What is a smart contract audit?

A smart contract audit is an independent security review of the code behind a blockchain application. Because smart contracts often hold money and are hard to change once deployed, a bug can be costly. Ethereum.org estimates that losses from smart contract security defects are easily over $1 billion. Projects hire auditors to find problems before users deposit funds.

What does a smart contract auditor do?

OpenZeppelin, a security firm that says it has carried out more than 1,000 audits, described its process in January 2025. The main stages are:

• Scoping. Auditors and the project agree on exactly which code and which version will be reviewed, and read the documentation.
• Manual review. At least two auditors go through the same code line by line, checking access controls, custom logic and unusual edge cases.
• Automated testing. Tools scan for known bad patterns, and fuzz testing throws random inputs at the code to see what breaks.
• Reporting. A private report lists each issue with a severity level, from Critical and High down to Low and Informational, plus suggested fixes.
• Fix review. The project fixes the issues, auditors check the changes, and a final report is issued, which the project may publish.

Ethereum.org notes that an audit is one layer among several. Others include thorough testing, bug bounties that pay outside researchers to report flaws, formal verification that mathematically checks code against a specification, and controls such as multisig wallets and timelocks.

How much does a smart contract audit cost?

There is no standard price. The Security Alliance (SEAL), a nonprofit security group, gives rough figures in its framework for security reviews: about $1,000 to $60,000 per week of auditor time, depending on complexity and the auditor's experience. It estimates that projects under 1,000 lines of code take one to two weeks, those of 1,000 to 4,000 lines two to five weeks, and larger ones five weeks or more. Size, complexity, deadlines and the auditor's reputation all push the cost up or down. These are estimates and vary by firm.

Are audited contracts safe?

Not necessarily. Ethereum.org warns that audits are not a silver bullet and will not catch every bug. SEAL lists what an audit does not promise:

• It does not certify the code as bug free or fully secure.
• It covers only the version reviewed. Any later change is unaudited.
• It is not a substitute for monitoring, incident response plans and ongoing security work.

So the word "audited" on a project's website tells you less than it seems. It helps to check who did the audit, whether the report is public, how serious the findings were, whether they were fixed, and whether the deployed code matches the version reviewed. These checks fit into wider steps for researching a crypto project. For how attacks happen despite reviews, see how crypto gets hacked.