How much does a smart contract audit cost?

A code-only review from a reputable firm typically costs $10,000–$25,000. Comprehensive audits with formal verification from top firms (Trail of Bits, OpenZeppelin) cost $30,000–$100,000.

Do I need an audit for a simple token?

Yes. Even a simple token can have critical vulnerabilities. The cost of an audit ($10,000–$25,000) is small compared to the potential cost of an exploit.

The Smart Contract Audit Checklist | BlockchainDevelopers.org

A smart contract audit is a rigorous security review of your code before deployment. This guide explains what auditors look for, how to prepare, how to find reputable firms, and what a professional audit engagement looks like.

Why Audits Are Non-Negotiable

Smart contracts are immutable once deployed. Bugs aren't fixed with a patch — they're permanent, and attackers have unlimited time to find them. The history of DeFi is filled with examples of projects that skipped audits and paid for it: The DAO ($60M, 2016), Poly Network ($610M, 2021), Ronin Bridge ($625M, 2022). Professional audits don't eliminate all risk, but they dramatically reduce it.

What Auditors Look For

Access Control

Are privileged functions properly protected? Who can call admin functions? Are role separations appropriate? Can any function be called by anyone who shouldn't be able to call it?

Reentrancy

Does the contract make external calls before updating state? Can an attacker re-enter a function in an unexpected state? Are ETH transfers done safely (using call with explicit guards rather than transfer or send)?

Price Oracle Manipulation

Does the contract rely on spot prices that can be manipulated via flash loans? Are TWAPs used where spot prices would be dangerous? Are multiple oracle sources checked?

Integer Arithmetic

Even with Solidity 0.8+'s built-in overflow protection, are there any unchecked blocks where arithmetic could overflow? Are division operations safe from unexpected rounding?

Denial of Service

Can an attacker cause a function to revert for all users? Can unbounded loops be exploited to exceed block gas limits? Can external contract calls fail in a way that blocks other users?

Finding Reputable Audit Firms

Top-tier firms (appropriate for high-value DeFi): Trail of Bits, OpenZeppelin, Halborn, Certora (for formal verification), Code4rena (competitive audit platform), Sherlock (audit marketplace with insurance). Mid-tier (appropriate for most projects): Quantstamp, Runtime Verification, Dedaub, MixBytes. Budget option: competitive audits via Code4rena's public contests. Cost: $10,000–$100,000 depending on codebase size and firm tier.

How to Prepare for an Audit

Freeze the codebase — don't make changes during the audit. Write NatSpec comments on every public and external function. Document all known issues and design decisions. Ensure tests are comprehensive (90%+ coverage). Provide architecture documentation and threat model. Set up a dedicated audit environment with test scripts.

What a Report Looks Like

Findings are categorized by severity: Critical (deploy-blocking, funds at risk), High (significant risk), Medium (moderate risk), Low (minor risk), Informational (best practice suggestions). A typical report will have 0–2 criticals, 2–5 highs, 5–15 mediums, and 10–20+ lows/informationals. Fix all criticals and highs before deployment. Document your responses to mediums.

After the Audit

Request a re-audit (remediation review) after fixing critical and high findings. Publish the audit report publicly — it builds trust with users and demonstrates security commitment. Don't change audited code without flagging it for review. Consider an ongoing security relationship with the audit firm, especially if you plan upgrades.

The Smart Contract Audit Checklist