Core service

Smart Contract Security Reviews

An independent audit of your Solidity or Vyper contracts on any EVM chain, delivered as a written report in 3–10 days.

One reviewer, start to finish. You get a manual read of the whole codebase, proof-of-concept tests for anything exploitable, and a fix for every finding — not a static-analysis dump with a logo on it.

Get a fixed quote Book a free assessment call

3 yrs: Auditing EVM smart contracts
M-01: Verified Code4rena finding
Critical: Vulnerability found in BulkSender
Live: Disclosures to Ronin protocols

Best fit for

Protocols preparing for launch or a token generation event

Teams that shipped fast and want a second pair of eyes before TVL grows

Projects that need a public report for investors, exchanges, or their community

Founders who want a fixed price instead of an open-ended hourly engagement

Focus areas

What I dig into on this kind of codebase

Access control

Owner and role boundaries, upgrade paths, emergency functions, and every privileged call that could be reached by the wrong address.

Accounting & token flows

Balance tracking, fee-on-transfer and rebasing assumptions, rounding direction, and the arithmetic that silently drains a pool.

External call safety

Reentrancy across the whole call graph, untrusted callbacks, return-value handling, and assumptions about integrated protocols.

Economic logic

Incentives, reward emission, liquidation and slippage parameters — the sequences of entirely legal transactions that end badly.

Oracle & price assumptions

Manipulation windows, stale data handling, and what happens to your protocol when a feed reports something absurd.

Upgrade & deployment risk

Proxy storage layout, initialiser protection, and the deployment scripts that ship a different contract than the one reviewed.

Deliverables

What you receive

Severity-rated findings report

Every issue written up with impact, likelihood, the exact affected lines, and a concrete remediation step you can hand straight to a developer.

Proof-of-concept exploits

Where a finding is exploitable I include a reproducible test, so your team can confirm the severity instead of debating it.

Prioritised fix list

Findings ordered by what actually threatens funds first, so a short remediation window is spent on the right things.

Follow-up support

Questions about a finding or a proposed patch get answered while you are still shipping the fix, not after the invoice clears.

Methodology

How the review runs

01
Scoping call
A short call to walk through your contracts, chain setup, and deadline. You leave with a fixed price and a delivery date, not an estimate.
02
Manual review
Line-by-line reading of the codebase, then targeted analysis of the parts that hold value: accounting, access control, reward maths, and external calls.
03
Exploit testing
I write proof-of-concept tests for the paths I think break, so findings arrive with evidence attached instead of a maybe.
04
Report & remediation
A written report with severity ratings, reproduction steps, and a concrete fix for each issue. Then I stay reachable while you patch.
05
Retest & sign-off
On the Audit + Retest tier I re-review your fixes and issue a final sign-off report you can share with your investors or community.

Pricing

Fixed prices, published up front

Final pricing is confirmed after a brief scoping call based on actual contract complexity. Payment is arranged before the review begins, and the agreed number is the number you pay.

Introductory rates

These are introductory prices while I build out my library of public audit reports. They go up after the next five engagements — the rate you book at is the rate you keep for that engagement.

Code Review

€250

Single contract review, up to 200 lines.

One contract, up to 200 lines
Manual line-by-line review
Findings list with severity ratings
Remediation guidance for every finding

3 day delivery · 1 revision

Start with Code Review

Protocol Audit

€900

Full multi-contract audit with a written report and severity ratings.

Multi-contract codebase
Business logic and economic attack paths
Proof-of-concept tests for exploitable findings
Written PDF report with severity ratings
Remediation guidance for every finding
Follow-up support on questions

7 day delivery · 3 revisions

Start with Protocol Audit

Audit + Retest

€1,600

Full audit plus a post-fix retest and a final sign-off report.

Everything in Protocol Audit
Post-fix retest of your patches
Final sign-off report you can publish
Extended follow-up support

10 day delivery · 5 revisions

Start with Audit + Retest

Larger codebase

From €2,000

Protocols above roughly 1,500 lines, multi-module systems, or anything needing a longer engagement.

Quoted on scope after a call. Same process, same deliverables, same guarantees — the timeline and price just match the size of the job.

Get a scoped quote

No-findings refund

If the review surfaces nothing above informational severity, you get a full refund and keep the report anyway. You should not have to pay to find out there was nothing to find.

The quoted price is the price

The number agreed on the scoping call is the number you pay. No hourly overruns, no scope-creep invoices, no surprise line items after delivery.

Confidential by default

Your code and findings are never published or shared without your written permission. NDA on request, signed before you send anything.

Ship your protocol without wondering what you missed

Send me your repo, chain, and deadline. You get a fixed price and a delivery date back — usually the same day.

Get a fixed quote Book a free assessment call

No obligation, and a full refund if the review finds nothing above informational severity. If your scope is outside what I cover, I will say so on the call.

FAQ

Questions before you book

What is included in a smart contract security review?

A manual line-by-line code review, exploit testing of the paths that look breakable, a written findings report with severity ratings and remediation steps, and follow-up support while you patch.

What types of contracts do you review?

DeFi protocols, GameFi and gambling mechanics, tokens, staking and reward systems, and other on-chain systems written in Solidity or Vyper on EVM-compatible chains.

How much does a smart contract security review cost?

A single-contract Code Review is €250, a full Protocol Audit is €900, and Audit + Retest is €1,600. Larger codebases start from €2,000, quoted on scope. Final pricing is confirmed after a brief scoping call, so there are no surprises after the fact. These are introductory rates while I build out my public report library.

How long does the review take?

Three days for a Code Review, seven for a Protocol Audit, and ten for Audit + Retest. The delivery date is agreed on the scoping call before any work starts.

When do I pay?

Pricing is confirmed after the scoping call and payment is arranged before the review begins. There are no hourly overruns — the agreed number is the number you pay.

Can I see an example report first?

Yes. The full BulkSender and KoinArcade reports are published on this site, so you can judge the depth and format before committing.