What is smart contract audit?

A paid review in which a security firm reads a protocol's code and reports the flaws it finds, usually before deployment.

An audit is a snapshot of one version and does not certify that code is safe, and audited protocols have still been exploited. Read the report itself, including which contracts were out of scope. See smart contract.

The word appears constantly in project marketing, usually as a badge rather than as a document. A badge saying "audited" with no link to a report is worth nothing, and it is the most common form the claim takes.

How it works

An engagement starts with a scope: a specific set of contracts at a specific commit. The firm reads the code, models what an attacker with money and patience could do, and produces findings graded by severity. The project then fixes what it chooses to fix, and the firm usually verifies the fixes and publishes a final report.

Four things in that process are where the value actually sits, and all four are visible in the report.

Scope. Contracts left out of scope were not reviewed. Protocols routinely audit the core and omit the periphery, and exploits have come through the periphery.

Commit hash. The report covers one version. Code deployed later, including an upgrade through a proxy contract, is unreviewed unless separately audited.

Resolution status. A finding marked "acknowledged" was not fixed. The project accepted the risk, which may be reasonable and is certainly worth knowing.

Administrative powers. Good reports document who can pause, upgrade, or drain, because those powers are not bugs and will never appear as findings.

Some projects supplement audits with a bug bounty and with formal verification of specific properties. Neither is a substitute for the others, and none of them prove the absence of flaws.

Example

Illustrative report shape. A firm reviews eleven contracts at one commit and reports two high-severity findings, five medium, and nine informational. The project fixes both high findings and three of the mediums, and acknowledges the rest. The deployed system then adds a twelfth contract that was written after the review. What the badge on the website says is "audited". What the report says is that eleven of twelve contracts, at an earlier version, were reviewed and that two accepted risks remain open. Those are very different statements, and only one of them is on the marketing page.

Why it matters when you buy

This bears on decentralized venues and on tokens whose value depends on a protocol continuing to work. Buying an asset on a centralized exchange does not expose you to its contracts directly, though a protocol failure still moves the price. The guide on verifying a token contract covers checking what you are actually interacting with.

Related terms

• smart contract — what is being reviewed
• reentrancy — a classic finding class
• proxy contract — how audited code gets replaced
• upgradeable contract — the power an audit should document
• rug pull — the outcome an audit cannot prevent
• honeypot token — a contract designed to pass a glance

Questions

Does an audit mean a protocol is safe?

No. It means specific code was reviewed at a specific point by people who found what they found. Protocols with several audits have still lost user funds.

Who pays for the audit?

The project being audited, which is a structural conflict the industry lives with. It makes the published report, with its scope and unresolved findings, more informative than the firm's name.

Is a bug bounty a substitute?

It is a different tool. A bounty pays for flaws found after deployment by anyone, an audit pays for a focused review before it. Serious protocols run both. See smart contract.