Rust audits, beyond Solana.
Rust security audits beyond Solana. Near, CosmWasm, Substrate, and custom runtimes. Memory-safety-adjacent risks, state machine invariants, and runtime-specific quirks.
Safe Rust still has unsafe ideas.
The language gives you memory safety. It doesn’t give you economic safety, state machine safety, or correctness under adversarial inputs. Most Rust audit findings sit at the layer above the borrow checker — the layer that compiles cleanly but still has the bug.
What’s in the audit.
Rust-specific risk classes
Cargo test, property-based fuzzing, our agents
Near, CosmWasm, Substrate, custom runtimes
Recent Rust engagements.
Sodax Cross-Chain Intent Protocol
Rust audit of a cross-chain intent protocol on Near. Matching engine, intent expiry, and bridge-side trust assumptions.
Aurora ETH Wallet Integration
Rust audit of an ETH wallet integration on Aurora (Near's EVM layer). Cross-VM signature handling and account binding.
Scoped to your codebase.
Rust audits are sized to ecosystem, runtime complexity, and integration surface. No fixed packages. Talk to us for a scope and quote.
Questions.
Yes. Solana programs have a dedicated page because the account model and CPI semantics need their own treatment. This page covers Rust on Near, CosmWasm, Substrate, and custom runtimes.
Yes. CosmWasm review covers entry points (instantiate / execute / query / migrate), message-passing assumptions, IBC integration trust, and the chain-specific bindings.
Yes. We review pallet logic, weight calculation, dispatch class assumptions, runtime upgrade safety, and inter-pallet trust. Familiarity with FRAME and Substrate macros is part of the engagement.
Yes. Some Rust engagements (like Sodax) ran through Sherlock. We bring the same depth to private engagements that we apply to contests.
We can scope it. No_std and embedded environments have additional concerns (panics-as-aborts, custom allocators, hardware traps) that we tag as in-scope upfront.
Two to four weeks for typical scope, longer for chain-runtime work. We scope and quote against your specific codebase before you commit.
Go deeper.
Need something else?
Ready to audit?
Send us your repo, the chain or runtime, and a target date. We’ll come back with a scope and a quote within 24 hours.