A smart contract audit is an independent security review of a contract's code, design and assumptions, carried out before deployment to find vulnerabilities the developers missed. Ethereum.org calls it one way of conducting an independent code review and warns that audits "won't catch every bug," per its smart contract security page. The same page estimates that value stolen or lost to smart contract defects is easily over $1 billion.
​

This page covers how a security audit runs from scope to fix review, the main audit formats, what audits cost based on figures auditors publish themselves, and the tools that do the automated part of the work. Every claim comes from ethereum.org, the auditors' own pages or the tools' repositories, fetched on October 13, 2026.
​

An audit checks whether a contract does what its specification says and nothing else an attacker could exploit. Reviewers look at access control, upgrade paths, external calls, oracle use and economic assumptions, not just syntax. The output is a report of findings ranked by severity, with recommended fixes for each.
​

Trail of Bits, which publishes its methodology, says most catastrophic blockchain failures live in architecture layers such as upgrade paths, access control, oracle integration, governance and cross-chain message flow rather than in inner contract logic, per its blockchain services page. Classic code-level bugs still matter: ethereum.org walks through reentrancy, where a balance is not zeroed until after an external call, which lets an attacker withdraw repeatedly, on its security page. That page cites the 2016 DAO hack, in which 3.6 million ETH was stolen.
​

Most firm-led audits follow five stages: scope and threat model, design review, implementation review with tooling, invariant testing, then reporting and fix review. The client freezes a commit, the auditors work against that exact code, and the team fixes findings before a final retest.
​

The stages are taken from the engagement outline on the Trail of Bits blockchain page, which says its written report gives severity, difficulty and an exploit scenario for every finding, and that it re-tests patches when the work returns. Ethereum.org adds the client's side of the job: document the code with NatSpec, run analysis tools before every merged pull request and arrive with tests, so auditors spend their time on logic rather than basics, per its security guidance.
​

Audits come in four common formats: a private engagement with one firm, a competitive audit contest open to many researchers, a collaborative audit that mixes the two, and a bug bounty after launch. Formal verification is a separate technique that proves specific properties rather than searching for bugs.

Ethereum.org recommends sizing bug bounty payouts in proportion to the funds at stake, an approach it calls the scaling bug bounty, per its security page. Several firms now add AI review: Sherlock markets an Audit Engine that coordinates AI security approaches against client code, per Sherlock.
​

Most audit firms do not publish rate cards; they quote per engagement after scoping. Cost tracks the amount and complexity of code, the number of reviewers and the number of weeks. The clearest public price signals are contest prize pools and published effort data, which give a realistic range.
​

Private firms ask for a quote: OpenZeppelin's audit page directs buyers to talk to a security expert, per OpenZeppelin, and Trail of Bits uses a request-a-quote form, per Trail of Bits. Effort is the main cost driver. As of October 2026, the Trail of Bits publications repository lists 473 blockchain security reviews, with 2,137 person-weeks logged across the 471 that report effort, or about 4.5 person-weeks per review. Its blockchain reviews dated July to September 2026 range from 0.4 person-weeks for the Offchain Labs Tip Collection Toggler to 24 person-weeks for the Offchain Labs Arbitrum ArbOS 60/61 upgrade.
​

Contest platforms publish their prize pools. Code4rena contests run between December 2025 and May 2026 carried a $135,000 USDC pool for the K2 lending audit (April 17 to May 27, 2026), $101,000 for the LayerZero Stellar endpoint (April 1 to 14, 2026), $40,000 for Rujira (December 16, 2025 to January 16, 2026), $22,000 for Monetrix (April 24 to May 4, 2026) and $4,000 for an Intuition mitigation review (April 2 to 6, 2026). Mitigation reviews, which retest fixes, sit at the low end.

Auditors pair manual review with three classes of tools: static analyzers that scan source code for known bug patterns, fuzzers that throw generated inputs at contracts to break stated properties, and formal or symbolic tools that reason about every possible path. Teams can run all of them before an audit.

Slither and Echidna both come from Trail of Bits, which says it uses them, plus its Medusa fuzzer, in every engagement, per its services page. Echidna uses Slither to extract information before a fuzzing campaign, per the Echidna README. Solidity also ships a built-in SMTChecker for model checking, per Ethereum.org formal verification docs; see What Is Solidity? for the language itself.
​

Match the format to the risk. Code that will hold significant value usually gets a private audit plus a contest or bounty, because the formats find different bugs. Smaller or lower-value code may get by with tooling, internal review and one contest. Upgrades and new modules need fresh review either way.

An audit is a time-boxed review of one commit by a limited number of people. It lowers risk but does not certify code as safe, and its value decays as soon as the code changes. Ethereum.org treats audits as one layer among several.

Effort varies widely. Trail of Bits' blockchain security reviews dated July to September 2026 logged 0.4 to 24 person-weeks each, per its publications repository.
​

No. An audit reviews code before launch; a bug bounty rewards findings in deployed code, per Ethereum.org security docs.
​

Yes, as a first pass. Slither installs with pip, per its README, and Foundry fuzzes parameterized tests automatically, per the Foundry docs. That complements an independent audit rather than replacing it.
​

No. Audits reduce risk, but ethereum.org states they won't catch every bug, per its security guide.
​

Process, cost and tool details come from ethereum.org, auditors' own pages and tool repositories, fetched October 13, 2026. Cost figures are published contest pools and effort data, not quotes. The 4.5 person-week average divides the person-weeks logged for blockchain security reviews in the Trail of Bits publications repository (its Blockchain Reviews section plus the blockchain clients under Major Clients) by the reviews that report effort. Code4rena pools and dates come from each contest's own page.