Smart Contract Development
Production-grade smart contracts. Audited. Enterprise-ready.
AR Data builds smart contracts that go beyond proof-of-concept. We write Solidity and Rust for EVM-compatible chains and Solana — contracts that hold value, govern protocols, and connect enterprise systems to decentralized infrastructure. Our smart contract work is backed by real Protocol Labs history, 20+ years of enterprise delivery, and a security-first engineering culture.
What we build
Smart contract development is not a single discipline — it spans fungible tokens, NFT infrastructure, DeFi mechanics, governance systems, and enterprise tokenization. AR Data has shipped across all of these categories. Below is the full scope of what we build and why each category matters.
ERC-20 and ERC-721 / ERC-1155 Token Contracts
Fungible and non-fungible token contracts are the foundation of the token economy. We write ERC-20 contracts for utility tokens, governance tokens, and stablecoins — with full compliance hooks, mint/burn controls, and pausability for regulated environments. Our ERC-721 and ERC-1155 implementations cover NFT collections, gaming assets, and semi-fungible tokenized instruments. Every contract is written with gas optimization in mind and tested against mainnet forking before deployment.
DeFi Protocols — AMMs, Lending, and Staking
Decentralized finance protocols are among the most technically demanding smart contract systems to build correctly. Automated market makers require careful handling of liquidity pool math, slippage tolerance, and fee accounting. Lending protocols introduce collateralization ratios, liquidation triggers, and interest rate models. Staking contracts must handle reward accrual, lock-up periods, and edge cases around early withdrawal. We have delivered DeFi protocol components and understand the security surface area that comes with each pattern. We do not treat these as template copy-paste jobs.
DAO Governance Contracts
Decentralized autonomous organizations require on-chain governance that is both secure and practically usable. We build governor contracts, timelock controllers, and voting modules — drawing on OpenZeppelin Governor and custom implementations where the use case demands it. We have designed voting weight systems based on token holdings, delegation mechanics, and proposal lifecycle management. Governance contracts are a particularly high-risk category because a poorly written governance contract can be exploited to seize control of an entire protocol treasury.
Multi-Sig and Treasury Management
Enterprise and protocol treasuries require multi-signature authorization schemes that are resistant to single points of failure. We implement Gnosis Safe integrations, custom multi-sig contracts, and treasury management systems with role-based access control. These contracts are used to protect protocol funds, manage DAO treasuries, and enforce spend governance policies. We configure threshold schemes, signer rotation, and on-chain spending limits.
Cross-Chain Bridges
Cross-chain bridges are among the most exploited contract systems in blockchain history — not because the concept is flawed, but because the implementation is routinely under-engineered. We build bridge contracts with validator sets, message passing systems, and relayer architectures that account for finality differences between chains. We draw on established bridge patterns while applying our own security review process. We are explicit about where cross-chain assumptions can break and design for those failure modes.
NFT Marketplace Contracts
NFT marketplace contracts handle listing, bidding, settlement, and royalty enforcement. We build marketplace contracts with support for EIP-2981 royalty standards, lazy minting, auction mechanics, and gasless listing via signatures. We have built both custodial and non-custodial marketplace architectures, and we understand the gas implications of each approach. Secondary royalty enforcement — a persistent challenge across marketplaces — is addressed through operator filter registries and custom enforcement mechanisms where appropriate.
Enterprise Tokenization — Asset-Backed Tokens and Real World Assets
Real world asset (RWA) tokenization is the convergence of enterprise finance and decentralized infrastructure. We build token contracts for real estate fractional ownership, trade finance instruments, and asset-backed securities. These contracts require compliance layers — KYC/AML allow-list enforcement, transfer restrictions, forced transfer mechanisms for regulatory compliance, and on-chain documentation linking. We work with enterprise clients who need these systems to meet legal requirements while operating on public or permissioned blockchains.
Decentralized Storage Integration — IPFS and Filecoin
Smart contracts that manage data — NFT metadata, document hashes, attestation records — need durable, decentralized storage for their off-chain payloads. AR Data's founder contributed directly to IPFS and Filecoin infrastructure at Protocol Labs. That is not a marketing claim — it means we understand content-addressed storage, CID generation, pinning services, and Filecoin deal mechanics at an engineering depth that most blockchain agencies cannot access. We integrate IPFS and Filecoin storage into smart contract systems so that the on-chain references are durable and the storage economics are properly accounted for.
Chains we build on
Chain selection is a strategic decision, not just a technical one. Gas costs, ecosystem maturity, finality speed, validator economics, and regulatory perception all factor into which chain the right choice for a given application. We have hands-on delivery experience across the following chains and give clients honest guidance on which fits their use case — not whichever is trending.
