Rust does not remove protocol risk
Rust prevents many memory-safety issues, but smart contract exploits usually target validation, authorization, state transitions, arithmetic, account models, and protocol logic.
Solana and Anchor review points
Solana programs need careful checks around signer validation, ownership, PDAs, account confusion, initialization, close flows, CPI targets, remaining accounts, and serialization.
CosmWasm and NEAR review points
CosmWasm audits focus on entry points, storage, migrations, IBC callbacks, replies, and permissions. NEAR adds asynchronous promise behavior, access keys, storage staking, and predecessor account validation.
Substrate and protocol Rust
Substrate runtime review covers pallets, origins, weights, hooks, storage, runtime upgrades, XCM, and economic invariants that may not look like typical smart contract code.
Dependency and unsafe-code risk
Auditors should review unsafe blocks, cryptographic code, serialization libraries, supply-chain assumptions, and performance changes that alter security behavior.
A review scenario for authority confusion
Consider an instruction that receives two valid accounts but assumes they belong to the same position. Test accounts from different users and positions, even when each account individually deserializes successfully. The property to establish is the relationship between those accounts, not merely the validity of their individual layouts.
What to include in a Rust audit package
Provide the runtime target, framework versions, serialization formats, account or storage relationships, and reproducible tests. Mark code that uses unsafe Rust or custom arithmetic and explain why it is needed. For asynchronous systems, include callback and failure-handling flows so review covers the full operation rather than only its first entry point.
Discuss Your Audit Scope
Start with your email and a short project description. Technical details can follow. Request a smart contract audit quote or review public CTDSEC audit examples.