Canonical page: Work & reports # Read our published security reports. [View Reports](#reports) Full reports published with client permission, including findings, evidence, and remediation status. Each report includes the full findings and severity ratings. ### Our current report format, in full. Since September 2026, our reports also include a threat model, security invariants, tests added to your repository and an evidence appendix. The reports below were published before that and use the earlier format. [Read the sample report](https://www.guvenkaya.co/reports/sample) ## Security reports Type Ecosystem Language 23 reports ### NEAR Intents NEAR Intents Security Review Medium Potential Funds Stealing From Users Via Repeating Failed Intents - NEAR - Intents - Rust [View report](https://www.guvenkaya.co/reports/near-intents) ### NEAR Intents NEAR Intents Passkeys Pull Request Security Review Medium Potential DoS of The Main Functionality Through Malicious Solvers - NEAR - Passkeys - Rust [View report](https://www.guvenkaya.co/reports/near-passkeys) ### Sailor Lend NEAR Smart Contract Security Review Critical Race Condition in Borrow Functionality - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sailor-contract) ### Sailor Lend Web Application Security Review Critical Vulnerable to React2Shell - Web application - TypeScript [View report](https://www.guvenkaya.co/reports/sailor-web) ### Spin Finance Onchain Orderbook and Perpetual Trading Security Review Critical Order Placement with Negative/Zero Margin Ratio Is Possible - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/spin) ### Sweat Economy SWEAT NEP-141 Token Security Review High LookupMap adapter can undercharge storage for selected accounts - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-token) ### Sweat Economy Sweat Jars Migration & Refactor Smart Contract Review Medium Possible Double Claim Through Race Condition - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-jars-migration) ### Sweat Economy Tiered Jars & Boosters Smart Contract Security Review Low Possible overflows - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-tiered-jars) ### Sweat Economy Sweat Booster & Step Jars Security Review Critical Missing Access Control On NFT Transfer Resolver - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-booster) ### Sweat Economy Jars Refactor Security Review High Potential DoS of Batch Operations - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-jars-refactor) ### Sweat Economy Burn Model Changes Security Review Low Error Prone Burn Rate Calculation - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-burn-model) ### Sweat Economy Defer Feature Security Review Low Race Condition Lock Is Not Asserted - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/sweat-defer) ### Templar Single Chain Smart Contracts Security Review High Supply Withdrawal Mechanism DoS - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/templar) ### Cleopetra Solana Trading Bot Security Review Medium Incorrect Use of Async in Reward Distribution - Solana - Trading bot - TypeScript [View report](https://www.guvenkaya.co/reports/cleopetra) ### Enjin Relaychain and Matrixchain Security Review Critical DoS of Fuel Tank Mutation - Polkadot - Substrate - Rust Private review ### Enjin Claims Pallet Security Review Critical DoS of Claiming Functionality - Polkadot - Substrate - Rust Private review ### Virto Network Pallet Pass Security Review High DoS of The Main Functionality Through Session Key Hijacking - Polkadot - Substrate - Rust [View report](https://www.guvenkaya.co/reports/virto) ### Ample Protocol IP and Media Protocol Security Review Critical Anyone Can Update The NFT Holder In Treasury - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/ample) ### DefiShards Decentralized Investment Platform Security Review Critical Irrecoverable Denial-of-Service Condition In Vault Contract - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/defishards) ### Potlock Portal for Public Goods and Funding Security Review Critical DoS of Process Payouts - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/potlock) ### Jump DeFi Smart Router and Farm Security Review Critical Token Draining Through Invalid Callback Handling - NEAR - Smart contract - Rust [View report](https://www.guvenkaya.co/reports/jump-router) ### Jump DeFi Backend & Frontend Security Assessment Critical Indexer Crash Due to Invalid UTF-8 Character - NEAR - Off-chain - Rust - TypeScript [View report](https://www.guvenkaya.co/reports/jump-backend) ### Neko / Trove Labs Airdrop Script Security Review Medium Lack of Error Handling in Airdrop Script - NEAR - Off-chain - TypeScript [View report](https://www.guvenkaya.co/reports/neko) ## Tell us what you need to secure. Describe your system, main concern, and deadline. We'll reply with scoping questions and a proposed next step. [Discuss your scope ](https://www.guvenkaya.co/contact)