The smart contract stack
The tools we use are not chosen for familiarity — they are chosen because they produce more secure, more auditable, and more maintainable contracts. Here is the full stack and why each component belongs.
The primary language for EVM-compatible smart contracts. We write Solidity targeting recent stable compiler versions, use natspec documentation throughout, and enforce strict compiler settings including overflow checks and the ABI encoder v2. We do not use outdated patterns like tx.origin for authentication or delegatecall in contexts that create proxy risks.
Solana programs are written in Rust using the Anchor framework, which enforces account validation and discriminator checks that prevent common Solana-specific attack vectors. Rust's ownership model eliminates entire categories of memory bugs. We write Anchor programs with full account constraint declarations and instruction-level access control.
We use Hardhat for JavaScript-native testing environments and deployment scripts, and Foundry for fuzz testing and invariant testing of DeFi contracts. Foundry's property-based testing is particularly valuable for financial contracts where edge-case arithmetic can create exploitable conditions. We run both suites on all production contracts.
OpenZeppelin's battle-tested contract library is the baseline for token standards, access control, and upgrade patterns. We do not rewrite what OpenZeppelin has already audited — we extend it correctly. When we diverge from the library, we document why and what the security implications are.
Frontend and backend integration libraries for interacting with deployed contracts. We use Ethers.js as the primary client library for its cleaner API and better TypeScript support. Web3.js is used where legacy systems or third-party integrations require it.
On-chain data is not easily queryable by default. The Graph enables indexed, queryable subgraphs over contract event data. We build and deploy subgraphs as part of the full-stack delivery — not as an afterthought. Applications that rely on event history for their UI logic need reliable indexing, and The Graph is the production-grade solution for that.
DeFi protocols and enterprise contracts that depend on off-chain data — price feeds, weather data, sports outcomes, randomness — require oracle infrastructure that cannot be manipulated. We integrate Chainlink price feeds, VRF for provable randomness, and Automation (formerly Keepers) for on-chain automation. We understand the trust assumptions that come with oracle usage and design contracts to minimize the blast radius of a corrupted feed.
Security and auditing
Smart contract security is not a phase at the end of development — it is a discipline embedded into every step of how we write code. The Ethereum ecosystem has seen over a billion dollars lost to contract exploits that were preventable. We take that history seriously.
Vulnerability patterns we design against
Reentrancy attacks — where a malicious contract calls back into a vulnerable function before its state is updated — are responsible for some of the largest hacks in DeFi history. We apply the checks-effects-interactions pattern and use ReentrancyGuard from OpenZeppelin on all functions that transfer value or interact with external contracts.
Integer overflow and underflow, historically a major attack vector before Solidity 0.8.x introduced automatic checks, still require vigilance in contracts that use unchecked blocks for gas optimization. We document every unchecked block and prove the invariants that make it safe.
Access control vulnerabilities — missing modifiers, overly permissive role structures, and unprotected initializer functions — account for a significant proportion of production contract exploits. We use OpenZeppelin's AccessControl and Ownable patterns, apply the principle of least privilege to all roles, and verify that proxy initializers cannot be called after deployment.
Flash loan attacks exploit the ability to borrow large sums within a single transaction, manipulating on-chain price oracles or governance vote counts. We design contracts to be flash-loan resistant through TWAP oracles, governance vote delays, and token snapshot mechanisms.
Front-running and MEV (Miner Extractable Value) are structural properties of public blockchains. We design contracts that are either MEV-resistant by construction — through commit-reveal schemes, batch auctions, or private transaction relays — or that make the MEV surface explicit and acceptable for the use case.
Testing methodology
Every production contract we deliver has a test suite with unit tests, integration tests against mainnet forks, and fuzz tests for financial logic. Mainnet forking allows us to test contracts against the real state of live protocols — ensuring that integrations with Uniswap, Aave, Compound, or other DeFi primitives behave correctly under real liquidity conditions, not simulated ones.
Foundry's invariant testing lets us define properties that should always hold — for example, that the total supply of a token never exceeds a defined cap, or that a lending protocol's collateral ratio never drops below a threshold — and then run thousands of randomized state transitions to attempt to break them. This catches edge cases that no manual test plan would enumerate.
Audit preparation
We deliver contracts that are ready for third-party audit — which means the code is documented with natspec, the architecture is explained in a system specification document, the test suite has high branch coverage, and known limitations are disclosed. A well-prepared audit scope means auditors spend their time finding real issues rather than reconstructing intent from undocumented code. We also run Slither and Mythril static analysis as a pre-audit step to eliminate the class of issues those tools reliably catch.
For clients deploying high-value contracts, we work with reputable audit firms and can facilitate that engagement. We view third-party audit as a standard part of production deployment for any contract holding significant value — not an optional luxury.
