diff --git a/foundry.toml b/foundry.toml
index a3031f2..f669393 100644
--- a/foundry.toml
+++ b/foundry.toml
@@ -37,3 +37,12 @@
   # with assume statements because we don't have the surrogate address until it's deployed later in
   # the test.
   include_storage = false
+
+[invariant]
+  call_override = false
+  depth = 50
+  dictionary_weight = 80
+  fail_on_revert = false
+  include_push_bytes = true
+  include_storage = true
+  runs = 100
diff --git a/test/README.md b/test/README.md
new file mode 100644
index 0000000..f51fecd
--- /dev/null
+++ b/test/README.md
@@ -0,0 +1,64 @@
+# Invariant Suite
+
+The invariant suite is a collection of tests that ensure certain properties of the system are always true.
+
+## Invariants under test
+
+- [ ] the earned fees should equal the percentage of durations that have passed on the rewards
+- [ ] Withdrawals for individual depositors + stake should equal the total staked throughout the tests
+- [ ] The sum of all of the notified rewards should equal the rewards balance in the staking contract plus all claimed rewards
+
+## Invariant Handler
+
+The handler contract specifies the actions that should be taken in the black box of an invariant run. Included in the handler contract are actions such as:
+
+### Valid user actions
+
+These actions are typical user actions that can be taken on the system. They are used to test the system's behavior under normal conditions.
+
+- [x] stake: a user deposits some amount of STAKE_TOKEN, specifying a delegatee and optionally a beneficiary.
+  - Action taken by: any user
+- [x] stakeMore: a user increments the balance on an existing deposit that she owns.
+  - Action taken by: existing depositors
+- [x] withdraw: a user withdraws some balance from a deposit that she owns.
+  - Action taken by: existing depositors
+- [x] claimReward: A beneficiary claims the reward that is due to her.
+  - Action taken by: existing beneficiaries
+- alterDelegatee
+- alterBeneficiary
+- permitAndStake
+- enable rewards notifier
+- notifyRewardAmount
+- all of the `onBehalf` methods
+- multicall
+
+### Invalid user actions
+
+- Staking without sufficient EC20 approval
+- Stake more on a deposit that does not belong to you
+- State more on a deposit that does not exist
+- Alter beneficiary and alter delegatee on a deposit that is not yours or does not exist
+- withdraw on deposit that's not yours
+- call notifyRewardsAmount if you are not rewards notifier, or insufficient/incorrect reward balance
+- setAdmin and setRewardNotifier without being the admin
+- Invalid signature on the `onBehalf` methods
+- multicall
+
+### Weird user actions
+
+These are actions that are outside the normal use of the system. They are used to test the system's behavior under abnormal conditions.
+
+- transfer in arbitrary amount of STAKE_TOKEN
+- transfer in arbitrary amount of REWARD_TOKEN
+- transfer direct to surrogate
+- reentrancy attempts
+- SELFDESTRUCT to this contract
+- flash loan?
+- User uses the staking contract as the from address in a `transferFrom`
+- A non-beneficiary calls claim reward
+- withdraw with zero amount
+- multicall
+
+### Utility actions
+
+- `warpAhead`: warp the block timestamp ahead by a specified number of seconds.
diff --git a/test/UniStaker.invariants.t.sol b/test/UniStaker.invariants.t.sol
new file mode 100644
index 0000000..1b05c03
--- /dev/null
+++ b/test/UniStaker.invariants.t.sol
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+pragma solidity ^0.8.23;
+
+import {Test} from "forge-std/Test.sol";
+import {IERC20} from "openzeppelin/token/ERC20/IERC20.sol";
+
+import {UniStaker} from "src/UniStaker.sol";
+import {UniStakerHandler} from "test/helpers/UniStaker.handler.sol";
+import {ERC20VotesMock} from "test/mocks/MockERC20Votes.sol";
+import {ERC20Fake} from "test/fakes/ERC20Fake.sol";
+
+contract UniStakerInvariants is Test {
+  UniStakerHandler public handler;
+  UniStaker public uniStaker;
+  ERC20Fake rewardToken;
+  ERC20VotesMock govToken;
+  address rewardsNotifier;
+
+  function setUp() public {
+    // deploy UniStaker
+    rewardToken = new ERC20Fake();
