A smart contract audit typically costs from a few thousand euros for a small token contract to several tens of thousands of euros for a DeFi protocol, and more for large or cross-chain systems. The price is essentially the number of auditor-days the code requires multiplied by the day rate of the auditors. The figures below come from the public indicative model used by the smart-contract.com calculator: they are orders of magnitude, not quotes, and the real price always depends on the scope you submit.
How an audit price is calculated
An audit is priced on effort: the number of auditor-days needed to review the code in depth, multiplied by a day rate. Auditors estimate that effort from the size of the code, then adjust it for everything that makes the review slower or riskier.
The indicative model follows the same logic:
- Effort in auditor-days = code size / reviewer throughput, multiplied by a language factor, a project type factor and a readiness factor, then increased by any risk factors.
- Minimum engagement: 3 auditor-days, even for very small contracts, because setting up, understanding the design and writing the report take time regardless of size.
- Price = auditor-days x day rate, then adjusted for urgency.
Code size is measured in nSLOC (normalized source lines of code), which counts meaningful lines and excludes comments, blank lines and formatting. It is a fairer measure than raw line counts, and it is the first figure an auditor will ask you for.
Indicative price ranges
For a mid-sized Solidity protocol, the model gives a range of about 4,800 to 30,000 EUR depending on the type of auditor. The table below shows three reference cases, all at standard urgency, with partial tests and documentation, and no additional risk factor.
| Project | Independent auditors | Established audit firms |
|---|---|---|
| Token, 300 nSLOC, Solidity | 2,400 to 4,200 EUR (minimum engagement) | 5,400 to 11,000 EUR (minimum engagement) |
| DeFi protocol, 1,500 nSLOC, Solidity | 4,800 to 8,400 EUR (about 6 auditor-days) | 15,000 to 30,000 EUR (about 8.5 auditor-days, 2 weeks) |
| DeFi protocol, 5,000 nSLOC, Solidity | 16,000 to 27,000 EUR | 49,000 to 95,000 EUR (2 auditors, about 3 weeks) |
These ranges are indicative. To estimate your own project, enter your nSLOC, language, project type and readiness in the audit cost calculator. Whatever the result, budget the audit on top of development: it is a separate engagement with a separate provider.
What drives the price
The size of the code is the main driver, but six other factors can move the price significantly. Each one increases or reduces the number of auditor-days.
Size in nSLOC
Throughput is the number of nSLOC an auditor can review properly in one day. In the model, it is 350 nSLOC per auditor-day for independent auditors and boutique firms, and 250 nSLOC for established firms, which apply deeper review with more reviewers per line. Doubling the code roughly doubles the effort.
Language
Solidity is the baseline because tooling, known vulnerability patterns and reviewer experience are the most mature. Other ecosystems take longer to review:
- Solidity: factor 1.0
- Move: 1.25
- Rust (Solana), Cairo and other languages: 1.3
Project type and complexity
The type of protocol reflects how much value and logic is at stake. A standard token is simpler than a lending market with liquidations.
- Token: 0.7
- NFT: 0.8
- Staking or vesting: 1.0
- DeFi (AMM, lending, derivatives): 1.35
- Bridge or cross-chain: 1.6
Readiness
Readiness means the quality of your tests and documentation. With good coverage and a clear specification, auditors spend their time looking for flaws rather than reconstructing intent.
- Good tests and documentation: 0.9
- Partial: 1.0
- None: 1.2
Risk factors
Some design choices add review work on their own, and each one is added to the effort:
- External integrations (oracles, other protocols): +10%
- Upgradeable contracts: +10%
- Custom math (pricing curves, interest models, fixed-point arithmetic): +20%
Urgency
Auditors plan their calendars weeks ahead. Asking for an earlier start has a direct cost in the model: x1.25 to start within two weeks, x1.5 to start within a week.
Re-audit
After the audit, your developers fix the findings and the auditor verifies the fixes. This re-audit is priced at about 20% of the first audit in the model. Include it in your budget from the start, because a report without verified fixes is incomplete.
Independent auditors vs established firms
Independent auditors and boutique firms are typically two to three times cheaper than established firms for the same code, and both can deliver serious work. The difference lies in method, capacity and what the report represents.
Independent auditors:
- Day rates of 800 to 1,400 EUR (900 to 1,500 USD) per auditor in the model.
- Faster throughput (350 nSLOC per day), often a single senior reviewer.
- A good fit for tokens, NFT collections, staking contracts and well-scoped protocols, or as a second, independent review.
Established audit firms:
- Day rates of 1,800 to 3,500 EUR (2,000 to 3,800 USD) per auditor in the model.
- Deeper review (250 nSLOC per day), several reviewers, internal cross-checks and a formal process.
- More often expected by investors, exchanges or institutional partners for high-value protocols.
The right choice depends on the value at risk, the complexity of the code and who will read the report. For a protocol that will hold significant funds, several complementary reviews are common practice. In every case, the audit must be performed by a provider that has not developed the code: a team cannot credibly review its own work.
How to reduce the cost without reducing quality
The most effective way to lower an audit price is to reduce the time auditors lose, not the time they spend reviewing. Four measures make a measurable difference.
- Freeze the code. Submit a fixed version identified by a commit hash, and stop changing it during the audit. Every change mid-review forces auditors to re-read code and can invalidate their conclusions.
- Deliver solid tests. Unit tests, fuzzing and invariant tests show how the code is meant to behave. In the model, moving from partial to good readiness reduces effort by 10%, and moving from none to partial avoids a 20% increase.
- Document the design. A short specification describing roles, permissions, flows of funds, assumptions and known limitations saves auditors hours of reverse engineering.
- Define a clear scope. List exactly which files and contracts are in scope, which dependencies are trusted, and which are excluded. Remove dead code and test helpers from the scope. A precise scope also makes quotes comparable.
Other useful habits: run static analysis tools yourself and fix the obvious issues before the audit, and book the audit early to avoid urgency surcharges. The guide on how to prepare for a smart contract audit details each step.
What you should not do is shrink the scope artificially, remove critical contracts from it, or ask for fewer auditor-days than the code requires. These choices lower the invoice and the value of the audit at the same time.
Why the cheapest quote is not always the best
A quote that is far below the others usually means fewer auditor-days, not a more efficient auditor. Since the price is effort multiplied by a day rate, a very low price for a large codebase implies a review that cannot cover everything in depth.
Before choosing, compare quotes on the same basis:
- Auditor-days and number of reviewers, not only the total price.
- Scope: the same files, the same commit, the same exclusions.
- Re-audit: included or billed separately, and within what time limit.
- Method: manual review, automated tools, fuzzing, formal verification where relevant.
- Report: severity classification, proof of concept for findings, public or private publication.
- Independence: no development engagement on the same project.
A higher quote is not automatically better either. The goal is a price that matches the effort your code objectively requires. And no audit, whatever its price, guarantees the absence of bugs: it reduces risk, it does not remove it. Bug bounties, monitoring and careful deployment remain necessary after the audit.
Key takeaways
- An audit costs auditor-days x day rate: from about 2,400 EUR for a small token with an independent auditor to 95,000 EUR or more for a large DeFi protocol with an established firm, in the site's indicative model.
- Size in nSLOC drives the price first, followed by language, project type, readiness, risk factors, urgency and the re-audit (about 20% more).
- Independent auditors are typically two to three times cheaper than established firms; the right choice depends on the value at risk and who will rely on the report.
- Frozen code, good tests, clear documentation and a precise scope reduce cost without reducing quality.
- Always budget the audit and the re-audit on top of development, and never have code audited by the team that wrote it.