diff --git a/foundry.toml b/foundry.toml
index 97b7b1d..7292500 100644
--- a/foundry.toml
+++ b/foundry.toml
@@ -41,3 +41,12 @@
   # with assume statements because we don't have the surrogate address until it's deployed later in
   # the test.
   include_storage = false
+
+[invariant]
+  call_override = false
+  depth = 50
+  dictionary_weight = 80
+  fail_on_revert = false
+  include_push_bytes = true
+  include_storage = true
+  runs = 256
diff --git a/test/README.md b/test/README.md
new file mode 100644
index 0000000..24daad7
--- /dev/null
+++ b/test/README.md
@@ -0,0 +1,68 @@
+# Invariant Suite
+
+The invariant suite is a collection of tests designed to build confidence around certain properties of the system expected to be true.
+
+## Invariants under test
+
+- The total staked balance should equal the sum of all individual depositors' balances
+- The sum of beneficiary earning power should equal the total staked balance
+- The sum of all surrogate balance should equal the total staked balance
+- Cumulative deposits minus withdrawals should equal the total staked balance
+- The sum of all notified rewards should be greater or equal to all claimed rewards plus the rewards balance in the staking contract (TODO: not strictly equal because of stray transfers in, which are not yet implemented in handler)
+- Sum of unclaimed reward across all beneficiaries should be less than or equal to total rewards
+- `rewardPerTokenAccumulatedCheckpoint` should be greater or equal to the last `rewardPerTokenAccumulatedCheckpoint` value
+
+## Invariant Handler
+
+The handler contract specifies the actions that should be taken in the black box of an invariant run. Here is a list of implemented actions the handler contract can take, as well as ideas for further actions.
+
+### Valid user actions
+
+These actions are typical user actions that can be taken on the system. They are used to test the system's behavior under normal conditions.
+
+- [x] stake: a user deposits some amount of STAKE_TOKEN, specifying a delegatee and optionally a beneficiary.
+  - Action taken by: any user
+- [x] stakeMore: a user increments the balance on an existing deposit that she owns.
+  - Action taken by: existing depositors
+- [x] withdraw: a user withdraws some balance from a deposit that she owns.
+  - Action taken by: existing depositors
+- [x] claimReward: A beneficiary claims the reward that is due to her.
+  - Action taken by: existing beneficiaries
+- [ ] alterDelegatee
+- [ ] alterBeneficiary
+- [ ] permitAndStake
+- [x] enable rewards notifier
+- [x] notifyRewardAmount
+- [ ] all of the `onBehalf` methods
+- [ ] multicall
+
+### Invalid user actions
+
+- [ ] Staking without sufficient ERC20 approval
+- [ ] Stake more on a deposit that does not belong to you
+- [ ] State more on a deposit that does not exist
+- [ ] Alter beneficiary and alter delegatee on a deposit that is not yours or does not exist
+- [ ] withdraw on deposit that's not yours
+- [ ] call notifyRewardsAmount if you are not rewards notifier, or insufficient/incorrect reward balance
+- [ ] setAdmin and setRewardNotifier without being the admin
+- [ ] Invalid signature on the `onBehalf` methods
+- [ ] multicall
+
+### Weird user actions
+
+These are actions that are outside the normal use of the system. They are used to test the system's behavior under abnormal conditions.
+
+- [ ] directly transfer in some amount of STAKE_TOKEN to UniStaker
+- [ ] directly transfer some amount of REWARD_TOKEN to UniStaker
+- [ ] transfer stake directly to surrogate
+- [ ] reentrancy attempts
+- [ ] SELFDESTRUCT to this contract
+- [ ] flash loan?
