Glossary

Smart contract and audit glossary

56 terms defined in plain language, for decision makers as well as developers.

A

Access control: The rules that determine who can call sensitive functions, such as minting tokens, pausing a contract, changing parameters or upgrading code. Missing or misconfigured access control is a frequent class of smart contract vulnerability, and often one of the most damaging.; See also: Multisig, Private key, Upgradeable proxy
AMM (automated market maker): A type of decentralized exchange where prices are set by a mathematical formula applied to pools of tokens supplied by liquidity providers, instead of an order book. Its pricing math and its exposure to price manipulation are central points of any audit.; See also: DeFi (decentralized finance), Oracle manipulation, Flash loan
Audit: An independent, time-boxed review of smart contract code by security specialists, who look for vulnerabilities and logic errors and report them by severity. An audit reduces risk but does not guarantee the absence of bugs, and it covers only the code and version defined in its scope.; See also: Audit scope, Audit report, Re-audit
Audit contest: A time-limited competition in which many independent researchers review the same code and are rewarded according to the valid findings they submit. It brings a wide range of reviewers but less predictable coverage than a scoped audit by a dedicated team.; See also: Audit, Bug bounty, Finding
Audit report: The document an auditor delivers at the end of an audit. It describes the scope and method, lists each finding with its severity, explanation and recommended fix, and, after a re-audit, records the resolution status of each issue.; See also: Finding, Severity, Audit scope
Audit scope: The precise list of files, contracts and commit that an audit covers, along with any exclusions and assumptions. A clear scope makes quotes comparable and defines what the final report can and cannot say about the code.; See also: Commit hash, nSLOC (normalized source lines of code), Audit report

B

Blockchain: A shared ledger replicated across many computers, where transactions are grouped into linked blocks validated by a consensus mechanism. Its history is very hard to alter, which lets parties who do not trust each other rely on the same record and on the smart contracts it runs.; See also: Smart contract, Mainnet, Gas
Bridge: A system of contracts and off-chain components that moves tokens or messages between two blockchains, typically by locking assets on one side and issuing a representation on the other. Bridges concentrate large amounts of value and complex trust assumptions, which makes them among the hardest systems to secure.; See also: DeFi (decentralized finance), Multisig, Oracle
Brief: The structured specification a client writes once to describe a smart contract project: goals, features, blockchain, integrations, budget, deadline and existing code. It serves as the common basis for development and audit requests, so every vendor quotes on the same information.; See also: RFP (request for proposals), Audit scope, nSLOC (normalized source lines of code)
Bug bounty: A standing program that rewards independent security researchers for responsibly reporting vulnerabilities in deployed code. It complements an audit after launch by keeping many reviewers engaged over time, with rewards usually scaled to severity.; See also: Audit, Audit contest, Severity

C

Cairo: The programming language used to write smart contracts on Starknet, a network that relies on zero-knowledge proofs to scale Ethereum. Its execution model differs from the EVM, so it calls for developers and auditors with specific experience.; See also: Rust, Move, EVM (Ethereum Virtual Machine)
Code freeze: The point after which no changes are made to the code submitted for audit, apart from fixes to findings. Freezing the code before the audit starts keeps the review valid; changes made during the audit can invalidate its conclusions and delay delivery.; See also: Commit hash, Audit scope, Re-audit
Commit hash: The unique identifier of a specific version of code in a Git repository. Naming the commit hash in the audit scope makes it unambiguous which code was reviewed, and lets anyone check whether the deployed contracts match the audited version.; See also: Audit scope, Code freeze

D

DAO (decentralized autonomous organization): An organization whose rules and decisions are executed through smart contracts, with members voting, often with governance tokens, on proposals such as spending funds or changing parameters. Its security depends on the voting logic, the timelock and resistance to vote manipulation.; See also: Timelock, Token, Multisig
DeFi (decentralized finance): Financial services such as exchange, lending, borrowing and derivatives, built as smart contracts that operate without a central intermediary. Because DeFi protocols hold pooled funds and interact with one another, they are among the most complex and most targeted contracts to secure.; See also: AMM (automated market maker), Lending protocol, Flash loan

E

ERC-1155: An Ethereum multi-token standard that lets a single contract manage both fungible and non-fungible tokens and transfer several of them in one transaction. It is often chosen for games, ticketing and collections with many item types.; See also: ERC-20, ERC-721, NFT (non-fungible token)
ERC-20: The Ethereum standard interface for fungible tokens, where every unit is interchangeable, as with a currency or a share. It defines functions for balances, transfers and allowances, which lets wallets and applications support any compliant token without custom integration.; See also: Token, ERC-721, ERC-1155
ERC-721: The Ethereum standard for non-fungible tokens, where each token has a unique identifier and a single owner. It is the basis of most NFT collections and of many tokenized items that must be tracked individually.; See also: NFT (non-fungible token), ERC-1155, Token
EVM (Ethereum Virtual Machine): The execution environment that runs smart contracts on Ethereum and on the many compatible networks. Contracts written in Solidity or Vyper compile to EVM bytecode, so code, tools and audit expertise can often be reused across EVM chains.; See also: Solidity, Vyper, Gas

