes through retesting. The final report records the remediation status and any unresolved findings.
Do you review custom chains?
Yes. Scope can include custom Layer 1, Layer 2, rollup, and appchain architecture; runtime and VM logic; node and client code; consensus; networking; validator operations; upgrades; and integrations.
Can you review only the changes to an existing chain?
Yes, when the changes can be assessed in the context of the existing system. We agree the baseline, changed components, and inherited assumptions that need checking.
What test environment do you need?
We need access to the code to scope a protocol implementation review, alongside architecture documentation, your main concerns, and your deadline. Build instructions, configuration, existing tests, and a local network or testnet help us reproduce behavior. We agree any validator, node, or infrastructure access before testing.
Do you review bridges?
Yes. Bridge security often spans contracts, verification, relayers, validators, oracles, services, key management, and operations.
How is this different from a smart contract audit?
A smart contract review focuses on application-level logic. A blockchain systems review reaches into the chain, runtime, virtual machine, node, consensus, networking, and operational layers.
Related services
Other ways we can help
Smart Contract Security Reviews
Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.
Explore 
Cryptography Reviews
Review ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.
Explore 
Secure Code Reviews
Find security flaws in critical code, including authorization, business logic, and state changes.
ExploreDiscuss your protocol review.
Describe the protocol, planned release, and main security concerns. We will help define the scope.
Discuss your scope