L2-specific assumptions
block.timestamp and block.number behave differently on a rollup than on mainnet. Any logic with a short time window needs checking against sequencer behaviour.
Base audits
Base smart contract audits
Base is EVM-equivalent, so the Solidity vulnerability classes carry over unchanged. What differs is the L2 environment around your contract: sequencing, bridging, and the assumptions your code makes about time and finality.
What we focus on
Bridge and messaging surfaces
Cross-domain messages, address aliasing, and what happens to in-flight transactions during a sequencer outage or forced-inclusion window.
Cost profile
Gas is cheap on Base, which changes the economics of griefing attacks. Loops and storage patterns that would be prohibitively expensive to abuse on mainnet are affordable here.
Pricing for Base work
Same tiers as everything else. Rust and Move carry a small premium over Solidity because the reviewer pool is smaller and the codebases are usually denser.
| Tier | Scope | Price |
|---|---|---|
Snapshot Real findings on one contract, in 72 hours |
1 contract · ≤200 LoC | Free72 hours |
Single contract Full manual review of one contract, all severities |
≤500 LoC | $400–7003–5 days |
Project audit Whole codebase, PoC exploits for high and above, re-review |
≤1,500 LoC | $1,500–2,5007–10 days |
Protocol audit Multi-contract, architecture, oracle and governance review |
1,500+ LoC | $4,000–6,0002–3 weeks |
Continuous Review on every commit, for teams shipping weekly |
Rolling scope | From $800/moRetainer |
Free monitoring assessment
Send us one Base contract, free.
Up to 200 lines, manually reviewed, findings within 72 hours. The fastest way to judge whether we know this stack.
- Reply written by the auditor who read your code
- No sales sequence, no drip campaign, no retargeting
- We’ll tell you if you don’t need a paid audit yet
- Report published only with your written permission