F

Finding: An issue identified by an auditor, such as a vulnerability, a logic error, a deviation from the specification or a code quality concern. Each finding is documented in the audit report with a severity level, a description of its impact and a recommendation.; See also: Severity, Audit report, Proof of concept (PoC)
Flash loan: An uncollateralized loan that must be borrowed and repaid within the same transaction. It is a legitimate DeFi tool, but it also gives attackers temporary access to large amounts of capital to exploit price manipulation or flawed logic.; See also: Oracle manipulation, DeFi (decentralized finance), AMM (automated market maker)
Formal verification: The use of mathematical methods to prove that a contract satisfies a precise specification or set of invariants for all possible inputs. It gives strong assurance on the properties proven, but it is costly and only as good as the specification it checks.; See also: Invariant, Fuzzing, Static analysis
Front-running: Placing a transaction ahead of another known pending transaction to profit from it, for example by buying just before a large purchase. On public blockchains pending transactions are visible, so contracts should limit what an observer can gain from seeing them.; See also: MEV (maximal extractable value), AMM (automated market maker)
Fuzzing: An automated testing technique that calls contract functions with large numbers of random or semi-random inputs to find cases that break assertions or invariants. It often uncovers edge cases that hand-written unit tests miss.; See also: Invariant, Unit test, Formal verification

G

Gas: The unit that measures the computation a transaction consumes on an EVM blockchain. Users pay for gas in the network's native currency, so inefficient code makes every interaction more expensive, and some operations fail if they exceed the gas limit of a block.; See also: EVM (Ethereum Virtual Machine), Blockchain

I

Independence rule: The rule on smart-contract.com that a company engaged to develop a project can never be invited to, or engaged for, the audit or re-audit of that same project. It is enforced by the database itself, not only by the interface, so the auditor always reviews code written by someone else.; See also: Audit, Re-audit, RFP (request for proposals)
Integer overflow: An error where an arithmetic result exceeds the range of its numeric type and wraps around to an unexpected value. Solidity has checked arithmetic by default since version 0.8, but unchecked blocks, type conversions and other languages can still expose contracts to it.; See also: Solidity, Fuzzing, Static analysis
Invariant: A property that must always hold true for a contract, whatever sequence of transactions occurs, for example that total deposits always equal the sum of user balances. Writing invariants down clarifies intent and allows fuzzing and formal verification to test them.; See also: Fuzzing, Formal verification, Unit test

L

Lending protocol: A DeFi application where users deposit assets to earn interest and borrow against collateral, with liquidations triggered automatically when collateral value falls. It depends on price oracles and precise interest and liquidation math, which makes it one of the more demanding contracts to build and audit.; See also: DeFi (decentralized finance), Oracle, Oracle manipulation

M

Mainnet: The production network of a blockchain, where transactions are final and tokens have real value. Deploying to mainnet is the moment when bugs start to carry financial consequences, which is why audits and fixes are normally completed before it.; See also: Testnet, Audit, Code freeze
MEV (maximal extractable value): The value that block producers and specialized bots can capture by including, excluding or reordering transactions within a block, for example through front-running or sandwich trades. Protocol design choices determine how exposed users are to it.; See also: Front-running, AMM (automated market maker)
Move: A smart contract language designed around resources, assets that cannot be copied or silently destroyed, used by several recent blockchains. Its type system rules out some classes of errors by design, but business logic and access control still need independent review.; See also: Rust, Cairo, Access control
Multisig: A wallet or contract that requires several independent signatures, for example three out of five, before a transaction executes. It is commonly used to hold treasury funds and admin rights so that no single compromised key or person can act alone.; See also: Private key, Timelock, Access control

N

NFT (non-fungible token): A token that is unique and not interchangeable with another, usually implemented with the ERC-721 or ERC-1155 standard. NFTs record ownership of digital items, access rights or certificates; the associated file or asset is often stored outside the blockchain.; See also: ERC-721, ERC-1155, Token
nSLOC (normalized source lines of code): A count of source lines of code that excludes comments, blank lines and formatting differences, so that codebases can be compared fairly. Auditors estimate audit effort, and therefore duration and price, mainly from the nSLOC in scope, adjusted for language, complexity and readiness.; See also: Audit scope, Audit, Solidity

O

Oracle: A service that brings off-chain data, such as asset prices, interest rates or event results, onto the blockchain so smart contracts can use it. A contract is only as reliable as the oracles it trusts, so their design and fallback behavior are key review points.; See also: Oracle manipulation, Lending protocol, DeFi (decentralized finance)
Oracle manipulation: An attack in which the price or data a contract relies on is distorted, often by trading heavily in a thin market or with a flash loan, so the contract makes decisions on false values. Robust oracles, time-weighted prices and sanity checks reduce the risk.; See also: Oracle, Flash loan, AMM (automated market maker)

