Building and auditing on NEAR: Rust contracts compiled to WebAssembly, asynchronous cross-contract calls and callbacks, access keys and preparation.
NEAR is a sharded layer 1 blockchain whose smart contracts run as WebAssembly. It uses human-readable account names and a flexible key system. For a project, the main difference from the EVM is that calls between contracts are asynchronous, which changes how errors and state must be handled.
Building on NEAR
Contracts are mostly written in Rust with the NEAR SDK, with a JavaScript SDK also available. A call to another contract returns a promise, and its result arrives later in a callback, in a separate step. If the remote call fails, earlier state changes in the calling contract are not reverted automatically. Accounts can hold full access keys or restricted function call keys, and contracts must lock tokens to pay for the storage they use.
Languages: Rust, JavaScript
Tooling: the NEAR SDK, command-line tools and a sandbox for integration tests
Not EVM-compatible, although separate EVM environments exist in the ecosystem
What auditors look at
Callbacks: state changed before the cross-contract call, failure paths and restoration of balances
Callback protection: callbacks that must be callable only by the contract itself
Attached deposits: checks on sensitive functions and refunds of excess deposits
Storage staking: who pays for storage and whether users can make the contract run out of balance
Access keys, upgrade rights and the handling of account names in authorization
Before requesting quotes
Describe every cross-contract call and the expected behavior when it fails
Specify the SDK and its version, and whether the contract can be redeployed and by whom
Provide integration tests in a sandbox, not only unit tests