+    vm.label(address(rewardToken), "Rewards Token");
+
+    govToken = new ERC20VotesMock();
+    vm.label(address(govToken), "Governance Token");
+
+    rewardsNotifier = address(0xaffab1ebeef);
+    vm.label(rewardsNotifier, "Rewards Notifier");
+    uniStaker = new UniStaker(rewardToken, govToken, rewardsNotifier);
+    handler = new UniStakerHandler(uniStaker);
+
+    bytes4[] memory selectors = new bytes4[](7);
+    selectors[0] = UniStakerHandler.stake.selector;
+    selectors[1] = UniStakerHandler.validStakeMore.selector;
+    selectors[2] = UniStakerHandler.validWithdraw.selector;
+    selectors[3] = UniStakerHandler.warpAhead.selector;
+    selectors[4] = UniStakerHandler.claimReward.selector;
+    selectors[5] = UniStakerHandler.enableRewardNotifier.selector;
+    selectors[6] = UniStakerHandler.notifyRewardAmount.selector;
+
+    targetSelector(FuzzSelector({addr: address(handler), selectors: selectors}));
+
+    targetContract(address(handler));
+  }
+
+  function invariant_Sum_of_beneficiary_earning_power_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.reduceBeneficiaries(0, this.accumulateEarningPower));
+  }
+
+  function invariant_Sum_of_surrogate_balance_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.reduceDelegates(0, this.accumulateSurrogateBalance));
+  }
+
+  function invariant_Sum_of_all_depositor_balances_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.reduceDepositors(0, this.accumulateDeposits));
+  }
+
+  function invariant_Total_staked_minus_withdrawals_equals_total_stake() public {
+    assertEq(uniStaker.totalStaked(), handler.ghost_stakeSum() - handler.ghost_stakeWithdrawn());
+  }
+
+  function invariant_Sum_of_notified_rewards_equals_all_claimed_rewards_plus_rewards_left() public {
+    assertEq(
+      handler.ghost_rewardsNotified(),
+      rewardToken.balanceOf(address(uniStaker)) + handler.ghost_rewardsClaimed()
+    );
+  }
+
+  function invariant_Sum_of_beneficiary_unclaimed_rewards_equals_rewards_left() public {
+    assertEq(
+      rewardToken.balanceOf(address(uniStaker)),
+      handler.reduceBeneficiaries(0, this.accumulateUnclaimedReward)
+    );
+  }
+
+  function accumulateDeposits(uint256 balance, address depositor) external view returns (uint256) {
+    return balance + uniStaker.depositorTotalStaked(depositor);
+  }
+
+  function accumulateEarningPower(uint256 earningPower, address caller)
+    external
+    view
+    returns (uint256)
+  {
+    return earningPower + uniStaker.earningPower(caller);
+  }
+
+  function accumulateUnclaimedReward(uint256 unclaimedReward, address beneficiary)
+    external
+    view
+    returns (uint256)
+  {
+    return unclaimedReward + uniStaker.unclaimedReward(beneficiary);
+  }
+
+  function accumulateSurrogateBalance(uint256 balance, address delegate)
+    external
+    view
+    returns (uint256)
+  {
+    address surrogateAddr = address(uniStaker.surrogates(delegate));
+    return balance + IERC20(address(uniStaker.STAKE_TOKEN())).balanceOf(surrogateAddr);
+  }
+
+  function invariant_callSummary() public view {
+    handler.callSummary();
+  }
+}
diff --git a/test/helpers/AddressSet.sol b/test/helpers/AddressSet.sol
new file mode 100644
index 0000000..e57f494
--- /dev/null
+++ b/test/helpers/AddressSet.sol
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+pragma solidity ^0.8.23;
+
+struct AddressSet {
+  address[] addrs;
+  mapping(address => bool) saved;
+}
+
+library LibAddressSet {
+  function add(AddressSet storage s, address addr) internal {
+    if (!s.saved[addr]) {
+      s.addrs.push(addr);
+      s.saved[addr] = true;
+    }
+  }
+
+  function contains(AddressSet storage s, address addr) internal view returns (bool) {
+    return s.saved[addr];
+  }
+
+  function count(AddressSet storage s) internal view returns (uint256) {
+    return s.addrs.length;
+  }
+
+  function rand(AddressSet storage s, uint256 seed) internal view returns (address) {
+    if (s.addrs.length > 0) return s.addrs[seed % s.addrs.length];
+    else return address(0);
+  }
+
+  function forEach(AddressSet storage s, function(address) external func) internal {
