Smart Contract Audits: What They Cover and Why They Matter
Smart contracts are unusual software: once deployed, they are public, they often hold real money, and they can be hard or impossible to change. A single missing check can let an attacker drain a protocol in minutes. A smart contract audit is an independent, line-by-line security review of your contract code before it goes live, designed to find those flaws while fixing them is still cheap.
This guide explains what an audit actually covers, how the process works, what it costs and how to prepare. It is written for founders and product leads who are commissioning smart contract development and need to plan security into the budget from the start.
What Is a Smart Contract Audit?
A smart contract audit is a structured review, by security specialists who did not write the code, that checks contracts for vulnerabilities, logic errors and deviations from the intended design. The output is a written report listing each finding with a severity rating and a recommended fix, followed by a review of the fixes you make.
An audit is not a guarantee. It reduces risk significantly, but it covers a specific code version at a point in time. Any change after the audit, including a “small” fix, is unaudited code.
What Auditors Check
Auditors look at three layers: known vulnerability patterns, your business logic, and the system around the contracts. Industry references such as the OWASP Smart Contract Top 10 summarize the most common classes of issue.
1. Known vulnerability classes
- Reentrancy: an external call lets an attacker re-enter a function before state is updated. This was the root of The DAO hack in 2016 and still appears in new code.
- Access control: admin or mint functions that anyone can call, or roles that are never revoked.
- Oracle and price manipulation: relying on a spot price that can be moved with a flash loan.
- Arithmetic and precision errors: rounding that leaks value, or unchecked math blocks. Solidity 0.8 and later reverts on overflow by default, but precision bugs remain common.
- Front-running and MEV: transactions that can be profitably reordered by others.
- Upgradeability issues: storage collisions in proxies, unprotected initializers and unsafe upgrade paths.
- Signature replay and denial of service: reused signatures, unbounded loops and griefing attacks.
2. Business logic
Many of the largest losses come from logic that is perfectly “safe” code but economically wrong: a reward formula that can be gamed, a liquidation that can be triggered unfairly, or a vesting schedule that releases tokens early. Auditors compare the code against your specification, so a clear written spec makes this part of the audit far more valuable.
3. System and operational risk
Good auditors also flag centralization risks (a single admin key that can pause or drain funds), dependency risks (external protocols and oracles) and deployment configuration. These are often the issues investors and users care about most.
The Smart Contract Audit Process, Step by Step
Most audits follow the same six steps and take one to six weeks of auditor time, depending on code size. Booking lead times at well-known firms can add several weeks, so schedule early.
- Scoping. You share the repository, commit hash, documentation and test suite. The auditor estimates effort, usually based on lines of code and complexity.
- Code freeze. The audited commit is locked. Changing code mid-audit wastes time and money.
- Automated analysis. Static analyzers such as Slither and fuzzers such as Echidna or Foundry’s invariant tests surface common issues quickly.
- Manual review. This is the core of the audit: experienced reviewers read every line, model attacker behavior and write proof-of-concept exploits for suspected bugs.
- Report. Findings are ranked Critical, High, Medium, Low or Informational, each with an explanation and recommendation.
- Fix review. Your team fixes the issues and the auditor verifies each fix. The final report, often published, shows which findings were resolved or acknowledged.
How Much Does a Smart Contract Audit Cost?
Smart contract audit pricing typically ranges from around $5,000 for a simple token to well over $100,000 for a complex DeFi protocol. Cost depends mainly on lines of code, complexity, novelty and the firm’s reputation. The ranges below are indicative; final quotes depend on scope.
| Contract type | Indicative audit cost (USD) | Typical duration |
|---|---|---|
| Standard token (ERC-20 or SPL) with vesting | $5,000 – $15,000 | 3 – 7 days |
| NFT collection and minting contract | $8,000 – $25,000 | 1 – 2 weeks |
| Staking, marketplace or DAO governance | $20,000 – $60,000 | 2 – 4 weeks |
| DeFi protocol (lending, AMM, derivatives) | $50,000 – $150,000+ | 3 – 8 weeks |
| Cross-chain bridge or novel cryptography | $100,000+ | 4 – 10 weeks |
High-value protocols often commission two independent audits and then run a public bug bounty. Competitive audit contests, where many researchers review code in parallel for a prize pool, are another option for larger codebases.
How to Prepare for an Audit
The better prepared your code, the more of the auditor’s time goes into finding deep issues rather than obvious ones. A well-prepared codebase can also shorten the audit and lower the quote.
- Write a clear specification of what each contract must and must not allow, including roles and invariants.
- Reach high test coverage, including fuzz and invariant tests, not just happy-path unit tests.
- Use audited libraries for standard functionality instead of writing your own token or access-control logic.
- Follow the language’s security guidance, such as the security considerations in the Solidity documentation.
- Run static analysis yourself and fix everything you can before handing over the code.
- Remove dead code and keep contracts small and modular.
Our guide to Solidity smart contract best practices covers the development habits that make audits smoother.
How to Choose an Audit Firm
Choose an auditor based on relevant experience with your chain and protocol type, not on price or brand alone. A firm that has reviewed dozens of lending protocols will spot lending-specific attacks faster than a generalist.
- Read their public reports. Look for depth of explanation and whether findings go beyond automated-tool output.
- Check chain and language expertise. Solidity, Vyper, Rust on Solana and Move each have distinct pitfalls.
- Ask who will do the work and how many reviewer-days are included, so you can compare quotes like for like.
- Confirm the fix-review terms. Some quotes include one round of re-review; others charge separately.
- Be wary of very fast, very cheap audits. A two-day review of a complex protocol is a marketing badge, not a security measure.
Security Does Not End With the Audit
An audit is one layer of a security program, not the whole program. After launch, the main risks shift to keys, upgrades and the protocols you depend on.
- Protect admin keys with multisig wallets and hardware signers, and add timelocks to sensitive actions.
- Monitor contracts on-chain for unusual activity and have an incident response plan, including a tested pause mechanism.
- Re-audit any upgrade or new module before deployment.
- Run a bug bounty so independent researchers have an incentive to report rather than exploit.
Chain choice also affects which risks matter most. Our comparison of Solana vs Ethereum outlines the vulnerability types common to each ecosystem.
Frequently Asked Questions
How long does a smart contract audit take?
A simple token audit can take a few days, while a complex DeFi protocol may need four to eight weeks of review, plus time for fixes and re-review. Waiting lists at popular firms can add further weeks.
Is an audit required by law?
Generally, no law requires an audit for every smart contract, but exchanges, launchpads, institutional partners and investors frequently expect one. Regulated products such as tokenized securities may face additional technology risk requirements from regulators.
Can automated tools replace a manual audit?
No. Automated tools catch common patterns quickly and should be used throughout development, but they cannot understand your business logic or economic incentives. Manual review finds most of the critical issues.
Does an audited contract mean it is safe?
It means the risk is much lower, not zero. Audited protocols have still been exploited, often through unaudited changes, compromised keys or interactions with other protocols.
Build Audit-Ready Smart Contracts
Sigmato develops smart contracts with audits in mind: written specifications, thorough test suites, audited libraries and internal security reviews before code goes to an independent auditor. We build on Ethereum, Solana and other chains, and can support your decentralized platform from design through launch.
Sources and References
