NEAR is a sharded layer 1 blockchain whose smart contracts run as WebAssembly. It uses human-readable account names and a flexible key system. For a project, the main difference from the EVM is that calls between contracts are asynchronous, which changes how errors and state must be handled.
Building on NEAR
Contracts are mostly written in Rust with the NEAR SDK, with a JavaScript SDK also available. A call to another contract returns a promise, and its result arrives later in a callback, in a separate step. If the remote call fails, earlier state changes in the calling contract are not reverted automatically. Accounts can hold full access keys or restricted function call keys, and contracts must lock tokens to pay for the storage they use.
- Languages: Rust, JavaScript
- Tooling: the NEAR SDK, command-line tools and a sandbox for integration tests
- Not EVM-compatible, although separate EVM environments exist in the ecosystem
What auditors look at
- Callbacks: state changed before the cross-contract call, failure paths and restoration of balances
- Callback protection: callbacks that must be callable only by the contract itself
- Attached deposits: checks on sensitive functions and refunds of excess deposits
- Storage staking: who pays for storage and whether users can make the contract run out of balance
- Access keys, upgrade rights and the handling of account names in authorization
Before requesting quotes
- Describe every cross-contract call and the expected behavior when it fails
- Specify the SDK and its version, and whether the contract can be redeployed and by whom
- Provide integration tests in a sandbox, not only unit tests
- Explain the storage model and who pays for it