+- [ ] User uses the staking contract as the from address in a `transferFrom`
+- [ ] A non-beneficiary calls claim reward
+- [x] withdraw with zero amount
+- [ ] multicall
+
+### Utility actions
+
+- [x] `warpAhead`: warp the block timestamp ahead by a specified number of seconds.
diff --git a/test/UniStaker.invariants.t.sol b/test/UniStaker.invariants.t.sol
new file mode 100644
index 0000000..4c80ce1
--- /dev/null
+++ b/test/UniStaker.invariants.t.sol
@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+pragma solidity ^0.8.23;
+
+import {Test} from "forge-std/Test.sol";
+import {IERC20} from "openzeppelin/token/ERC20/IERC20.sol";
+
+import {UniStaker} from "src/UniStaker.sol";
+import {UniStakerHandler} from "test/helpers/UniStaker.handler.sol";
+import {ERC20VotesMock} from "test/mocks/MockERC20Votes.sol";
+import {ERC20Fake} from "test/fakes/ERC20Fake.sol";
+
+contract UniStakerInvariants is Test {
+  UniStakerHandler public handler;
+  UniStaker public uniStaker;
+  ERC20Fake rewardToken;
+  ERC20VotesMock govToken;
+  address rewardsNotifier;
+
+  function setUp() public {
+    rewardToken = new ERC20Fake();
+    vm.label(address(rewardToken), "Rewards Token");
+
+    govToken = new ERC20VotesMock();
+    vm.label(address(govToken), "Governance Token");
+
+    rewardsNotifier = address(0xaffab1ebeef);
+    vm.label(rewardsNotifier, "Rewards Notifier");
+    uniStaker = new UniStaker(rewardToken, govToken, rewardsNotifier);
+    handler = new UniStakerHandler(uniStaker);
+
+    bytes4[] memory selectors = new bytes4[](7);
+    selectors[0] = UniStakerHandler.stake.selector;
+    selectors[1] = UniStakerHandler.validStakeMore.selector;
+    selectors[2] = UniStakerHandler.validWithdraw.selector;
+    selectors[3] = UniStakerHandler.warpAhead.selector;
+    selectors[4] = UniStakerHandler.claimReward.selector;
+    selectors[5] = UniStakerHandler.enableRewardNotifier.selector;
+    selectors[6] = UniStakerHandler.notifyRewardAmount.selector;
+
+    targetSelector(FuzzSelector({addr: address(handler), selectors: selectors}));
+
+    targetContract(address(handler));
+  }
+
+  // Invariants
+
+  function invariant_Sum_of_all_depositor_balances_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.reduceDepositors(0, this.accumulateDeposits));
+  }
+
+  function invariant_Sum_of_beneficiary_earning_power_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.reduceBeneficiaries(0, this.accumulateEarningPower));
+  }
+
+  function invariant_Sum_of_surrogate_balance_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.reduceDelegates(0, this.accumulateSurrogateBalance));
+  }
+
+  function invariant_Cumulative_staked_minus_withdrawals_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.ghost_stakeSum() - handler.ghost_stakeWithdrawn());
+  }
+
+  function invariant_Sum_of_notified_rewards_equals_all_claimed_rewards_plus_rewards_left() public {
+    assertEq(
+      handler.ghost_rewardsNotified(),
+      rewardToken.balanceOf(address(uniStaker)) + handler.ghost_rewardsClaimed()
+    );
+  }
+
+  function invariant_Sum_of_unclaimed_reward_should_be_less_than_or_equal_to_total_rewards() public {
+    assertLe(
+      handler.reduceBeneficiaries(0, this.accumulateUnclaimedReward),
+      rewardToken.balanceOf(address(uniStaker))
+    );
+  }
+
+  function invariant_RewardPerTokenAccumulatedCheckpoint_should_be_greater_or_equal_to_the_last_rewardPerTokenAccumulatedCheckpoint(
+  ) public {
+    assertGe(
+      uniStaker.rewardPerTokenAccumulatedCheckpoint(),
