A smart contract audit is an independent security review of your code before it holds real value: auditors read every line in scope, look for vulnerabilities and design flaws, and document what they find in a report. On smart-contract.com, you describe your project once and receive comparable audit quotes from vetted audit firms and independent auditors.
The service is free for clients and you commit to nothing until you choose a vendor. The platform does not perform audits itself: it prepares the brief, invites matching auditors, keeps quotes in one format and makes sure the auditor you hire has never developed the code.
What a smart contract audit covers
A security audit is a manual, in-depth review supported by tools. Its scope is a fixed version of the code, identified by a commit hash, and a defined list of contracts. A serious engagement usually includes:
- Manual review of the business logic, access control, flows of funds and upgrade paths, which is where the costliest flaws hide.
- Automated analysis: static analysis, fuzzing and invariant testing where the design allows it, and formal verification for critical components when the auditor offers it.
- Findings classified by severity, each with an explanation, a proof of concept where relevant and a recommended fix.
- An audit report you can share with investors, partners or users, published or kept private depending on the agreement.
- A re-audit of your fixes, so the final report reflects the code you actually deploy.
An audit reduces risk, it does not remove it. No auditor can promise the absence of bugs, and a report is only valid for the commit it reviewed. The guide to common smart contract vulnerabilities gives an overview of what auditors look for.
When you need an audit
Plan an audit before any deployment where a flaw would cost money, data or trust. Typical moments:
- Before the first mainnet launch of a token, NFT collection, staking contract or DeFi protocol.
- Before a significant upgrade, a new module or a deployment on an additional chain.
- When investors, an exchange or an institutional partner ask for an independent report.
- After a first audit, when the code has changed enough that the earlier report no longer describes it.
Book early. Auditors plan their calendars weeks ahead, and a start within one or two weeks costs more (see below). The code should be frozen, tested and documented by the time the review starts: the guide on how to prepare for a smart contract audit lists each step.
How it works on smart-contract.com
- Describe the project once. The guided request asks for the type of project, the language, the chains, the size of the code, the repository and your deadline. An AI drafts a specification (the brief) that every auditor quotes against. You review and edit it before submitting. The minimum budget of a request is 1,000 EUR or USD.
- Review and invitations. The platform reviews the request, then invites up to 6 matching auditors automatically, based on services, blockchains and languages.
- Comparable quotes. Every quote follows the same format: price, currency, duration, scope, team, and whether a re-audit is included. You compare them side by side. An AI assistant working for you only compares quotes, flags scope gaps and unusual prices, and never chooses in your place. You can message each auditor separately.
- Contract declaration. When you choose an auditor, the contract is declared and confirmed by both parties on the platform. The auditor pays a single 10% commission; you pay nothing to the platform. There is no escrow: you pay the auditor directly, on the terms you agree together.
Independence is enforced in the database
Under the independence rule, a company that holds a development engagement on your project can never be invited to, or engaged for, its audit or re-audit. The rule is applied by the database, not only by the interface. If your code was built through the platform, you can request an independent audit on the same project in one click once development is under way. The guide on developer and auditor independence explains why this matters.
What drives the price of an audit
An audit is priced on effort: auditor-days multiplied by a day rate. In the public indicative model behind the audit cost calculator, effort starts from the size of the code in nSLOC, then moves with:
- Language: Solidity is the baseline (factor 1.0); Move 1.25; Rust (Solana), Cairo and other languages 1.3.
- Project type: token 0.7, NFT 0.8, staking 1.0, DeFi 1.35, bridge or cross-chain 1.6.
- Readiness: good tests and documentation 0.9, partial 1.0, none 1.2.
- Risk factors: external integrations +10%, upgradeable contracts +10%, custom math +20%.
- Urgency: x1.25 to start within two weeks, x1.5 within a week.
- Re-audit: about 20% of the first audit's price.
The model also sets a minimum engagement of 3 auditor-days and prices two market tiers separately. Indicative ranges at standard urgency, with partial tests and documentation:
| Project | Independent auditors | Established audit firms |
|---|---|---|
| Token, 300 nSLOC, Solidity | 2,400 to 4,200 EUR | 5,400 to 11,000 EUR |
| DeFi protocol, 1,500 nSLOC, Solidity | 4,800 to 8,400 EUR | 15,000 to 30,000 EUR |
| DeFi protocol, 5,000 nSLOC, Solidity | 16,000 to 27,000 EUR | 49,000 to 95,000 EUR |
These are orders of magnitude, not quotes. The guide on smart contract audit cost details every parameter.
How to choose your auditor
Compare quotes on the same basis before you look at the total price:
- Effort: auditor-days and number of reviewers. A price far below the others usually means fewer days, not a faster auditor.
- Experience with your language, chain and type of protocol, shown by public reports you can read.
- Method: manual review, tools, fuzzing, formal verification where relevant.
- Report: severity scale, proofs of concept, publication terms.
- Re-audit: included or not, and within what time limit.
- Independence: no link with the team that wrote the code.
Independent auditors and boutique firms are typically two to three times cheaper than established firms in the model, and both can deliver serious work. Established firms are more often expected for protocols holding significant funds. Red flags include a quote that does not state the scope or commit, a promise that the code will be "100% secure", and pressure to shrink the scope to fit a budget. The guide on how to choose a smart contract auditor goes further.
Vendors on the platform are vetted: legal existence, authority of the representative, verifiable references and a conflict of interest declaration. You can browse audit firms in the directory, or penetration testers if you also need the off-chain side of your application tested.
Audits by blockchain
Auditors specialize by language and ecosystem, and the request matches them to your chain. Browse auditors and developers active on Ethereum, Arbitrum, Solana or Sui. Non-EVM chains take longer to review in the model, because tooling and reviewers are less abundant.
Get audit quotes
Have your code frozen, your tests running and your scope listed, then request audit quotes. You describe the project once, review the AI-drafted brief, and receive comparable quotes from up to 6 independent auditors. If your contracts are not written yet, start with smart contract development and plan the audit from day one.