Smart contract security review and expert analysis
I analyse what a smart contract written in Solidity or Cairo really does compared with what was promised, either for litigation or before it is deployed.
Member of AEPEJU (no. 1556). Barcelona and across Spain.
Fee: tailored quote. See prices
An audit and an expert report are different jobs
An audit looks for flaws before deployment; an expert report explains to a court what a contract that is already deployed actually did.
An audit is commissioned by the development team, and its report is a technical opinion to improve the code. An expert report is commissioned by a party to a dispute, is signed under an oath of objectivity and is ratified in court. I do both, but I never mix them: whoever hires me for a review knows it is not an expert report.
What I look for in the code
I look for anything that lets someone move funds or change the rules without users knowing.
- Privileged functions: minting tokens, pausing, changing fees or emergency withdrawals.
- Upgradeable contracts (proxies): who can change the code and under what controls.
- Dependencies on oracles and prices that can be manipulated.
- Classic bugs: reentrancy, arithmetic, access control and input validation.
- Gaps between what the project documentation says and what the deployed code does.
Rug pulls and trap tokens: what the contract proves
The contract usually puts the intent in writing: if the creator kept a way to drain it, it is in the code.
In a rug pull I analyse which functions existed, who called them and when, and how the liquidity left. In a trap token (honeypot) I show that buying was possible but selling was not, or only for certain addresses. Everything is backed by transactions anyone can verify on a public block explorer.
Solidity and Cairo
I review contracts written in Solidity, the language of Ethereum and its L2s, and in Cairo.
I have specific training in smart contract security (Cyfrin Updraft) and work daily with Ethereum network data as a blockchain data engineer at MigaLabs. If the contract has no verified source code, I analyse the deployed bytecode: it takes more work, but it still shows what the contract does.
When a smart contract expert report makes sense
When a contract sits at the centre of a dispute and someone has to explain to the judge what the code did.
- Investors accusing a token creator of draining the liquidity.
- A protocol disputing with a supplier whether the flaw was in the delivered code.
- A platform that needs to show its contract behaved as documented.
- A review of the expert report filed by the other party.
What I deliver and its limits
I deliver a report with each finding, its severity, the line of code or transaction that proves it and what it means in plain language.
A review does not guarantee that a contract is secure: it reduces risk and documents what was found. And an expert report does not say who is guilty: it explains the technical facts so the judge can decide.
Frequently asked questions
Common questions about this kind of report.
Can an audit be used as expert evidence?
Not on its own. It can be filed as a document, but if it is challenged you need an expert to defend it or a separate expert report, signed under oath and ratified in court.
Can a contract without verified source code be analysed?
Yes. The deployed bytecode and its transactions are analysed; it takes more work, but it shows which functions exist and what they do.
Which functions point to a possible rug pull?
Those that let the creator mint unlimited tokens, pause sales, raise fees or withdraw liquidity. Their existence does not prove fraud, but their use is recorded on-chain.
What do you need to quote a review?
The contract address or repository, the project documentation and the network where it is or will be deployed.
Can you testify about a rug pull in court?
Yes. I explain in court which functions the contract had, who used them and how the liquidity left, separating recorded facts from conclusions.
Do you review Cairo contracts?
Yes. As well as Solidity, I review contracts written in Cairo.
How much does it cost?
It depends on the size and complexity of the code. The first 30-minute consultation is free and a quote arrives within 24 working hours.
Related articles
To understand this kind of case better.
Tell me about your case
Free 30-minute consultation and a free quote within 24 working hours.