Code review

Solidity & Vyper Code Review

A focused manual review of a single contract or module — the fastest way to get expert eyes on code before it grows into a full protocol.

Ideal when you don't need a full protocol audit yet: one contract, up to 200 lines, reviewed line by line with findings back in three days. Many teams start here and upgrade to a full audit once the scope settles.

Get a fixed quote Book a free assessment call

3 yrs: Auditing EVM smart contracts
M-01: Verified Code4rena finding
Critical: Vulnerability found in BulkSender
Live: Disclosures to Ronin protocols

Best fit for

A single contract or module you want checked before it ships

Teams preparing a codebase for a larger audit later

Developers who want feedback on patterns, not just bugs

Small budgets that still need a real reviewer rather than a scanner

Focus areas

What I dig into on this kind of codebase

Correctness

Does the contract do what the spec says under every input, including the ones your tests do not cover?

Known vulnerability classes

Reentrancy, unchecked returns, delegatecall misuse, signature replay, and the rest of the catalogue — checked by hand, not by grep.

Solidity & Vyper pitfalls

Version-specific behaviour, unchecked blocks, storage packing surprises, and assembly that assumes more than it should.

Gas & efficiency

Meaningful savings flagged where they do not trade away safety, including loops that stop working as your user count grows.

Test coverage gaps

Which behaviours your suite never exercises, and the specific cases worth adding before the code goes near mainnet.

Readability & maintainability

Naming, structure, and documentation issues that turn into security issues the next time somebody edits the file.

Deliverables

What you receive

Severity-rated findings report

Every issue written up with impact, likelihood, the exact affected lines, and a concrete remediation step you can hand straight to a developer.

Proof-of-concept exploits

Where a finding is exploitable I include a reproducible test, so your team can confirm the severity instead of debating it.

Prioritised fix list

Findings ordered by what actually threatens funds first, so a short remediation window is spent on the right things.

Follow-up support

Questions about a finding or a proposed patch get answered while you are still shipping the fix, not after the invoice clears.

Methodology

How the review runs

01
Scoping call
A short call to walk through your contracts, chain setup, and deadline. You leave with a fixed price and a delivery date, not an estimate.
02
Manual review
Line-by-line reading of the codebase, then targeted analysis of the parts that hold value: accounting, access control, reward maths, and external calls.
03
Exploit testing
I write proof-of-concept tests for the paths I think break, so findings arrive with evidence attached instead of a maybe.
04
Report & remediation
A written report with severity ratings, reproduction steps, and a concrete fix for each issue. Then I stay reachable while you patch.
05
Retest & sign-off
On the Audit + Retest tier I re-review your fixes and issue a final sign-off report you can share with your investors or community.

Pricing

Fixed prices, published up front

Final pricing is confirmed after a brief scoping call based on actual contract complexity. Payment is arranged before the review begins, and the agreed number is the number you pay.

Introductory rates

These are introductory prices while I build out my library of public audit reports. They go up after the next five engagements — the rate you book at is the rate you keep for that engagement.

Code Review

€250

Single contract review, up to 200 lines.

One contract, up to 200 lines
Manual line-by-line review
Findings list with severity ratings
Remediation guidance for every finding

3 day delivery · 1 revision

Start with Code Review

Protocol Audit

€900

Full multi-contract audit with a written report and severity ratings.

Multi-contract codebase
Business logic and economic attack paths
Proof-of-concept tests for exploitable findings
Written PDF report with severity ratings
Remediation guidance for every finding
Follow-up support on questions

7 day delivery · 3 revisions

Start with Protocol Audit

Audit + Retest

€1,600

Full audit plus a post-fix retest and a final sign-off report.

Everything in Protocol Audit
Post-fix retest of your patches
Final sign-off report you can publish
Extended follow-up support

10 day delivery · 5 revisions

Start with Audit + Retest

Larger codebase

From €2,000

Protocols above roughly 1,500 lines, multi-module systems, or anything needing a longer engagement.

Quoted on scope after a call. Same process, same deliverables, same guarantees — the timeline and price just match the size of the job.

Get a scoped quote

No-findings refund

If the review surfaces nothing above informational severity, you get a full refund and keep the report anyway. You should not have to pay to find out there was nothing to find.

The quoted price is the price

The number agreed on the scoping call is the number you pay. No hourly overruns, no scope-creep invoices, no surprise line items after delivery.

Confidential by default

Your code and findings are never published or shared without your written permission. NDA on request, signed before you send anything.

Ship your protocol without wondering what you missed

Send me your repo, chain, and deadline. You get a fixed price and a delivery date back — usually the same day.

Get a fixed quote Book a free assessment call

No obligation, and a full refund if the review finds nothing above informational severity. If your scope is outside what I cover, I will say so on the call.

FAQ

Questions before you book

How is a code review different from a full audit?

A code review is scoped to a single contract or module and focuses on that file in isolation. A full audit covers the whole system, including how contracts interact and how the protocol's economics can be gamed.

What if the review finds more than expected?

If the scope turns out to be larger or more complex than the code review tier covers, I tell you before starting and quote the appropriate tier. Work never silently expands into a bigger invoice.

How long does the review take?

Three days for a Code Review, seven for a Protocol Audit, and ten for Audit + Retest. The delivery date is agreed on the scoping call before any work starts.

When do I pay?

Pricing is confirmed after the scoping call and payment is arranged before the review begins. There are no hourly overruns — the agreed number is the number you pay.

Can I see an example report first?

Yes. The full BulkSender and KoinArcade reports are published on this site, so you can judge the depth and format before committing.