+    for (uint256 i; i < s.addrs.length; ++i) {
+      func(s.addrs[i]);
+    }
+  }
+
+  function reduce(
+    AddressSet storage s,
+    uint256 acc,
+    function(uint256,address) external returns (uint256) func
+  ) internal returns (uint256) {
+    for (uint256 i; i < s.addrs.length; ++i) {
+      acc = func(acc, s.addrs[i]);
+    }
+    return acc;
+  }
+}
diff --git a/test/helpers/UniStaker.handler.sol b/test/helpers/UniStaker.handler.sol
new file mode 100644
index 0000000..df25435
--- /dev/null
+++ b/test/helpers/UniStaker.handler.sol
@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8.13;
+
+import {CommonBase} from "forge-std/Base.sol";
+import {StdCheats} from "forge-std/StdCheats.sol";
+import {StdUtils} from "forge-std/StdUtils.sol";
+import {console} from "forge-std/console.sol";
+import {AddressSet, LibAddressSet} from "../helpers/AddressSet.sol";
+import {UniStaker} from "src/UniStaker.sol";
+import {IERC20} from "openzeppelin/token/ERC20/IERC20.sol";
+
+contract UniStakerHandler is CommonBase, StdCheats, StdUtils {
+  using LibAddressSet for AddressSet;
+
+  UniStaker public uniStaker;
+  IERC20 public stakeToken;
+  IERC20 public rewardToken;
+  address public admin;
+
+  uint256 public ghost_stakeSum;
+  uint256 public ghost_stakeWithdrawn;
+  uint256 public ghost_depositCount;
+  uint256 public ghost_rewardsClaimed;
+  uint256 public ghost_rewardsNotified;
+
+  mapping(bytes32 => uint256) public calls;
+
+  address internal currentActor;
+
+  AddressSet internal _depositors;
+  AddressSet internal _delegates;
+  AddressSet internal _beneficiaries;
+  AddressSet internal _surrogates;
+  AddressSet internal _rewardNotifiers;
+
+  mapping(address => uint256[]) internal _depositIds;
+
+  function _getActorRandDepositId(uint256 _randomDepositSeed) internal view returns (uint256) {
+    return _depositIds[currentActor][_randomDepositSeed % _depositIds[currentActor].length];
+  }
+
+  function _createDepositor() internal {
+    currentActor = msg.sender;
+    // Surrogates can't stake. We won't include them as potential depositors.
+    vm.assume(!_surrogates.contains(currentActor));
+    _depositors.add(msg.sender);
+  }
+
+  function _useActor(AddressSet storage _set, uint256 _randomActorSeed) internal {
+    currentActor = _set.rand(_randomActorSeed);
+  }
+
+  modifier countCall(bytes32 key) {
+    calls[key]++;
+    _;
+  }
+
+  constructor(UniStaker _uniStaker) {
+    uniStaker = _uniStaker;
+    stakeToken = IERC20(address(_uniStaker.STAKE_TOKEN()));
+    rewardToken = IERC20(address(_uniStaker.REWARD_TOKEN()));
+    admin = uniStaker.admin();
+  }
+
+  function _mintStakeToken(address _to, uint256 _amount) internal {
+    vm.assume(_to != address(0));
+    deal(address(stakeToken), _to, _amount, true);
+  }
+
+  function _mintRewardToken(address _to, uint256 _amount) internal {
+    vm.assume(_to != address(0));
+    deal(address(rewardToken), _to, _amount, true);
+  }
+
+  function enableRewardNotifier(address _notifier) public countCall("enableRewardNotifier") {
+    vm.assume(_notifier != address(0));
+    _rewardNotifiers.add(_notifier);
+    vm.prank(admin);
+    uniStaker.setRewardNotifier(_notifier, true);
+  }
+
+  function notifyRewardAmount(uint256 _amount, uint256 _actorSeed)
+    public
+    countCall("notifyRewardAmount")
+  {
+    _useActor(_rewardNotifiers, _actorSeed);
+    vm.assume(currentActor != address(0));
+    _amount = bound(_amount, 0, 100_000_000e18);
+    _mintRewardToken(currentActor, _amount);
+    vm.startPrank(currentActor);
+    rewardToken.transfer(address(uniStaker), _amount);
+    uniStaker.notifyRewardAmount(_amount);
+    vm.stopPrank();
+    ghost_rewardsNotified += _amount;
+  }
+
+  // TODO: distinguish between valid and invalid stake
+  function stake(uint256 _amount, address _delegatee, address _beneficiary)
+    public
+    countCall("stake")
+  {
+    _createDepositor();
+
+    // TODO: decide if we want reverts in stake
+    //_beneficiary = address(uint160(bound(uint160(_beneficiary), 1, type(uint160).max)));
+    //_delegatee = address(uint160(bound(uint160(_delegatee), 1, type(uint160).max)));
