For protocol teams preparing code, integrations and upgrades
Smart contract security audits & reviews
Review the code before it reaches users.
I review a defined smart contract system or change set to identify vulnerabilities and challenge its security assumptions. The work combines manual analysis with appropriate testing and tooling, guided by the system's design and risk areas.
What the review can cover
- Contract logic and the invariants the system relies on.
- Access control, signatures, permissions and upgrade paths.
- External integrations and assumptions about token or protocol behavior.
- Failure scenarios involving accounting, oracles or interactions between contracts.
- A defined upgrade or remediation change set.
Language, chain and specialist requirements are confirmed during scoping.
What you receive
- A report describing the reviewed scope, methodology and findings.
- Impact explanations and supporting evidence, including reproducible tests where applicable.
- Remediation guidance discussed directly with your developers.
- Review of agreed fixes, with retest scope and timing defined in the engagement.
How we define the scope
We agree on the repository and commit, relevant contracts, documentation, dependencies and delivery schedule. Changes to the reviewed code or scope are assessed before additional work begins.
The report records what was reviewed and the limitations of the engagement. A time-bounded review cannot establish that a system is free of vulnerabilities.
Questions before we start
Which chains and languages can you review?
My background includes Solidity/EVM security and Cairo/Starknet security. Send the language, chain, repository and system design so I can confirm the fit and any specialist requirements before accepting the engagement.
How much does a smart contract review cost, and how long does it take?
The quote and schedule depend on code size, complexity, documentation, dependencies and review depth. We agree on the repository commit, scope and delivery dates before starting; there is no universal price or duration for every codebase.
What does the security report include?
The reviewed commit and scope, methodology, findings with impact and supporting evidence, remediation guidance and the limitations of the review. Reproducible tests are included where applicable.
Are fixes reviewed after the initial report?
Review of agreed fixes is part of the defined engagement. We specify the retest scope and timing up front. New functionality or changes beyond the agreed scope may require a separate review.
Can you review private code under an NDA?
Confidentiality and access arrangements, including any NDA requirements, are agreed before private code is shared. Whether a report can be published is a separate agreement.
Does an audit guarantee that a protocol is safe?
No. A review is limited to the agreed scope, code version and available time. It can identify vulnerabilities and improve the basis for a release decision, but it cannot establish that a system is free of vulnerabilities.
Share the system and your release plans.
Send an overview of the codebase, its intended use and your target timeline. We'll define the review depth and deliverables before work starts.