Cairo audits, from day one.
Senior manual review of Cairo contracts on Starknet, Madara, and Kakarot. Felt arithmetic, storage layout, account contract logic, and the prover-side execution model.
ZK doesn’t mean bug-free.
Cairo’s provability story is real and powerful. It tells you the program executed as written. It doesn’t tell you the program was written correctly. The bugs we look for in Cairo — felt math under arithmetic edges, storage collision in maps, account contract signer mistakes — are bugs whose proofs verify just fine.
What’s in the audit.
Cairo-specific risk classes
Scarb, Starknet Foundry, manual review
Starknet, Madara, Kakarot
No public Cairo audits yet.
We’ve audited across Solidity, Solana, and Rust ecosystems, but our published Cairo work is still ahead of us. If you’re shipping on Starknet, Madara, or Kakarot, we’d be glad to be your first listed audit — with the same depth, tooling, and report quality we apply to every other engagement.
Scoped to your codebase.
Cairo audits are sized to your specific contracts, your account architecture, and your timeline. Talk to us for a scope and quote.
Questions.
Not yet. Our public engagements are concentrated in Solidity, Solana, and Rust ecosystems. If you're shipping Cairo, we'd be glad to be your first listed audit — and we'd treat the engagement with the same depth we apply to every other language we cover.
Felt arithmetic is not 256-bit modular arithmetic, storage maps use a different collision model, and account abstraction is the default rather than the exception. The biggest mental shift: Cairo's safety story is built on provability, not on the EVM's gas-and-revert model.
Both. Most production work has moved to Cairo 2.x and we follow the language and OZ Cairo ecosystem closely. Cairo 1 legacy code is in scope on request.
Yes. Account abstraction is the default on Starknet, so account contract review (signer logic, multicall, validation hooks) is a first-class scope item rather than an afterthought.
Yes. App-chains built on Madara and Cairo-EVM equivalence layers like Kakarot are in scope. We tag chain-specific assumptions explicitly so the report is portable across deployments.
Two to four weeks for typical scope. We scope and quote against your specific codebase before you commit.
Go deeper.
Need something else?
Ready to audit?
Send us your repo and a target date. We’ll come back with a scope and a quote within 24 hours.