Blockchain penetration testing is a security test in which specialists attack the off-chain parts of a web3 project, such as the dApp front end, APIs, back end, wallet integration, keys and infrastructure, the way a real attacker would. It complements a smart contract audit, which reviews the on-chain code line by line: the two answer different questions and are usually performed by different teams.
Many web3 projects commission only an audit and assume the whole product is covered. It is not. This guide explains what a web3 pentest covers, how it differs from an audit, what the terms "blockchain audit" and "crypto audit" usually mean, and how to choose a provider.
What blockchain penetration testing covers
A web3 pentest targets everything around the contracts that users and attackers can reach. The contracts may be flawless while a compromised front end, a leaked API key or an exposed node gives an attacker another way in. A typical scope includes:
- Front end and dApp: the web application users connect their wallets to, including injection flaws, cross-site scripting, dependency risks, content security policy and the integrity of what is displayed before a user signs.
- APIs and back end: authentication, authorization, rate limiting, business logic, indexers and any service that prepares transactions or stores user data.
- Wallet integration: how the application requests signatures, what it shows the user, how it handles networks and addresses, and whether a user can be tricked into signing something other than what they expect.
- Key management: where deployer, admin, operator and hot wallet keys live, who can use them, and how they are protected (hardware devices, multisig, vaults, access procedures). See private key in the glossary.
- Infrastructure and cloud: accounts, permissions, secrets, CI/CD pipelines, DNS and domain settings, and exposed services.
- Nodes and RPC: self-hosted nodes, RPC endpoints, validator or relayer machines, and the configuration that decides which data the application trusts.
Some firms also include social engineering or phishing simulations against the team, if the client asks for it and agrees on the rules in writing.
Web3 pentest vs smart contract audit
A pentest asks "how can an attacker get into this system?", while a smart contract audit asks "can this code be made to behave in a way its authors did not intend?". The table below summarizes the difference.
| Web3 pentest | Smart contract audit | |
|---|---|---|
| Target | Off-chain systems: dApp, APIs, back end, wallets integration, keys, cloud, nodes | On-chain code: the contracts in scope, at a fixed commit |
| Approach | Simulated attacks, black box, grey box or white box | Manual line-by-line review supported by tools |
| Typical tools | Web and API testing tools, infrastructure scanners, configuration reviews | Static analysis, fuzzing, invariant tests, formal verification |
| Main questions | Can an attacker take over accounts, keys, servers or what users see? | Can funds be stolen, locked or mispriced through the code? |
| Snapshot | Systems as configured during the test window | The code at a given commit hash |
| Deliverable | Pentest report with findings, evidence and remediation | Audit report with findings ranked by severity |
| Follow-up | Retest of fixed issues | Re-audit of fixes |
Both are point-in-time exercises. Neither guarantees the absence of vulnerabilities, and both lose value as soon as the code or the infrastructure changes significantly.
What "blockchain audit" and "crypto audit" usually mean
"Blockchain audit", "blockchain security audit" and "crypto audit" are loose terms, and providers use them for at least three different services. Clarify which one you need before asking for quotes.
- Protocol or node audit. A review of a blockchain's own software: consensus, networking, node client, virtual machine or cryptography. It concerns teams building a chain, a rollup or core infrastructure, and requires very specialized reviewers.
- Smart contract audit. The most common meaning: a security review of the contracts an application deploys on an existing chain. The smart contract audit service page describes this engagement.
- Security review of a crypto company. A broader assessment of an exchange, custodian, wallet provider or other crypto business: infrastructure, key custody, internal procedures, access control and often a pentest. It may also relate to compliance requirements, which depend on the jurisdiction and on the regulator involved; a specialized lawyer can tell you what applies to you.
A "crypto audit" can also mean a financial audit of reserves or accounts, which is a different profession altogether. When a partner or investor asks for "an audit", ask them which of these they expect.
When you need each
You usually need a smart contract audit before your contracts hold value, and a pentest before your application and infrastructure are exposed to real users. For most products, the right answer is both, scheduled at different moments.
- Only contracts, no custom application: a token or contract that users reach through existing tools needs an audit first; a pentest has little to test.
- A dApp with its own back end: audit the contracts, then pentest the application once it is close to its production configuration.
- Custody of keys or user funds off chain: key management and infrastructure become the main risk, and a pentest with a strong key management component is essential.
- Bridges, relayers, oracles or keepers: off-chain components sign or submit transactions, so both reviews matter. See cross-chain bridges.
- A crypto company preparing a partnership or listing: expect a broader security review, and ask the partner which reports they will read.
