Core engagement · From $3,000 · 1–3 weeks
Smart Contract Security Audit
Two researchers read every in-scope line against a written threat model, then prove what they find. You get a findings register with severities, a runnable exploit for each Critical and High, specific remediation guidance, and a verification pass after you fix.
An audit is not a scan. It is a time-boxed adversarial reading of your code by people whose job is to think like the person who wants your users' money — and then to prove they could take it.
We start by writing down what the system is supposed to guarantee: who may do what, which contracts are trusted, what happens at every external boundary, and which assets are at risk. Almost every serious finding is a gap between that document and the code. Teams routinely tell us the threat model surfaced disagreements inside their own engineering team before we found a single bug.
Then two reviewers read the scope independently. Independence matters: once you have read a contract with one mental model, you stop seeing the paths that model excludes. Reconciling two separate reads catches materially more than two people reading together.
Scope of review
What we look at, and what we're looking for.
Value flow & accounting
Every path where value enters, moves or leaves. Share maths, fee accrual, rounding direction, decimal handling, and what happens with fee-on-transfer or rebasing tokens.
External call surface
Every call to code you do not control, asked from the callee's perspective: what if it re-enters, reverts, returns garbage, consumes all gas, or is a malicious token?
Access control & privilege
Role design, modifier coverage, initialiser safety, two-step ownership, and what a compromised or careless admin key can actually do.
State machines
Every reachable state and transition, including the ones your tests never construct — paused mid-operation, partially initialised, or reached out of order.
Arithmetic & precision
Unchecked blocks, casts, division-before-multiplication, share-price inflation, and the rounding directions that leak value over many transactions.
Deployment & upgrade path
Constructor arguments, deployment scripts, storage layout compatibility, and whether the upgrade you plan is safe against the storage you have.
In practice
What a finding looks like in the report
Code on this page is written to illustrate a technique or a finding class. It is not taken from any client engagement.
// ILLUSTRATIVE — the shape of a finding, not client code
// H-02 Missing initializer guard on an upgradeable implementation
contract Vault is UUPSUpgradeable {
address public owner;
// VULNERABLE: callable by anyone, on the implementation
// contract as well as through the proxy.
function initialize(address _owner) external {
owner = _owner;
}
// FIXED
function initialize(address _owner) external initializer {
require(_owner != address(0), "zero owner");
__UUPSUpgradeable_init();
owner = _owner;
}
// Also required: _disableInitializers() in the constructor,
// so the implementation itself can never be initialised.
constructor() { _disableInitializers(); }
}A standard smart contract audit starts from $3,000. Price is driven by lines of code, complexity, the number of external integrations and how many privileged roles exist — not by contract count alone. A 400-line token is a different engagement from a 400-line perpetuals margin engine. Use the quote estimator for a range, then send the repo for a fixed quote.
One to three weeks for a standard engagement, plus two to five days for remediation verification after your fixes land. The manual review is 40–60% of the calendar time; the rest is tooling, PoC development and writing. Rush engagements are possible at a premium when researcher capacity allows.
An executive summary, the threat model and trust assumptions, every finding with severity, impact, likelihood, location and a proof of concept where applicable, and remediation guidance specific to your code. You receive it as PDF and Markdown, plus the findings register as JSON so you can import it into your own tracker.
Yes, and it is included — not an upsell. We re-review every changed line, re-run each proof of concept and the invariant suite, and mark every finding Fixed, Acknowledged or Open in a final report you can publish.
The repository at a fixed commit, the list of in-scope contracts, whatever documentation exists, your external integrations, the privileged roles and who holds them, and your target deployment date. Scoping is free and takes under two working days.
Yes. We review the deployed bytecode against the repository, check the upgrade path and admin keys, and prioritise findings by what is exploitable right now rather than by textbook severity — because on a live system, what you can actually fix without a migration matters.
Related
Often scoped alongside this.
From $3,000
Send the repo. Scoping is free.
Under two working days to a written scope, a fixed quote and a review plan.