+
+    _beneficiaries.add(_beneficiary);
+    _delegates.add(_delegatee);
+    // todo: adjust upper bound
+    _amount = bound(_amount, 0, 100_000_000e18);
+
+    // assume user has stake amount
+    _mintStakeToken(currentActor, _amount);
+
+    vm.startPrank(currentActor);
+    stakeToken.approve(address(uniStaker), _amount);
+    uniStaker.stake(_amount, _delegatee, _beneficiary);
+    vm.stopPrank();
+
+    // update handler state
+    _depositIds[currentActor].push(ghost_depositCount);
+    ghost_depositCount++;
+    _surrogates.add(address(uniStaker.surrogates(_delegatee)));
+    ghost_stakeSum += _amount;
+  }
+
+  function validStakeMore(uint256 _amount, uint256 _actorSeed, uint256 _actorDepositSeed)
+    public
+    countCall("validStakeMore")
+  {
+    _useActor(_depositors, _actorSeed);
+    vm.assume(currentActor != address(0));
+    vm.assume(_depositIds[currentActor].length > 0);
+    UniStaker.DepositIdentifier _depositId =
+      UniStaker.DepositIdentifier.wrap(_getActorRandDepositId(_actorDepositSeed));
+    (uint256 _balance,,,) = uniStaker.deposits(_depositId);
+    _amount = bound(_amount, 0, _balance);
+    vm.startPrank(currentActor);
+    stakeToken.approve(address(uniStaker), _amount);
+    uniStaker.stakeMore(_depositId, _amount);
+    vm.stopPrank();
+    ghost_stakeSum += _amount;
+  }
+
+  // TODO: include invalid withdrawals
+  function validWithdraw(uint256 _amount, uint256 _actorSeed, uint256 _actorDepositSeed)
+    public
+    countCall("validWithdraw")
+  {
+    _useActor(_depositors, _actorSeed);
+    vm.assume(currentActor != address(0));
+    vm.assume(_depositIds[currentActor].length > 0);
+    UniStaker.DepositIdentifier _depositId =
+      UniStaker.DepositIdentifier.wrap(_getActorRandDepositId(_actorDepositSeed));
+    (uint256 _balance,,,) = uniStaker.deposits(_depositId);
+    _amount = bound(_amount, 0, _balance);
+    vm.startPrank(currentActor);
+    uniStaker.withdraw(_depositId, _amount);
+    vm.stopPrank();
+    ghost_stakeWithdrawn += _amount;
+  }
+
+  function claimReward(uint256 _actorSeed) public countCall("claimReward") {
+    _useActor(_beneficiaries, _actorSeed);
+    vm.startPrank(currentActor);
+    uint256 rewardsClaimed = uniStaker.unclaimedRewardCheckpoint(currentActor);
+    uniStaker.claimReward();
+    vm.stopPrank();
+    ghost_rewardsClaimed += rewardsClaimed;
+  }
+
+  function warpAhead(uint256 _seconds) public countCall("warpAhead") {
+    _seconds = bound(_seconds, 0, uniStaker.REWARD_DURATION() * 2);
+    skip(_seconds);
+  }
+
+  function _getBeneficiaryEarningPower(address _beneficiary) internal view returns (uint256) {
+    return uniStaker.earningPower(_beneficiary);
+  }
+
+  function forEachActor(function(address) external func) public {
+    return _depositors.forEach(func);
+  }
+
+  function reduceDepositors(uint256 acc, function(uint256,address) external returns (uint256) func)
+    public
+    returns (uint256)
+  {
+    return _depositors.reduce(acc, func);
+  }
+
+  function reduceBeneficiaries(
+    uint256 acc,
+    function(uint256,address) external returns (uint256) func
+  ) public returns (uint256) {
+    return _beneficiaries.reduce(acc, func);
+  }
+
+  function reduceDelegates(uint256 acc, function(uint256,address) external returns (uint256) func)
+    public
+    returns (uint256)
+  {
+    return _delegates.reduce(acc, func);
+  }
+
+  function actors() external view returns (address[] memory) {
+    return _depositors.addrs;
+  }
+
+  function callSummary() external view {
+    console.log("\nCall summary:");
+    console.log("-------------------");
+    console.log("stake", calls["stake"]);
+    console.log("validStakeMore", calls["validStakeMore"]);
+    console.log("validWithdraw", calls["validWithdraw"]);
+    console.log("claimReward", calls["claimReward"]);
+    console.log("enableRewardNotifier", calls["enableRewardNotifier"]);
+    console.log("notifyRewardAmount", calls["notifyRewardAmount"]);
+    console.log("warpAhead", calls["warpAhead"]);
+    console.log("-------------------\n");
+  }
+
+  receive() external payable {}
+}