P

Private key: The secret number that proves control of a blockchain account and signs its transactions. Anyone who obtains it can move the account's assets and act with its privileges, so keys that administer smart contracts deserve strict custody, ideally through a multisig.; See also: Wallet, Multisig, Access control
Proof of concept (PoC): Code or a test that demonstrates a vulnerability can actually be exploited, usually by reproducing the attack in a test environment. A PoC removes doubt about a finding's impact and gives the developer a way to confirm that the fix works.; See also: Finding, Unit test, Severity

R

Re-audit: A follow-up review in which the auditor verifies the fixes the developer made in response to the findings of the first audit. It confirms whether each issue is resolved and checks that the fixes did not introduce new problems; it is not a full new audit.; See also: Audit, Finding, Independence rule
Reentrancy: A vulnerability where a contract calls an external contract before updating its own state, allowing the external contract to call back in and repeat an action such as a withdrawal. It is prevented by updating state before external calls and by using reentrancy guards.; See also: Access control, Finding, Static analysis
RFP (request for proposals): A formal request sent to several vendors, asking each to submit a proposal for the same defined need. On smart-contract.com, an RFP is built from the client's brief and requires quotes in an imposed format so they can be compared line by line.; See also: Brief, Audit scope, Independence rule
Rust: A general-purpose systems programming language used to write smart contracts (often called programs) on Solana and other non-EVM blockchains. It offers strong memory safety, but its blockchain frameworks follow their own account and security models, which require specific audit expertise.; See also: Move, Cairo, Solidity

S

Severity: The rating given to a finding according to its potential impact and likelihood, commonly critical, high, medium, low or informational. Severity helps teams prioritize fixes, although each auditor applies its own classification criteria.; See also: Finding, Audit report, Bug bounty
Smart contract: A program deployed on a blockchain that executes automatically according to its code when a transaction calls it. Once deployed, its logic is usually immutable and it can hold and move digital assets, which is why errors are costly and independent review matters.; See also: Blockchain, Solidity, Audit
Solidity: The most widely used programming language for smart contracts on the EVM, statically typed with a syntax close to JavaScript and C++. Because it has the largest pool of developers, auditors and tools, it serves as the baseline for audit effort estimates.; See also: EVM (Ethereum Virtual Machine), Vyper, nSLOC (normalized source lines of code)
Staking: Locking tokens in a smart contract, either to help secure a proof-of-stake network or to earn rewards within an application. Staking contracts handle deposits, reward calculations and withdrawal conditions, where rounding and timing errors are common sources of findings.; See also: Token, Finding, Invariant
Static analysis: Automated inspection of source code without executing it, to detect known vulnerability patterns, risky constructs and style issues. It is fast and useful before and during an audit, but it produces false positives and cannot understand business logic.; See also: Fuzzing, Audit, Formal verification

T

Testnet: A public test network that mirrors a blockchain's behavior but uses tokens with no value. Teams deploy there to test contracts, integrations and user flows in realistic conditions before going to mainnet.; See also: Mainnet, Unit test
Timelock: A contract that enforces a delay between the moment a sensitive action is scheduled, such as an upgrade or a parameter change, and the moment it can execute. The delay gives users and the team time to review the change and react if it is unexpected.; See also: Multisig, Upgradeable proxy, DAO (decentralized autonomous organization)
Token: A digital unit recorded and managed by a smart contract, which can represent a currency, an access right, a vote, a share of an asset or a unique item. Its behavior depends entirely on the contract that issues it, usually following a standard such as ERC-20 or ERC-721.; See also: ERC-20, ERC-721, Tokenization
Tokenization: Representing ownership of a real-world or financial asset, such as real estate, a fund share or an invoice, as tokens on a blockchain. Beyond the smart contracts, it involves legal structuring, investor eligibility rules and transfer restrictions that the code must enforce.; See also: Token, ERC-20, Access control

U

Unit test: An automated test that checks one function or behavior of a contract in isolation against an expected result. A thorough test suite documents intended behavior, catches regressions after fixes and makes an audit faster and more effective.; See also: Fuzzing, Invariant, Code freeze
Upgradeable proxy: A pattern where users interact with a proxy contract that forwards calls to a separate implementation contract, which can be replaced to upgrade the logic. It adds flexibility but also creates risks around storage layout, initialization and who controls upgrades.; See also: Access control, Timelock, Multisig

V

Vyper: A smart contract language for the EVM with a Python-like syntax. It deliberately restricts some features to keep code simple and easier to review. It is less common than Solidity, so fewer developers and auditors specialize in it.; See also: Solidity, EVM (Ethereum Virtual Machine)

W

Wallet: Software or hardware that stores the private keys controlling blockchain accounts and uses them to sign transactions. A wallet does not hold the assets themselves, which live on the blockchain; it holds the means to move them.; See also: Private key, Multisig

Describe your project once. Compare with confidence.

Get comparable quotes from vetted developers, then secure your code with an independent auditor.

Get quotes

Free for clients. No commitment.