+      handler.ghost_prevRewardPerTokenAccumulatedCheckpoint()
+    );
+  }
+
+  // Used to see distribution of non-reverting calls
+  function invariant_callSummary() public view {
+    handler.callSummary();
+  }
+
+  // Helpers
+
+  function accumulateDeposits(uint256 balance, address depositor) external view returns (uint256) {
+    return balance + uniStaker.depositorTotalStaked(depositor);
+  }
+
+  function accumulateEarningPower(uint256 earningPower, address caller)
+    external
+    view
+    returns (uint256)
+  {
+    return earningPower + uniStaker.earningPower(caller);
+  }
+
+  function accumulateUnclaimedReward(uint256 unclaimedReward, address beneficiary)
+    external
+    view
+    returns (uint256)
+  {
+    return unclaimedReward + uniStaker.unclaimedReward(beneficiary);
+  }
+
+  function accumulateSurrogateBalance(uint256 balance, address delegate)
+    external
+    view
+    returns (uint256)
+  {
+    address surrogateAddr = address(uniStaker.surrogates(delegate));
+    return balance + IERC20(address(uniStaker.STAKE_TOKEN())).balanceOf(surrogateAddr);
+  }
+}
diff --git a/test/helpers/AddressSet.sol b/test/helpers/AddressSet.sol
new file mode 100644
index 0000000..83327a7
--- /dev/null
+++ b/test/helpers/AddressSet.sol
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+pragma solidity ^0.8.23;
+
+// AddressSet.sol comes from
+// https://github.com/horsefacts/weth-invariant-testing/blob/973156bc9b6684f0cf62de19e9bb4c5c27a41bb2/test/helpers/AddressSet.sol
+
+struct AddressSet {
+  address[] addrs;
+  mapping(address => bool) saved;
+}
+
+library LibAddressSet {
+  function add(AddressSet storage s, address addr) internal {
+    if (!s.saved[addr]) {
+      s.addrs.push(addr);
+      s.saved[addr] = true;
+    }
+  }
+
+  function contains(AddressSet storage s, address addr) internal view returns (bool) {
+    return s.saved[addr];
+  }
+
+  function count(AddressSet storage s) internal view returns (uint256) {
+    return s.addrs.length;
+  }
+
+  function rand(AddressSet storage s, uint256 seed) internal view returns (address) {
+    if (s.addrs.length > 0) return s.addrs[seed % s.addrs.length];
+    else return address(0);
+  }
+
+  function forEach(AddressSet storage s, function(address) external func) internal {
+    for (uint256 i; i < s.addrs.length; ++i) {
+      func(s.addrs[i]);
+    }
+  }
+
+  function reduce(
+    AddressSet storage s,
+    uint256 acc,
+    function(uint256,address) external returns (uint256) func
+  ) internal returns (uint256) {
+    for (uint256 i; i < s.addrs.length; ++i) {
+      acc = func(acc, s.addrs[i]);
+    }
+    return acc;
+  }
+}
diff --git a/test/helpers/UniStaker.handler.sol b/test/helpers/UniStaker.handler.sol
new file mode 100644
index 0000000..f8fe335
--- /dev/null
+++ b/test/helpers/UniStaker.handler.sol
@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8.13;
+
+import {CommonBase} from "forge-std/Base.sol";
+import {StdCheats} from "forge-std/StdCheats.sol";
+import {StdUtils} from "forge-std/StdUtils.sol";
+import {console} from "forge-std/console.sol";
+import {AddressSet, LibAddressSet} from "../helpers/AddressSet.sol";
+import {UniStaker} from "src/UniStaker.sol";
+import {IERC20} from "openzeppelin/token/ERC20/IERC20.sol";
+
+contract UniStakerHandler is CommonBase, StdCheats, StdUtils {
+  using LibAddressSet for AddressSet;
+
+  // system setup
+  UniStaker public uniStaker;
+  IERC20 public stakeToken;
+  IERC20 public rewardToken;
