Guvenkaya

Guvenkaya is a principal-led security advisory firm that conducts smart contract audits, blockchain protocol reviews, and penetration testing across Solana, NEAR, EVM chains, Polkadot, Cosmos, Sui, Aptos, TON, and other ecosystems, with a collective track record of more than 200 audits and $24 billion in volume secured.

Core Mechanism

The firm's defining characteristic is what it calls the "principal on every engagement" model. Rather than routing clients through account managers or anonymous review teams, each engagement is overseen end-to-end by a named principal — from initial scope definition through remediation verification. Every specialist conducting the review is publicly listed on the website before a contract is signed, not disclosed after delivery. This transparency is the central differentiation Guvenkaya markets: "Eight senior specialists you can look up before you sign."

The engagement process follows six stages: scope alignment, technical review, written findings report, principal QA of the report, remediation support, and retest of patched code. All reports are published publicly on GitHub with full technical detail rather than executive summaries.

Services

Security Reviews cover the full stack of Web3 infrastructure: smart contract logic, state transitions, accounting, and authorization across Solidity, Rust, Move, Cairo, CosmWasm, Tact, FunC, Tolk, Vyper, Sway, ink!, and Stylus; blockchain protocol and runtime reviews for custom L1/L2 chains and consensus mechanisms; signing and custody architecture covering MPC, HSM, and multisig systems; penetration testing spanning web, mobile, APIs, and cloud infrastructure; and AI and agent security assessments, an area of growing focus given the firm's July 2025 blog post on security risks in AI-generated applications.

Design and Advisory services include secure architecture review, board-ready risk reporting, digital asset program advisory, and technical due diligence for investment and acquisition decisions.

Capability Building encompasses internal security training workshops and tabletop exercises for development and security teams.

Solana Coverage

Guvenkaya explicitly lists Solana among its supported ecosystems for smart contract security review. The firm's Rust expertise is central to this coverage: founder Timur Guvenkaya built his specialization in Rust-based security, and Rust is the primary smart contract language on Solana. The public reports repository on GitHub includes an audit of Cleopetra, a Solana trading bot, reviewed at the TypeScript layer, demonstrating coverage of both on-chain Solana programs and off-chain infrastructure that interacts with the network.

The review methodology applied to Solana engagements examines contract logic and state transitions, asset balances and accounting, authorization and upgrade mechanisms, cross-contract integrations and oracle dependencies, economic incentives and MEV risks, and deployment security.

Team

Eight named senior specialists are listed on the website.

Timur Guvenkaya (Founder) led the Rust, Substrate, and NEAR security practice at Halborn before founding Guvenkaya, securing protocols with over $600 million in TVL including Composable Finance, Nodle, and Octopus Network. He authored the NEAR Rust Smart Contract Security training course and contributed Rust and Substrate content to the SANS SEC-554 curriculum. He also worked at Invicti Security, where he designed a JWT security engine used by Fortune 500 companies including Apple, Amazon, Verizon, Ford, and NASA. He is additionally co-founder and CTO of Trustblock, a Web3 security data aggregator.

Piotr Cielas (Principal Advisor) is a former Head of Security at Agora with prior security roles at EY covering financial services and government sectors.

Paul Vijender (Specialist Advisor) is the current Head of Security at Gauntlet, with previous roles at Tensor, EY, Broadcom, and ADP.

Michal Bajor (Specialist Advisor) brings custody and exchange background from Kraken with 60+ security reviews completed.

Manuel B. Santos (Specialist Advisor) holds a Ph.D. in Information Security with 13 published cryptography research papers.

Georgii Plotnikov (Specialist Advisor) is CEO at Inferara and designer of the Inference programming language.

Lukasz Mikula (Specialist Advisor) has completed 100+ public audits with certifications including OSCP, OSCE, eWPT, and eWPTX.

Jose C. Ramirez (Specialist Advisor) has a ZKsync background and approximately 10 years of security engineering experience.

Collectively, the team holds 200+ audits, 13 research papers, two current Heads of Security at active Web3 firms, and extensive offensive security certifications.

Track Record

The firm publicly states: $24 billion in volume secured across client protocols, 24 million users protected, 65+ critical and high-severity findings across engagements, and 200+ security assessments completed across the team.

Notable findings from public reports include a medium-severity fund-stealing vulnerability in NEAR Intents by Defuse Labs, a high-severity storage undercharging flaw in Sweat Economy Token, a critical order placement vulnerability with improper margin validation in Spin Finance, a critical race condition in Sailor Lend's borrow functionality, and a DoS vulnerability via session key hijacking in Virto Network. Full reports with technical detail are available in the public GitHub repository.

Client Portfolio

Clients represented in public disclosures include NEAR Protocol, NEAR Foundation, Sweat Economy, Enjin, Circle Alliance Program, Immunefi, Invicti, Aurora, and Polkadot Assurance Legion. The majority of published work concentrates on NEAR Protocol ecosystem projects, with growing coverage of other chains including Solana.

Target Sectors

Guvenkaya serves four primary client categories: financial institutions such as banks, asset managers, fintechs, and payment providers entering digital assets; digital asset operators including exchanges, custodians, wallets, and stablecoin platforms; protocols and networks covering L1/L2 systems, bridges, and DeFi protocols; and software and infrastructure teams across web, mobile, cloud, and AI.

Ecosystem Fit

Guvenkaya addresses one of the most persistent gaps in the Solana ecosystem: the shortage of auditors with deep Rust expertise. Most Web3 security firms are EVM-native and audit Solidity; the Solana runtime's account model, program-derived addresses, cross-program invocations, and ownership rules require different threat modeling from EVM contracts. Guvenkaya's founding rationale explicitly targets this gap — Rust-based and non-EVM protocols — making it one of the few security firms positioned by design to audit Solana programs at the language level rather than as an extension of an EVM-first practice.