# Smart Contract Security Reviews

> Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.

Canonical page: https://www.guvenkaya.co/services/smart-contract-security-review

**Find flaws in contract logic, permissions, and accounting.** We review how contracts move funds, enforce permissions, and handle upgrades and integrations.

## A contract is only as secure as the assumptions around it.

- **Logic & state**: Expected behavior, state transitions, edge cases, invariants, and failure conditions.
- **Assets & accounting**: Balances, rounding, precision, settlement, fees, rewards, and value conservation.
- **Roles & upgrades**: Authorization, governance, admin paths, initialization, proxies, and upgrade controls.
- **Integrations & oracles**: Cross-contract calls, tokens, callbacks, price feeds, and dependency failures.
- **Economics**: Incentive failures, front-running, MEV, manipulation, griefing, and insolvency.
- **Deployment & operations**: Configuration, privileged actions, recovery paths, monitoring, and release controls.

## When to schedule a review

- **Before launch**: When code, tests, and expected behavior are stable enough for focused review.
- **Before an upgrade**: When changed state, permissions, accounting, or integrations could invalidate earlier assurance.
- **Ahead of a major integration**: Review how a new bridge, oracle, or counterparty changes the system’s trust assumptions.
- **After an incident**: When the system needs independent review of the failure path and remediation.

## How we review your contracts.

1. **Build the threat model**: Agree the scope and target commit. Map assets, roles, trust boundaries, and the ways an attacker could reach them.
2. **Trace flows and define invariants**: Follow how funds and permissions move through the contracts. Document the security properties each flow must preserve.
3. **Review the code and write tests**: Examine attack paths through manual review and targeted testing. Add security tests to your repo so your team can rerun them.
4. **Verify fixes and document conclusions**: We always verify fixes through retesting, record unresolved findings, and tie the principal’s signed opinion to the reviewed commit and supporting evidence.

## Deliverables

- **Findings report**: Findings ranked by impact and likelihood, with affected code, evidence, and remediation guidance.
- **Threat model**: Actors, trust boundaries, and attack scenarios, including those blocked by existing controls.
- **Record of flows and security properties tested**: Contract flows showing how funds and permissions move, with the security properties each flow must preserve.
- **Invariant register**: Each security property, its test result, and the evidence your team can use to check future changes.
- **Security tests in your repo**: Regression tests alongside the code, so your engineers can verify fixes and check future changes.
- **Signed opinion on a reviewed commit**: The principal’s conclusions, tied to the reviewed commit, scope, and evidence.

## Engagement team

- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.
- **Łukasz Mikuła**, Specialist Advisor: Offensive security, exploit development, mobile, infrastructure, and multi-ecosystem reviews.
- **José C. Ramírez**, Specialist Advisor: Smart contract, protocol, application, Rust, EVM, and AI-assisted security analysis.

## Published reports

- [Sweat Economy: SWEAT NEP-141 Token Security Review](https://github.com/Guvenkaya/public-reports/blob/master/The-Sweat-Foundation-Ltd-SWEAT-NEP-141-Token-Smart-Contract-Security-Review.pdf)
- [Spin Finance: Onchain Orderbook and Perpetual Trading Security Review](https://github.com/Guvenkaya/public-reports/blob/master/Spin-NEAR-Rust-Smart-Contract-Security-Assessment.pdf)
- [NEAR Intents: NEAR Intents Security Review](https://github.com/Guvenkaya/public-reports/blob/master/NEAR-Defuse-Labs-NEAR-Intents-Security-Review.pdf)

## Frequently asked questions

### What do you need to scope the review?

To scope the review, we need access to the contract code alongside its purpose, target commit, planned launch date, and your main concerns. Documentation, tests, and details of integrations help us define the scope and estimate the effort.

### Which languages and ecosystems do you cover?

We review Solidity, Rust, Move, DAML, Cairo, Compact, Stylus, CosmWasm, Tact, FunC, Tolk, Vyper, Sway, ink!, and other smart-contract stacks across EVM chains, Avalanche, NEAR, Solana, Sui, Aptos, Canton, Midnight, Polkadot, Cosmos, and TON.

### Does the code need to be final?

The review is most efficient when critical behavior, documentation, tests, and the target commit are stable. Design questions can be reviewed earlier.

### Can you review only a change set or upgrade?

Yes, when the surrounding system and inherited assumptions can be understood.

### Do you verify fixes?

Yes. We always provide remediation guidance and verify fixes through retesting. The final report distinguishes fixed, partially fixed, accepted, and unresolved findings.

### What determines the price and duration?

Code size is one factor. Contract complexity, integrations, documentation, and the testing needed to check the system’s behavior also affect the effort. Fix verification and retesting are always included. The proposal defines the review scope and retesting schedule.

## Related services

- [Blockchain Protocol & Infrastructure Reviews](https://www.guvenkaya.co/services/blockchain-protocol-security-review.md): Review custom chains, runtimes, nodes, consensus, and bridges beneath the application layer.
- [Cryptography Reviews](https://www.guvenkaya.co/services/cryptography-security-review.md): Review ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.
- [Secure Code Reviews](https://www.guvenkaya.co/services/secure-code-review.md): Find security flaws in critical code, including authorization, business logic, and state changes.

## Discuss your contract review.

Describe your contracts, planned changes, and launch date. We will propose a review scope.

Discuss your scope: https://www.guvenkaya.co/contact