Protocol Labs — where the decentralized depth comes from
AR Data's founder, Alvin Reyes, contributed to IPFS and Filecoin infrastructure at Protocol Labs. Protocol Labs is the organization that built the InterPlanetary File System — the content-addressed, peer-to-peer protocol that underpins decentralized storage across Web3 — and Filecoin, the decentralized storage network that incentivizes storage providers with cryptographic proofs and token rewards.
This is not background reading. This is production-level, infrastructure-layer work on the protocols that the rest of the Web3 ecosystem depends on. That experience means when AR Data integrates decentralized storage into a smart contract system, we understand the storage deal lifecycle, proof mechanisms, retrieval markets, and CID pinning economics at a level that most blockchain development firms cannot access.
It also means our smart contract work is informed by how decentralized systems behave at infrastructure scale — how consensus mechanisms create finality guarantees, how network partitions affect distributed state, and how economic incentives shape protocol behavior over time. That depth shows in how we design contract systems, not just in how we write individual functions.
Enterprise blockchain integration
Most enterprise clients do not replace their existing systems with blockchain — they extend them. The real delivery challenge is connecting smart contracts with off-chain enterprise architecture: ERPs, core banking systems, data warehouses, identity providers, and compliance infrastructure. This is where AR Data's Oracle, IBM, Scotiabank, and Macquarie delivery background becomes directly relevant.
Hybrid on-chain / off-chain architectures
Most enterprise blockchain use cases follow a hybrid pattern: high-value state transitions happen on-chain for auditability, immutability, and trustlessness, while compute-intensive or latency-sensitive operations remain off-chain. We design these architectures so that the on-chain and off-chain components are correctly synchronized, with clear dispute resolution paths when they diverge. The contract system defines what is authoritative; the off-chain system handles what is practical.
Event-driven enterprise integration
Smart contract events are the primary mechanism for notifying off-chain systems of on-chain state changes. We build event listeners, indexers, and message queue integrations that bridge contract events into enterprise data pipelines — whether that means writing to a Kafka topic, updating a PostgreSQL record, or triggering a workflow in an enterprise service bus. We have delivered these integrations for financial and data management clients where event reliability and ordering guarantees are non-negotiable.
Identity, KYC, and compliance on-chain
Regulated enterprises that tokenize assets need compliance infrastructure built into the token mechanics — not bolted on afterward. We implement on-chain allow-list systems backed by off-chain KYC providers, transfer restriction contracts that enforce jurisdiction-based rules, and compliance agent roles that can freeze or seize tokens under regulatory order. We understand that these mechanisms need to be legally defensible as well as technically sound.
Permissioned and consortium chains
Not every enterprise application belongs on a public blockchain. Consortium chains — Hyperledger Fabric, Besu, Avalanche Subnets — offer the auditability and finality of blockchain with permissioned access and known validators. We advise clients on when a permissioned chain is the right architecture and when a public chain with access-control contracts achieves the same outcome with less operational overhead. We have delivered on both and are not ideologically committed to either.
Industries we serve
Smart contract development is a cross-industry capability. The same Solidity expertise that builds a DeFi lending protocol applies directly to tokenizing a commercial real estate fund. The governance contract patterns we build for a DAO are the same patterns used for enterprise multi-stakeholder decision systems. Here is where we focus.
Why AR Data
The blockchain development agency market is crowded with firms that learned Solidity in 2021 and have been applying the same patterns to every project since. AR Data is different in three concrete ways.
First, the depth is real. Our Protocol Labs background means we understand decentralized infrastructure from the protocol layer up — not from the application layer down. When we tell you that your IPFS integration will have retrieval latency issues under certain network conditions, or that your Filecoin deal size affects retrieval costs in ways that break your UX, we know that from shipping infrastructure, not from reading documentation.
Second, we bring enterprise delivery discipline to blockchain work. Smart contracts deployed to production are immutable. That means the software development practices that enterprise delivery demands — requirements clarity, test coverage, security review, documentation, change control — are not optional overhead. They are survival requirements for smart contract work. Our Oracle, IBM, and Scotiabank delivery history is directly relevant to how we manage the production readiness of contract deployments.
Third, our AI-augmented delivery model means we move meaningfully faster. Agentic workflows handle scaffolding, test generation, documentation, and repetitive implementation tasks at a speed that traditional development shops cannot match. You get faster delivery without compromising on the security review and engineering rigor that smart contract work requires. The two are not in tension — the AI handles the repeatable parts, the engineer handles the judgment calls.
Ready to build on-chain?
30 minutes. Bring your contract requirements, your chain preferences, or your questions about smart contract security. We scope real work, not slide decks.
