Need Help Preparing for Your Smart Contract Audit?
Get expert guidance on selecting and preparing for a smart contract audit.
Curated List
Quick Take
A professional smart contract audit follows a structured timeline: T-8 weeks: Send RFP to 2-3 firms, T-6 weeks: Select firm, T-4 weeks: Code freeze and prepare documentation, Audit begins. During audit (2-4 weeks): auditors review code and ask questions. After audit (1 week): receive draft report. 2 weeks: remediation complete. 3 weeks: final report published. Minimum viable audit firms: Sigma Prime, Dedaub, Spearbit, Trail of Bits. Premium audit firms: Trail of Bits, Consensys Diligence, Certora (formal verification).
Audit Selection Process
Choose your audit firm based on: relevant protocol expertise (DeFi AMM auditors vs enterprise Fabric auditors), published reports in your category, timeline availability (leading firms have 4–12 week waitlists), and budget alignment.
Minimum viable audit firms (for contracts handling up to $5M TVL):
Sigma Prime
Dedaub
Spearbit (Cantina platform)
Trail of Bits (mid-range engagements)
Code4rena competitive audit
Premium audit firms (for $10M+ TVL protocols):
Trail of Bits
Consensys Diligence
Certora (formal verification)
Spearbit top researchers
Audit Timeline
T-8 weeks: Send RFP to 2-3 firms, request quotes
T-6 weeks: Select firm, sign engagement letter
T-4 weeks: Code freeze, prepare documentation package
T-0: Audit begins
During audit (2-4 weeks):
Auditors may send questions about architecture decisions
Daily/weekly sync calls depending on engagement
Audit end + 1 week: Receive draft report
Review findings, prepare responses
"We fixed this" vs "Accepted risk: [reason]"
+ 2 weeks: Remediation complete
Submit fixed code to auditor
Auditor verifies fixes (included in scope for reputable firms)
+ 3 weeks: Final report published
Publicly post on your website, GitHub, and link from protocol UI
What Auditors Look For
Manual review checklist:
1. Access control: every privileged function's authorization
2. Integer arithmetic: overflow/underflow, division ordering
3. Reentrancy: CEI pattern compliance, external call ordering
4. Oracle: manipulation resistance, staleness handling
5. Flash loan attack surface: same-block state consistency
6. Economic attack surface: price manipulation, governance attacks
7. Upgrade patterns: storage collision, initializer protection
8. Event completeness: all state changes emit events
Automated tools (auditors also use):
Slither: static analysis
Mythril/Echidna: symbolic execution and fuzzing
Halmos: formal verification of specific properties
After Receiving the Report
Critical findings (must fix before launch):
Any finding that could lead to fund loss or permanent protocol damage. Zero tolerance. Remediate and get auditor confirmation.
High findings (fix before launch):
Significant risk, less severe than Critical. All should be fixed. If not fixed: document the accepted risk and mitigation clearly.
Medium findings: Fix if possible, accept risk with documentation otherwise.
Low/Informational: Best practices; fix in V2 unless trivial to fix now.