What a smart contract audit costs — and why the quotes vary 1000x.
The same three words describe a $150 automated scan and a $150,000 engagement. Here is what sits behind each price, what actually drives a firm's number up, and how to work out which one your project needs.
The three price bands, and what each one buys
There is no single smart contract audit price because "audit" is not one product. It describes at least three different things that happen to share a name, and the price gap between them is not a discount — it is a difference in what is being delivered.
Automated audits: $150 to $500
A tool parses your Solidity, runs a detector suite over the AST, and produces a report. Because the cost is compute rather than salary, the price is low and the turnaround is minutes. What you get is complete coverage of the known: reentrancy, access control, arithmetic, delegatecall, randomness, centralization, gas waste, standards compliance. What you do not get is anyone thinking about your protocol's design.
Boutique manual audits: $5,000 to $30,000
One to three engineers read your code for one to three weeks. This is where economic reasoning enters: someone models what happens if the oracle lags, if a whale enters and exits in the same block, if governance is captured. Most quotes at this tier include one re-review after you ship fixes. The variance inside the band is mostly headcount and calendar.
Tier-one firms: $50,000 and up
The recognised names, whose logo on your README is itself part of what you are buying. You get a larger team, a longer engagement, formal methods on the critical paths, and a report that exchanges and institutional investors already know how to read. You also get a queue: booking six to twelve weeks out is normal, which for a lot of teams is the real cost.
What actually moves a quote
When a firm sends you a number, it was built from five inputs. Knowing them lets you argue with the quote instead of just accepting it.
| Driver | Cheap end | Expensive end |
|---|---|---|
| Size | One contract, a few hundred lines | A protocol of 20+ contracts and shared libraries |
| Novelty | A fork of a battle-tested standard | A new AMM curve, a new lending model, anything unprecedented |
| External surface | Self-contained, no outside calls | Oracles, bridges, and composability with protocols you do not control |
| Upgradeability | Immutable, deploy once | Proxies, which means auditing the logic and the upgrade path |
| Turnaround | You fit their calendar | You need it next week |
Two of these you can change for free. Clean up before you submit — dead code, unused imports, and unresolved TODOs all get billed at audit rates if a human has to read past them. And run an automated pass first, so the obvious findings are already fixed and the engineers you are paying by the week start on the problems only they can solve.
Is a cheap smart contract audit a false economy?
It depends entirely on what you claim afterwards. A $150 automated audit that finds a missing onlyOwner on your mint function has returned its cost several thousand times over. The same audit, described to your community as "we are audited" with no further qualification, is worse than useless — it converts a real but narrow assurance into a false broad one, and when something breaks, that gap is the thing people will be angriest about.
The right question is not "is this audit cheap?" but "what does this audit actually claim, and am I repeating that claim honestly?"
For a token with standard mechanics, an NFT mint, or a staking contract that follows a well-worn pattern, automated coverage plus a careful internal review is a proportionate answer. For a protocol holding other people's deposits with a design nobody has shipped before, it is not, at any price. The comparison of audit companies goes through where the line sits.
Our pricing, and what each tier includes
Every plan is a one-off audit — there is no subscription and no per-seat billing.
| Plan | Price | Scope | Included |
|---|---|---|---|
| Starter | $150 | 1 contract | 20+ static detectors, SWC + OWASP coverage, summary PDF |
| Pro | $250 | Up to 5 contracts, or a project .zip | Everything in Starter, plus AI deep analysis, attack paths, code map, gas findings |
| Enterprise | $350 | Unlimited contracts | Everything in Pro, plus Slither, proxy resolution, combined PDF, re-audit after fixes |
| Testnet scan | Free | Any testnet contract | Full static engine, watermarked report, no account required |
The re-audit on Enterprise is the line worth noticing. Fixing findings changes the code, and changed code is unaudited code — a report that describes a commit you have since edited is a document about the past. Any pricing comparison that ignores whether re-review is included is comparing different products.
Choosing without overthinking it
- Pre-launch, standard mechanics, small budget — run the free testnet scan, fix everything it finds, then buy Starter or Pro on mainnet for the record.
- Live contract, real TVL, no audit yet — Enterprise, for the proxy resolution and the re-audit, then budget for a manual review.
- Novel protocol taking deposits — automated first to clear the ground, then a firm. Use the automated report to shorten their engagement, not to replace it.
- Evaluating someone else's contract before investing — Starter on the deployed address. The centralization findings alone usually answer the question.
Frequently asked questions
How much does a smart contract audit cost?
It depends almost entirely on who does it. An automated audit costs $150 to $350 per contract and finishes in minutes. A boutique manual audit typically runs $5,000 to $30,000. A top-tier firm auditing a full protocol commonly quotes $50,000 to $150,000 or more, and books weeks out. All three are called "an audit", which is why quotes look so wildly inconsistent until you ask what is actually being delivered.
Why are smart contract audit quotes so different from each other?
Because you are buying human hours, not a product. A firm prices by engineer-weeks: lines of code, how novel the design is, how many external protocols it touches, whether they must model economic attacks, and how many re-review rounds are included. An automated audit prices by compute, which is why it is two orders of magnitude cheaper and also why it covers a narrower set of problems.
Is a cheap smart contract audit worth anything?
A cheap automated audit is worth a great deal for what it covers: every known bug class, every standards gap, every centralization lever, found deterministically. It is worth nothing as a substitute for expert review of novel economic design. The failure is not buying a cheap audit — it is buying a cheap audit and telling your users you have been audited, full stop.
What makes an audit quote go up?
Size (lines of code and number of contracts), novelty (a fork of a known protocol is cheaper to review than a new AMM design), external surface (oracles, bridges, and other protocols you compose with), upgradeability (proxies double the review), and turnaround (a rush job costs more). Ask any firm to break their quote down by these and the number stops looking arbitrary.
Do you charge per contract or per audit?
Per audit. Starter is $150 for a single contract, Pro is $250 for up to five contracts or a full project .zip, and Enterprise is $350 for unlimited contracts with Slither, proxy resolution and a re-audit after fixes. There is no subscription — every plan is a one-off.
Can I see the quality before I pay?
Yes. Testnet scans are free and need no account, and sample reports are downloadable from the home page. Run the engine on a contract whose bugs you already know and compare the output to what you expected — that tells you more than any pricing page.
Get a real number for your contract
Run the engine on your code and see the findings before you decide what depth of review you need.
Start audit