+  address public admin;
+
+  // actors, deposit state
+  address internal _currentActor;
+  AddressSet internal _depositors;
+  AddressSet internal _delegates;
+  AddressSet internal _beneficiaries;
+  AddressSet internal _surrogates;
+  AddressSet internal _rewardNotifiers;
+  mapping(address => uint256[]) internal _depositIds;
+  mapping(bytes32 => uint256) public calls;
+
+  // ghost vars
+  uint256 public ghost_stakeSum;
+  uint256 public ghost_stakeWithdrawn;
+  uint256 public ghost_depositCount;
+  uint256 public ghost_rewardsClaimed;
+  uint256 public ghost_rewardsNotified;
+  uint256 public ghost_prevRewardPerTokenAccumulatedCheckpoint;
+
+  modifier countCall(bytes32 key) {
+    calls[key]++;
+    _;
+  }
+
+  modifier doCheckpoints() {
+    _checkpoint_ghost_prevRewardPerTokenAccumulatedCheckpoint();
+    _;
+  }
+
+  constructor(UniStaker _uniStaker) {
+    uniStaker = _uniStaker;
+    stakeToken = IERC20(address(_uniStaker.STAKE_TOKEN()));
+    rewardToken = IERC20(address(_uniStaker.REWARD_TOKEN()));
+    admin = uniStaker.admin();
+  }
+
+  function _mintStakeToken(address _to, uint256 _amount) internal {
+    vm.assume(_to != address(0));
+    deal(address(stakeToken), _to, _amount, true);
+  }
+
+  function _mintRewardToken(address _to, uint256 _amount) internal {
+    vm.assume(_to != address(0));
+    deal(address(rewardToken), _to, _amount, true);
+  }
+
+  function enableRewardNotifier(address _notifier)
+    public
+    countCall("enableRewardNotifier")
+    doCheckpoints
+  {
+    vm.assume(_notifier != address(0));
+    _rewardNotifiers.add(_notifier);
+    vm.prank(admin);
+    uniStaker.setRewardNotifier(_notifier, true);
+  }
+
+  function notifyRewardAmount(uint256 _amount, uint256 _actorSeed)
+    public
+    countCall("notifyRewardAmount")
+    doCheckpoints
+  {
+    _useActor(_rewardNotifiers, _actorSeed);
+    vm.assume(_currentActor != address(0));
+    _amount = bound(_amount, 0, 100_000_000e18);
+    ghost_prevRewardPerTokenAccumulatedCheckpoint = uniStaker.rewardPerTokenAccumulatedCheckpoint();
+    _mintRewardToken(_currentActor, _amount);
+    vm.startPrank(_currentActor);
+    rewardToken.transfer(address(uniStaker), _amount);
+    uniStaker.notifyRewardAmount(_amount);
+    vm.stopPrank();
+    ghost_rewardsNotified += _amount;
+  }
+
+  function stake(uint256 _amount, address _delegatee, address _beneficiary)
+    public
+    countCall("stake")
+    doCheckpoints
+  {
+    _createDepositor();
+
+    _beneficiaries.add(_beneficiary);
+    _delegates.add(_delegatee);
+    _amount = bound(_amount, 0, 100_000_000e18);
+
+    // assume user has stake amount
+    _mintStakeToken(_currentActor, _amount);
+
+    vm.startPrank(_currentActor);
+    stakeToken.approve(address(uniStaker), _amount);
+    uniStaker.stake(_amount, _delegatee, _beneficiary);
+    vm.stopPrank();
+
+    // update handler state
+    _depositIds[_currentActor].push(ghost_depositCount);
+    ghost_depositCount++;
+    _surrogates.add(address(uniStaker.surrogates(_delegatee)));
+    ghost_stakeSum += _amount;
+  }
+
+  function validStakeMore(uint256 _amount, uint256 _actorSeed, uint256 _actorDepositSeed)
+    public
+    countCall("validStakeMore")
+    doCheckpoints
+  {
+    _useActor(_depositors, _actorSeed);
+    vm.assume(_currentActor != address(0));
+    vm.assume(_depositIds[_currentActor].length > 0);
+    UniStaker.DepositIdentifier _depositId =
+      UniStaker.DepositIdentifier.wrap(_getActorRandDepositId(_actorDepositSeed));
