Smart Contract Audit FAQ

A security review of the code that controls funds on a blockchain. It looks for ways a caller could take money, freeze it, or gain rights they should not have, and reports each finding with a severity, the exact line, and a fix.

Deployed contract code usually cannot be patched, it is public, and it holds money. A bug found after launch is often permanent, and attackers read the source too. An audit is the cheapest point to find the problem.

Reentrancy, access control, tx.origin authorization, unchecked arithmetic, unsafe delegatecall, unchecked call return values, weak randomness, timestamp dependence, unbounded loops, centralization, and gas waste — 20 detector classes, graded against 22 SWC Registry and OWASP Smart Contract Top 10 items.

No. An audit reduces risk by finding the known and detectable classes of bug. It cannot prove there are none, and it cannot fix a flawed economic design. Treat a report as evidence about one version of the code at one point in time.

The SWC Registry is a long-standing catalogue of Solidity and EVM weaknesses that can be decided from the code. The OWASP Top 10 is a shorter list ordered by real-world loss, and adds categories such as oracle manipulation and flash-loan attacks. Every report shows both.

Here, $150 for one contract, $250 for up to five, and $350 for unlimited contracts with Slither and a re-audit. Manual firms typically charge $5,000 to $30,000, and tier-one firms start around $50,000.

Yes. Address scans on any supported testnet are free and need no account. They run the full static detector suite and return a watermarked PDF. Mainnet audits are the paid product.

Minutes for an automated audit: the source is fetched, analysed by the static engine, Slither and the AI pass, and rendered into a PDF. A manual audit by a firm usually takes one to four weeks.

No. Every plan is a one-off payment for one audit. You pay again only if you want another audit, for example after changing the code.

Paste a verified contract address and pick its chain, paste Solidity directly, or upload a .sol file or a project .zip. Everything runs on the server; there is nothing to install.

Every major EVM network — Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, Linea and more — plus Danny Chain, VORA Chain, Dancore and eight testnets.

Not by address, because the source cannot be read from the explorer. Paste the Solidity or upload the project instead, or verify the contract on the explorer first — it is free and takes a minute with Hardhat or Foundry.

Yes. When an address is a proxy, the implementation is resolved and both are audited and labelled separately. Auditing the proxy alone says almost nothing about the logic users actually call.

The 0.4 to 0.8 line. The compiler version is read from the verified source, because several findings depend on it — unprotected arithmetic is a real bug on 0.7 and noise on 0.8.

Yes — ERC-721, ERC-1155 and their common extensions. The audit focuses on how mints fail: supply caps, allowlist replay, reentrancy through safeMint, reveal randomness, and owner powers over metadata.

A risk gauge, severity breakdown, the standards coverage grid, and one entry per finding with the affected code, an attack-path diagram and the fix. It comes in three styles: summary, detailed, and a combined PDF.

Critical: funds can be taken now, by anyone. High: serious loss under a specific condition. Medium: real impact in narrower cases. Low: limited impact. Informational: hygiene and gas. Three mediums can chain into one critical, so read them together.

Yes. Share links give private read access and can be revoked. You can also publish a summary to a public verification page with an embeddable badge; findings stay private.

For known bug classes and standards coverage it is more complete, because it never skips a check. For novel economic design and cross-protocol risk it is not a substitute for a human expert. Run the automated pass first, then a firm for the design questions.

Yes. Fixing findings changes the code, and changed code is unaudited code. A report describing a version you have since edited is a document about the past. The Enterprise plan includes a re-audit after fixes.