Work & reports

Read our published security reports.

View Reports

Full reports published with client permission, including findings, evidence, and remediation status.

Each report includes the full findings and severity ratings.

Our current report format, in full.

Since September 2026, our reports also include a threat model, security invariants, tests added to your repository and an evidence appendix. The reports below were published before that and use the earlier format.

Read the sample report

Security reports

Type
Ecosystem
Language

23 reports

NEAR Intents

NEAR Intents Security Review

Medium Potential Funds Stealing From Users Via Repeating Failed Intents

  • NEAR
  • Intents
  • Rust
View report

NEAR Intents

NEAR Intents Passkeys Pull Request Security Review

Medium Potential DoS of The Main Functionality Through Malicious Solvers

  • NEAR
  • Passkeys
  • Rust
View report

Sailor Lend

NEAR Smart Contract Security Review

Critical Race Condition in Borrow Functionality

  • NEAR
  • Smart contract
  • Rust
View report

Sailor Lend

Web Application Security Review

Critical Vulnerable to React2Shell

  • Web application
  • TypeScript
View report

Spin Finance

Onchain Orderbook and Perpetual Trading Security Review

Critical Order Placement with Negative/Zero Margin Ratio Is Possible

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

SWEAT NEP-141 Token Security Review

High LookupMap adapter can undercharge storage for selected accounts

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

Sweat Jars Migration & Refactor Smart Contract Review

Medium Possible Double Claim Through Race Condition

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

Tiered Jars & Boosters Smart Contract Security Review

Low Possible overflows

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

Sweat Booster & Step Jars Security Review

Critical Missing Access Control On NFT Transfer Resolver

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

Jars Refactor Security Review

High Potential DoS of Batch Operations

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

Burn Model Changes Security Review

Low Error Prone Burn Rate Calculation

  • NEAR
  • Smart contract
  • Rust
View report

Sweat Economy

Defer Feature Security Review

Low Race Condition Lock Is Not Asserted

  • NEAR
  • Smart contract
  • Rust
View report

Templar

Single Chain Smart Contracts Security Review

High Supply Withdrawal Mechanism DoS

  • NEAR
  • Smart contract
  • Rust
View report

Cleopetra

Solana Trading Bot Security Review

Medium Incorrect Use of Async in Reward Distribution

  • Solana
  • Trading bot
  • TypeScript
View report

Enjin

Relaychain and Matrixchain Security Review

Critical DoS of Fuel Tank Mutation

  • Polkadot
  • Substrate
  • Rust
Private review

Enjin

Claims Pallet Security Review

Critical DoS of Claiming Functionality

  • Polkadot
  • Substrate
  • Rust
Private review

Virto Network

Pallet Pass Security Review

High DoS of The Main Functionality Through Session Key Hijacking

  • Polkadot
  • Substrate
  • Rust
View report

Ample Protocol

IP and Media Protocol Security Review

Critical Anyone Can Update The NFT Holder In Treasury

  • NEAR
  • Smart contract
  • Rust
View report

DefiShards

Decentralized Investment Platform Security Review

Critical Irrecoverable Denial-of-Service Condition In Vault Contract

  • NEAR
  • Smart contract
  • Rust
View report

Potlock

Portal for Public Goods and Funding Security Review

Critical DoS of Process Payouts

  • NEAR
  • Smart contract
  • Rust
View report

Jump DeFi

Smart Router and Farm Security Review

Critical Token Draining Through Invalid Callback Handling

  • NEAR
  • Smart contract
  • Rust
View report

Jump DeFi

Backend & Frontend Security Assessment

Critical Indexer Crash Due to Invalid UTF-8 Character

  • NEAR
  • Off-chain
  • Rust
  • TypeScript
View report

Neko / Trove Labs

Airdrop Script Security Review

Medium Lack of Error Handling in Airdrop Script

  • NEAR
  • Off-chain
  • TypeScript
View report

Tell us what you need to secure.

Describe your system, main concern, and deadline. We'll reply with scoping questions and a proposed next step.

Discuss your scope contact@guvenkaya.co