Cairo
Cairo security review
Cairo is the contract language for Starknet. Hackerbane audits Cairo contracts, class upgrades, and the L1 handlers that move value.
scope
What we review
We audit Cairo contracts on Starknet: entry points, class upgrades, felt packing, account validation, L1 handlers, and constructors. Typical issues are an entry point that writes privileged state without a caller check, a class upgrade with no owner, a missing range check on a packed felt, an L1 handler that skips the Ethereum caller, and an initializer that can run twice.
Entry points that write privileged state without checking the caller.
Class upgrades that replace the class with no owner check.
Felt packing that skips a range check before fields go into a felt252.
Account validate paths that accept a call the account should have rejected.
L1 handlers that skip the L1 caller check, and constructors or initializers that can run twice.
Advanced Threat Detection
We built our own advanced threat detection stack that is more performant and cheaper than our competitors. We use a state-of-the-art AI harness coupled with world-class senior security engineers with proven experience finding vulnerabilities in well-tested software.
How we review this language
A Cairo review follows the same five-stage engagement as every Hackerbane audit. We lock the packages and class hashes first, then read entry points, upgrades, felt packing, account validation, and L1 handlers.
Two senior engineers read the Cairo in parallel and build it with scarb. We follow the account validate path, the class upgrade, and every L1 handler, including the ones your tests never call.
Scope and threat model
We lock the packages, the class hashes, the chain, and who can call each entry point, including upgrade keys, before the review starts.
Architecture and design review
We read the account, storage, and class-upgrade design against that model to find the flaws a line-by-line pass would miss.
Hybrid code and infrastructure review
Two senior engineers read the Cairo in parallel, build with scarb, and run checks across entry-point authorization, felt packing, and range checks.
Exploitability and root-cause analysis
High and Critical findings ship with a proof of concept on a Starknet target and the root cause, so the class of bug gets fixed, not only the instance.
Reporting and remediation
A prioritized report, a live walkthrough, and verification of every in-scope fix within the remediation window.
Tools and practices
We work in the repository you already use. scarb builds keep their tests. We add checks around authorization, upgrades, felt packing, and L1 handlers, then hand those artifacts back with the report.
What you get
Prioritized findings your engineers can ship against, each with root cause and a recommended fix.
Verifiable proofs of concept for High and Critical issues on a Starknet target.
A report you can share with partners, exchanges, investors, and regulators.
Remediation verification and a final report that reflects the fixed state of the system.
The harnesses and checks used against the account, class-upgrade, and L1-handler paths.
How to prepare
| # | Before review starts |
|---|---|
| 01 | scarb builds and tests run cleanly from a fresh checkout. |
| 02 | Class hashes, upgrade keys, and the accounts allowed to call each entry point are documented. |
| 03 | The codebase is stable, with no major refactors planned mid-audit. |
| 04 | L1 handlers, trusted L1 callers, and initializer rules are written down. |
| 05 | Scope is defined: which packages, which class hashes, and which deployments. |
Other pages
Questions
- Do you audit the Cairo and the L1 contracts it talks to?
- Yes. A Starknet system is the Cairo plus the L1 handlers and the Ethereum contracts they call. We read both, and we check that an L1 handler only accepts a trusted L1 caller.
- Do you need a scarb project?
- A clean scarb build with passing tests and pinned versions helps most. The layout matters less than a reproducible build.
- What about the account contract that calls everything?
- The account and its validate path are in scope. They choose which calls run, so we review them next to the contracts they touch.
Next step
Request an audit
Share the Cairo packages, the class hashes you deploy, and your timeline. We will propose an audit plan and estimate. Send the scarb build as it is.