# Blockchain Protocol & Infrastructure Reviews

> Review custom chains, runtimes, nodes, consensus, and bridges beneath the application layer.

Canonical page: https://www.guvenkaya.co/services/blockchain-protocol-security-review

**Review the chain, runtime, and execution layer beneath the application.** Security reviews for custom chains, rollup stacks, runtimes, and the node and consensus code beneath them. A flaw in these layers can affect the applications that depend on them.

## Review the layers that determine safety, liveness, and control.

- **Consensus & finality**: Safety assumptions, liveness failures, validator behavior, fork handling, and recovery.
- **Runtime & state transition**: State-machine logic, invariants, authorization, economics, resource limits, and upgrades.
- **Virtual machines & execution**: Instruction semantics, bytecode validation, metering, determinism, and whether the sandbox holds.
- **Node & client**: Parsing, storage, concurrency, memory safety, validation, and error handling.
- **Networking & RPC**: Peer behavior, message validation, denial of service, exposure, rate limits, and trust boundaries.
- **Critical operators**: Keys, privilege, deployment, monitoring, and failover for validators, sequencers, and relayers.
- **Bridges & integrations**: Message verification, cross-domain assumptions, relayers, oracles, wallets, and off-chain boundaries.
- **Governance & upgrades**: Proposal, approval, activation, rollback, emergency control, and recovery.

## When to bring Guvenkaya in

- **During architecture**: Challenge the threat model while core safety and liveness choices can change.
- **Before release**: Once behavior is stable enough to test, and while a fix is still a code change rather than a migration.
- **When a critical change lands**: A runtime module, a consensus change, or a new bridge alters what the chain guarantees.
- **During assurance**: For an upgrade, migration, incident review, or ongoing assurance program.

## How we review your protocol.

1. **Build the threat model**: Agree the scope and target commit. Document actors, assets, trust boundaries, and assumptions inherited from clients, validators, and other dependencies.
2. **Trace state and message flows**: Follow consensus, execution, upgrades, and cross-boundary messages. Record the safety and liveness properties each flow must preserve.
3. **Review the protocol and write tests**: Examine implementation and configuration for ways to violate those properties. Add regression tests to your repo and record results against the invariants.
4. **Verify fixes and document conclusions**: We always verify fixes through retesting and record remaining risks to safety, liveness, or funds. Tie the principal’s signed opinion to the reviewed commit and evidence.

## Deliverables

- **Findings report**: Ranked by whether they threaten safety, liveness, or funds, each with the scenario that sets it off.
- **Threat model**: Who is trusted, where the boundaries sit, and which assumptions you inherited from a dependency rather than chose. The register includes scenarios blocked by existing controls.
- **Record of flows and security properties tested**: Consensus, execution, upgrades, and the bridges between them, each with the safety and liveness properties it is responsible for.
- **Invariant register**: Each security property, its test result, and supporting evidence.
- **Security tests in your repo**: Regression tests for the reviewed runtime, client, or module, ready to rerun after fixes and future changes.
- **Signed opinion on a reviewed commit**: The principal’s conclusions, tied to the reviewed commit, scope, and evidence.

## Engagement team

- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.
- **Michal Bajor**, Specialist Advisor: Exchange, funding, custody, API, web application, red-team, and L1 security.
- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.

## Published reports

- [Virto Network: Pallet Pass Security Review](https://github.com/Guvenkaya/public-reports/blob/master/Virto-Network-Pallet-Pass-Security-Review-Final-Report.pdf)
- [NEAR Intents: NEAR Intents Security Review](https://github.com/Guvenkaya/public-reports/blob/master/NEAR-Defuse-Labs-NEAR-Intents-Security-Review.pdf)

## Frequently asked questions

### Do you verify fixes?

Yes. We always provide remediation guidance and verify fixes through retesting. The final report records the remediation status and any unresolved findings.

### Do you review custom chains?

Yes. Scope can include custom Layer 1, Layer 2, rollup, and appchain architecture; runtime and VM logic; node and client code; consensus; networking; validator operations; upgrades; and integrations.

### Can you review only the changes to an existing chain?

Yes, when the changes can be assessed in the context of the existing system. We agree the baseline, changed components, and inherited assumptions that need checking.

### What test environment do you need?

We need access to the code to scope a protocol implementation review, alongside architecture documentation, your main concerns, and your deadline. Build instructions, configuration, existing tests, and a local network or testnet help us reproduce behavior. We agree any validator, node, or infrastructure access before testing.

### Do you review bridges?

Yes. Bridge security often spans contracts, verification, relayers, validators, oracles, services, key management, and operations.

### How is this different from a smart contract audit?

A smart contract review focuses on application-level logic. A blockchain systems review reaches into the chain, runtime, virtual machine, node, consensus, networking, and operational layers.

## Related services

- [Smart Contract Security Reviews](https://www.guvenkaya.co/services/smart-contract-security-review.md): Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.
- [Cryptography Reviews](https://www.guvenkaya.co/services/cryptography-security-review.md): Review ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.
- [Secure Code Reviews](https://www.guvenkaya.co/services/secure-code-review.md): Find security flaws in critical code, including authorization, business logic, and state changes.

## Discuss your protocol review.

Describe the protocol, planned release, and main security concerns. We will help define the scope.

Discuss your scope: https://www.guvenkaya.co/contact