Security engagement
Smart contract audit
A fixed-fee review of the code that holds the money. Most losses are not exotic Solidity: they are access control, accounting and integration failures, which is what years of web-app exploitation teach you to find. Threat model first, then manual review and stateful fuzzing against the invariants that matter, with a proof of concept for every High and Critical and a verification pass on the fixes.
from $6,500 · quoted in writing after scope
Who it is for
For teams shipping a token, vault, lending market, perp venue or RWA settlement layer, and for teams that already have a firm audit but want an attacker’s second pass on the module that changed.
What is in scope
- Access control and privilege boundaries: roles, admin paths, upgrade authority, paused states
- Accounting and share math: rounding, fee accrual, deposit and withdraw symmetry, liquidation paths
- Oracle and price assumptions: staleness, manipulation, market-hours gaps, sequencer downtime
- External interactions: reentrancy, callback trust, and token quirks such as fee-on-transfer or rebasing
- Cross-contract and cross-chain assumptions, including message replay and settlement windows
- Invariant and stateful fuzzing (Foundry, Echidna) against the properties agreed at kickoff
What you get
- A threat model and invariant list agreed before the review starts
- Severity-ranked findings with proof of concept for High and Critical
- Fix verification: each finding marked fixed, partially fixed or acknowledged
- A coverage statement naming commits, files and exclusions
- An exit call with your engineers, plus a public-ready report on request
By protocol type
The review follows value through the system, so the first question is what kind of system it is. The failure modes differ by category.
- Lending: interest accrual, collateral factors, liquidation thresholds, bad-debt paths and oracle failure across markets.
- Perpetuals: funding, margin, liquidation and ADL, plus the accounting between the pool and the trader.
- AMM and DEX: invariant math, fee accounting, slippage protection and whether a pool can be drained through ordinary swaps.
- RWA and settlement: NAV updates, transfer restrictions, market-hours gaps and atomic settlement between two asset legs.
- Restaking and yield: share accounting across strategies, withdrawal queues, slashing exposure and reward distribution.
EVM and Solana
Solidity on EVM chains is the default. Rust programs on Solana are reviewed against a different account model, where every account is an input and the runtime only enforces ownership.
- Solidity and EVM: storage layout, upgradeability, token quirks, reentrancy and cross-contract accounting.
- Rust and Anchor: account validation, signer and owner checks, PDA seeds and bumps, CPI trust and compute limits.
- Non-EVM scopes carry a 25% surcharge because the tooling and the failure modes are different.
Contracts, app and keys
A Web3 product is three attack surfaces. The contract review answers "can the contract be broken". It does not answer "can the user be tricked into signing something else", or "who can upgrade this at 3am".
- Contracts: access control, accounting, oracles, liquidation, upgrades and integrations.
- The app: wallet connection, transaction building, signing prompts, API authorization and supply chain.
- Operations: admin and upgrade authority, multisig and key paths, deploy configuration and incident response.
Frequently asked
What does a smart contract audit cost?
A pre-launch review of up to 1,500 nSLOC starts at $6,500 and takes about five business days. A full protocol audit of up to 4,000 nSLOC is $18,000 and takes about ten. Scope and price are fixed in writing before kickoff.
Do you audit Solidity only?
Solidity on EVM chains is the default. I also review Rust programs for Solana and Substrate-style runtimes; non-EVM scopes carry a 25% surcharge because the tooling and failure modes are different. Other runtimes are scoped case by case after a call.
Will you find the same things as my existing auditor?
Sometimes. The value of a second pass is different eyes on the assumptions the first review accepted: oracle behaviour at the edges, admin paths, and the accounting between contracts. The coverage statement tells you exactly what is new.
How fast can you start?
Kickoff within 24 to 72 hours of signed scope and repository access. A rush start is available at a 40% surcharge.
Do you verify the fixes?
Yes. Every review includes a fix-review round where each finding is marked fixed, partially fixed or acknowledged, with my verification rather than the team’s word for it.
Go deeper
Scope it in one message
Send the targets, the commit and the timeline. You get the rules of engagement and a fixed price.
References available on request. No client names or numbers are published without written consent. Part of an ongoing relationship instead? See the full service list.