Smart contract audit companies: how to tell them apart.
Every audit firm's site says the same things. This page is about the questions that actually separate them, what each tier of provider is genuinely good at, and how to spend the least money for the most real assurance.
The four kinds of provider
Smart contract audit firms are not one category. The label covers four business models with different economics and different blind spots. Matching the model to your situation matters more than picking the best-regarded name in a category you did not need.
Tier-one firms
Large, well-known security houses with a queue. You are buying deep review, formal methods on critical paths, and — candidly — the reputational weight of their name on your README, which exchanges and institutional investors recognise. The costs are money and calendar: six figures is normal for a protocol, and booking six to twelve weeks out is standard. For a protocol that will hold significant third-party deposits, this is the right answer and there is not a clever way around it.
Boutique audit shops
Small teams, often two to five engineers, frequently specialists in one domain — DeFi mechanics, NFT standards, bridges. The good ones are excellent and cost a fraction of tier one. The variance is much wider, so due diligence matters more here than anywhere else. This is where reading their published reports is not optional.
Audit marketplaces and contests
Competitive platforms where many researchers review your code for a prize pool. Very effective at breadth, and genuinely good at surfacing the unusual bug that one reviewer would have missed. Less suited to producing the single authoritative document some counterparties want, and the quality of triage varies.
Automated audit engines
Tools rather than firms. They run a detector suite over your code and return a report in minutes for a fixed low price. Complete on the known and structural, silent on design. That is the category this site is in, and the automated audit page is explicit about where the ceiling is.
Five questions that expose a weak auditor
Ask these before you ask about price. They sort the top smart contract auditors from the merely well-marketed faster than any comparison table.
- "Can I read two recent full reports?" Not summaries, not a marketing PDF — complete reports with findings, severities, code locations and the client's responses. A firm that cannot show you this is asking you to buy a document sight unseen.
- "Has anything you audited been exploited, and what did you say about it?" Everyone with a real track record has one. The answer you want is a specific, unflinching post-mortem. "No" usually means a short history, not a perfect one.
- "Who specifically is doing the work?" Named engineers, with their background. Some firms sell on senior reputations and staff on juniors.
- "What is out of scope?" A good auditor volunteers this — off-chain components, admin key management, oracle assumptions, economic modelling. An auditor who implies everything is covered is either careless or selling.
- "Is a fix review included, and does the final report cover the deployed commit?" If not, the report describes code you have since changed.
Which one you actually need
| Your situation | Sensible choice | Rough spend |
|---|---|---|
| Token or NFT with standard mechanics | Automated audit, plus careful internal review | $150–$250 |
| Staking or vesting, moderate TVL | Automated audit, then a boutique firm | $5k–15k |
| Novel DeFi protocol taking deposits | Automated first, then tier one, then a bug bounty | $50k+ |
| Bridge or cross-chain messaging | Tier one, plus a contest. Do not economise here | $100k+ |
| Checking a contract before investing in it | Automated audit on the deployed address | $150 |
Why running both is cheaper than running one
Manual audits are billed in engineer-weeks. Every hour a senior engineer spends finding a floating pragma, an unchecked return value or a missing zero-address check is an hour billed at expert rates for work a tool does in seconds and does not get bored doing.
Run the automated pass first, fix everything it finds, and hand the firm a clean codebase. You will get a shorter engagement, a cheaper quote, and a report that spends its pages on the problems only humans can find.
This is also the honest answer to "can I skip the firm?" — for standard mechanics, often yes; for novel design holding other people's money, no, and no tool vendor who tells you otherwise is being straight with you. The cost breakdown works through where the line falls for different budgets.
Where this site fits
EVM Smart Audit is the automated layer: 20+ static detectors, an optional Slither pass, and an AI review for business-logic traps, graded against SWC and OWASP and delivered as a report you can hand to somebody. It is fast, it is a fixed low price, and it is honest about its ceiling.
Use it as the first pass before a firm, as the standing check between engagements when your code changes, or as the whole answer for contracts whose mechanics are well-trodden. Testnet scans are free, so you can judge the output before spending anything.
Frequently asked questions
What separates the best smart contract auditors from the rest?
Published work you can check. The strongest auditors put their reports in public, disclose findings they missed when an incident happens later, and describe their methodology specifically enough to argue with. Weak ones lead with client logos and a score out of 100. Ask for two recent full reports before you ask for anything else.
Should I use an audit company or an automated audit tool?
Both, in that order — automated first, because it is cheap and fast and clears every known bug class, then a firm for the design questions a tool cannot reach. Running the automated pass first also makes the manual engagement cheaper, since you are not paying engineers by the week to find a floating pragma.
How do I verify an audit firm is legitimate?
Read a full report they published, not a summary. Check that findings have severities, code locations and client responses. Look for whether they audited anything that was later exploited, and what they said about it — an honest post-mortem is a better signal than an unbroken record. Confirm the engagement includes a re-review after fixes.
What should an audit engagement include?
A defined scope with commit hashes, a report with severity and likelihood per finding, a fix-review round after you remediate, and a final report that reflects the code you actually deploy. If re-review is not included, you will be shipping code that no report describes.
How much do audit companies charge?
Boutique firms commonly quote $5,000 to $30,000; tier-one firms auditing a full protocol usually start around $50,000 and go well past six figures. Automated audits sit at $150 to $350. The pricing page breaks down what drives those numbers.
Is EVM Smart Audit an audit company?
No, and it is worth being clear about it. This is an automated auditing engine — static analysis, Slither and an AI review that produce a report in minutes. It replaces the first week of a manual engagement, not the engagement. For a novel protocol holding other people’s deposits, hire humans as well.
Clear the ground before you hire anyone
Run the automated pass, fix what it finds, and take a clean codebase to whichever firm you choose.
Start audit