Order matters. Audit the contracts once the code is frozen, then run the pentest on the deployed stack, in staging or in production with agreed rules. The guide on the smart contract audit process details the audit side.
Deliverables to expect
A serious web3 pentest ends with a written report that someone outside the team can understand and act on. Ask for these items in the quote:
- Scope and rules of engagement: systems, environments, accounts, test window, what is forbidden and who to call in an emergency.
- Method: black, grey or white box, tools used, and what was tested manually.
- Findings ranked by severity, each with evidence, impact, reproduction steps and a recommended fix.
- An executive summary for non-technical readers, investors or partners.
- A retest of the fixed issues and an updated report, or at least a statement of its conditions and price.
- Confidentiality terms: how evidence, credentials and data accessed during the test are stored and destroyed.
How to choose a pentest firm
Choose a pentest firm on demonstrated web3 experience and method, not only on general security credentials. The criteria that matter:
- Web3 references: sample reports (redacted if needed) covering dApps, wallet flows and key management, not only conventional web applications.
- Named testers: who will actually do the work, and their experience with the chains and wallets you use.
- Clear scope and method: a quote that lists systems, environments and test type, rather than a generic package.
- Legal framework: a written authorization and rules of engagement before any test on production systems.
- Independence: no role in building or operating the systems under test. On smart-contract.com, the independence rule already prevents a company developing a project from auditing it.
The directory lists penetration testers alongside audit firms, with filters by blockchain and country. Vendors are vetted for legal existence, authority of the representative, verifiable references and a conflict of interest declaration. The guide on how to choose a smart contract auditor applies to the audit part.
What a pentest and an audit cost
The site has no public cost model for penetration tests, so this guide gives no pentest figures: the price depends on the number of systems, the test type and the depth requested, and only quotes against a precise scope are meaningful.
For the smart contract audit, the public indicative model gives orders of magnitude. At standard urgency, with partial tests and documentation, a 300 nSLOC Solidity token costs about 2,400 to 4,200 EUR with an independent auditor and 5,400 to 11,000 EUR with an established firm; a 1,500 nSLOC Solidity DeFi protocol about 4,800 to 8,400 EUR and 15,000 to 30,000 EUR respectively. A re-audit adds about 20%. Test your own case with the audit cost calculator, and read the guide on smart contract audit cost for every parameter.
Budget the two separately. They are different engagements, often with different providers, and one does not replace the other.
Key takeaways
- Blockchain penetration testing attacks the off-chain side of a web3 project: dApp, APIs, back end, wallet integration, keys, cloud and nodes.
- A smart contract audit reviews the on-chain code; a web3 pentest does not replace it, and the reverse is also true.
- "Blockchain audit" and "crypto audit" can mean a protocol audit, a smart contract audit or a security review of a crypto company: clarify before requesting quotes.
- Audit the frozen contracts first, then pentest the application in a configuration close to production.
- There is no public model for pentest prices; audit ranges come from the site's indicative model.
Frequently asked questions
Is a web3 pentest the same as a smart contract audit?
No. A smart contract audit reviews the contracts' code line by line to find flaws in logic, access control and flows of funds. A web3 pentest simulates attacks on the systems around the contracts: front end, APIs, back end, wallet integration, keys, cloud and nodes. A project with its own application and infrastructure usually needs both, often from different providers with different skills.
Do I need a pentest if my contracts are audited?
If users only reach your contracts through existing wallets and tools, an audit may be enough. If you run your own dApp, APIs, back end, relayers or hold keys that control the protocol, those systems are attack surfaces the audit did not cover. A compromised front end or admin key can cause losses even when the contracts themselves are sound.
How much does blockchain penetration testing cost?
The site has no public pricing model for penetration tests, so it gives no indicative figures. The price depends on the number of applications and systems in scope, the test type (black, grey or white box), the depth required and whether a retest is included. Describe the scope precisely and compare quotes built on the same basis.
What should I prepare before a pentest?
List the systems in scope with their environments, provide test accounts and documentation of the architecture, name a technical contact available during the test window, and agree on rules of engagement in writing, especially for production systems. Freeze major changes during the test, otherwise findings may no longer match what is deployed.
Can the same firm perform my audit and my pentest?
Yes, if it has both skills and has not built the systems it tests. Some firms offer both, others specialize in one. What matters is that the reviewers are independent from the team that developed the code and the infrastructure, and that each report states its scope clearly.
Need a smart contract audit, a pentest or both? Describe your project once and receive comparable quotes from vetted, independent providers, free for clients and without commitment until you choose.