Starknet is a zero-knowledge rollup on Ethereum that proves the validity of its transactions with STARK proofs. Its smart contracts are written in Cairo, a language designed for provable computation, not in Solidity. For a project, this means a distinct stack and a smaller pool of specialists, with review effort focused on language specifics and cross-layer messaging.
Building on Starknet
Cairo's base type is the field element (felt252), and higher-level integer types are built on top of it. Contracts are declared as classes and then deployed as instances, and a contract can replace its own class to be upgraded. Every account is a smart contract (native account abstraction), and messages between Ethereum and Starknet go through a core contract on Ethereum and dedicated L1 handler functions on Starknet.
- Language: Cairo
- Tooling: Scarb for building and packaging, Starknet Foundry for testing
- Not EVM-compatible
What auditors look at
- Felt arithmetic: operations on raw field elements wrap around modulo a prime, so values must use checked integer types where overflow matters
- L1 to L2 and L2 to L1 messaging: validation of the sender in L1 handlers, message cancellation and failure handling
- Account abstraction: signature validation, assumptions about the caller and replay protection
- Upgrades through class replacement: who can trigger them and how storage is preserved
- Storage layout, access control and the handling of Ethereum addresses, which differ in size from Starknet addresses
Before requesting quotes
- Indicate the Cairo and Scarb versions used and any external libraries
- Describe each cross-layer flow and the contracts on both sides
- Provide Starknet Foundry tests, including negative cases and message handling
- Explain the upgrade mechanism and who controls it