+    (uint256 _balance,,,) = uniStaker.deposits(_depositId);
+    _amount = bound(_amount, 0, _balance);
+    vm.startPrank(_currentActor);
+    stakeToken.approve(address(uniStaker), _amount);
+    uniStaker.stakeMore(_depositId, _amount);
+    vm.stopPrank();
+    ghost_stakeSum += _amount;
+  }
+
+  function validWithdraw(uint256 _amount, uint256 _actorSeed, uint256 _actorDepositSeed)
+    public
+    countCall("validWithdraw")
+    doCheckpoints
+  {
+    _useActor(_depositors, _actorSeed);
+    vm.assume(_currentActor != address(0));
+    vm.assume(_depositIds[_currentActor].length > 0);
+    UniStaker.DepositIdentifier _depositId =
+      UniStaker.DepositIdentifier.wrap(_getActorRandDepositId(_actorDepositSeed));
+    (uint256 _balance,,,) = uniStaker.deposits(_depositId);
+    _amount = bound(_amount, 0, _balance);
+    vm.startPrank(_currentActor);
+    uniStaker.withdraw(_depositId, _amount);
+    vm.stopPrank();
+    ghost_stakeWithdrawn += _amount;
+  }
+
+  function claimReward(uint256 _actorSeed) public countCall("claimReward") doCheckpoints {
+    _useActor(_beneficiaries, _actorSeed);
+    vm.startPrank(_currentActor);
+    uint256 rewardsClaimed = uniStaker.unclaimedRewardCheckpoint(_currentActor);
+    uniStaker.claimReward();
+    vm.stopPrank();
+    ghost_rewardsClaimed += rewardsClaimed;
+  }
+
+  function warpAhead(uint256 _seconds) public countCall("warpAhead") doCheckpoints {
+    _seconds = bound(_seconds, 0, uniStaker.REWARD_DURATION() * 2);
+    skip(_seconds);
+  }
+
+  function _getActorRandDepositId(uint256 _randomDepositSeed) internal view returns (uint256) {
+    return _depositIds[_currentActor][_randomDepositSeed % _depositIds[_currentActor].length];
+  }
+
+  function _createDepositor() internal {
+    _currentActor = msg.sender;
+    // Surrogates can't stake. We won't include them as potential depositors.
+    vm.assume(!_surrogates.contains(_currentActor));
+    _depositors.add(msg.sender);
+  }
+
+  function _useActor(AddressSet storage _set, uint256 _randomActorSeed) internal {
+    _currentActor = _set.rand(_randomActorSeed);
+  }
+
+  function reduceDepositors(uint256 acc, function(uint256,address) external returns (uint256) func)
+    public
+    returns (uint256)
+  {
+    return _depositors.reduce(acc, func);
+  }
+
+  function reduceBeneficiaries(
+    uint256 acc,
+    function(uint256,address) external returns (uint256) func
+  ) public returns (uint256) {
+    return _beneficiaries.reduce(acc, func);
+  }
+
+  function reduceDelegates(uint256 acc, function(uint256,address) external returns (uint256) func)
+    public
+    returns (uint256)
+  {
+    return _delegates.reduce(acc, func);
+  }
+
+  function _checkpoint_ghost_prevRewardPerTokenAccumulatedCheckpoint() internal {
+    ghost_prevRewardPerTokenAccumulatedCheckpoint = uniStaker.rewardPerTokenAccumulatedCheckpoint();
+  }
+
+  function callSummary() external view {
+    console.log("\nCall summary:");
+    console.log("-------------------");
+    console.log("stake", calls["stake"]);
+    console.log("validStakeMore", calls["validStakeMore"]);
+    console.log("validWithdraw", calls["validWithdraw"]);
+    console.log("claimReward", calls["claimReward"]);
+    console.log("enableRewardNotifier", calls["enableRewardNotifier"]);
+    console.log("notifyRewardAmount", calls["notifyRewardAmount"]);
+    console.log("warpAhead", calls["warpAhead"]);
+    console.log("-------------------\n");
+  }
+
+  receive() external payable {}
+}