Building on Avalanche? Ava Labs can cover up to 75% of your audit, and we take 10% off our quote. Avalanche audits: up to 75% covered. See how

Review your protocol before launch or upgrade.

Discuss your scope

We review contracts, runtimes, consensus, and bridges across EVM and non-EVM systems, and publish reports with client permission.

When this fits

When protocol teams bring us in.

Before a mainnet launch or upgrade

Review once behavior is stable enough to test, while changes are still cheap.

When a bridge or integration changes what you trust

A new dependency moves your trust boundary whether or not anyone redrew it.

After an incident or a near miss

Reconstruct the failure path and check for related weaknesses.

Before an ecosystem or exchange review

Review the system and address findings before an ecosystem or exchange assessment.

Where it breaks

Risks across the protocol stack

We review contract logic, runtime behavior, consensus, and cross-chain verification.

Every layer fails differently. The review has to match the layer.
01

Contract logic & accounting

Permissions, state transitions, accounting, upgrade paths, and economic assumptions.

02

Runtime & execution

Virtual machines, gas and resource metering, host functions, and node client behavior.

03

Consensus & finality

Validator incentives, safety and liveness, reorg handling, and upgrade coordination.

04

Bridges & cross-chain trust

Message verification, relayer assumptions, replay, and what a compromised chain can claim.

Your engagement team

Meet the specialists

Specialists matched to your protocol stack and the layers in scope.

Michal Bajor portrait

Michal Bajor

Specialist Advisor

Security specialist with 60+ Web3 reviews across DeFi, L1s, bridges, oracles, and other critical infrastructure. At Kraken, worked on the security of funding services, custody, APIs, and on-chain systems.

Michal Bajor portrait

Michal Bajor

Specialist Advisor

Michal is a security expert with a Master's in ICT, three published research papers, and active academic research in blockchain technology. He has reviewed 60+ Web3 projects across DeFi, L1 systems, bridges, oracles, and other critical ecosystem components. At Kraken, he was responsible for security across crypto and fiat funding services and custody, B2B APIs, on-chain monitoring, smart-contract risk, and architectural and compliance reviews. Earlier at EY, he conducted web application penetration tests, participated in red-team activities, and worked across defensive security responsibilities; at Cisco, he supported Security Advisory penetration-testing work and internal cybersecurity training.
LinkedIn
Łukasz Mikuła portrait

Łukasz Mikuła

Specialist Advisor

Offensive security specialist with 10+ years of experience, 100+ public audits across 8+ ecosystems, and OSCP, OSCE, eWPT, and eWPTX certifications. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.

Łukasz Mikuła portrait

Łukasz Mikuła

Specialist Advisor

Łukasz is a security researcher with 10+ years in offensive security and a public portfolio of 100+ audits across 8+ ecosystems. His smart-contract work spans EVM/Solidity, Move, Rust-based ecosystems, CosmWasm, Solana, Substrate, and TON, including assessments for Coinbase, MegaETH, Kyber, Jupiter, Zilliqa, IOTA, and Initia Move. At ING, he worked across web application and infrastructure penetration testing, red-team work, exploit development, reverse engineering, mobile security, adversary simulation, and smart-device testing. At Binance, he worked on security concerns for high-scale digital asset systems. He holds the OSCP, OSCE, eWPT, and eWPTX certifications and has CVE disclosures affecting IBM, Oracle, F5, Dell, and Red Hat.
LinkedIn
José C. Ramírez portrait

José C. Ramírez

Specialist Advisor

Security engineer and trainer with around 10 years of experience across application and protocol security. At ZKsync, reviewed Solidity and Rust code, including account abstraction, then built AI-assisted vulnerability-analysis workflows.

José C. Ramírez portrait

José C. Ramírez

Specialist Advisor

José is a security engineer and technical trainer specializing in smart contract and blockchain security, with around 10 years of experience across offensive security, application security, and security review. At ZKsync, he reviewed code, architecture, and design across Solidity/EVM, account abstraction, protocol-level security, and Rust-based components, later building AI-assisted workflows for vulnerability discovery and protocol security analysis. He has participated in smart contract audits across CosmWasm, EVM, and NEAR and holds OSCP, CREST CRT, AWS Certified Security, and AWS Certified Solutions Architect certifications. José has also delivered university courses, guest lectures, and workshops on blockchain and smart contract security, including at the University of Málaga and with the University of Porto.
LinkedIn
Piotr Cielas portrait

Piotr Cielas

Principal Advisor

Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.

Piotr Cielas portrait

Piotr Cielas

Principal Advisor

Piotr is Head of Security at Agora, where he oversees information security, data protection, and corporate IT risk management. He brings both industry and consulting experience, having led information security advisory engagements and security program development for global financial institutions and large organizations. Earlier in his career, Piotr was a Senior Cybersecurity Consultant at Ernst & Young (EY), leading security assessments across financial services, healthcare, and government. He holds CEH, OSCP, and OSWE certifications, has contributed to the CVE program, and is the inventor of multiple U.S. patents related to information security and blockchain technology.
LinkedIn
Meet the full team

Published work

Read the findings before you hire us.

NEAR Intents

NEAR Intents Security Review

Medium Potential Funds Stealing From Users Via Repeating Failed Intents

  • NEAR
  • Intents
  • Rust
View report

NEAR Intents

NEAR Intents Passkeys Pull Request Security Review

Medium Potential DoS of The Main Functionality Through Malicious Solvers

  • NEAR
  • Passkeys
  • Rust
View report

Sailor Lend

NEAR Smart Contract Security Review

Critical Race Condition in Borrow Functionality

  • NEAR
  • Smart contract
  • Rust
View report
All reports

Discuss your protocol review.

Describe the protocol, planned changes, and launch date. We will help define the scope and timing.

Discuss your scope