Smart Contract Audit: Process, Cost and Limits (2026)

A smart contract audit is an independent security review of a protocol's code before (or after) it holds user funds. Specialist reviewers read the contracts line by line, run automated tools, and write a report that lists vulnerabilities by severity so the team can fix them. In 2026 a typical DeFi audit costs roughly $25,000 to $100,000, according to Sherlock's February 2026 pricing reference, though simple tokens cost far less and bridges far more.

An audit lowers risk; it does not remove it. This guide explains how the process works, what audits catch and miss, what they cost, how contests, bug bounties and formal verification fit in, and how to read an audit report as a user.

What is a smart contract audit?

Smart contracts are programs that hold and move money without a human in the loop. Once deployed, a bug can be exploited in a single transaction, and on-chain transfers cannot be reversed. An audit is the closest thing DeFi has to a pre-flight inspection.

A standard engagement with an audit firm follows the same broad steps:

1. Scoping. The team names the exact contracts and the commit hash to be reviewed. Anything outside that scope is not covered.
2. Code freeze. The code stops changing during the review, so findings apply to a known version.
3. Review. Auditors read the code manually, model how it can be attacked, and use tools such as static analysers, fuzzers and sometimes formal verification.
4. Report. Each finding gets a severity (usually critical, high, medium, low and informational) and a recommended fix.
5. Remediation and fix review. The team fixes the issues and the auditor checks the fixes. Sherlock notes that these re-audit rounds typically add $5,000 to $20,000 per pass and should be budgeted up front.

The output is a public or private PDF. The most important line in it is often the one people skip: the commit hash. An audit applies to that code only.

What audits catch, and what they miss

Audits are good at finding known bug classes: reentrancy, missing access controls, broken maths and rounding, unchecked return values, and logic that lets one user take another user's funds. They also catch design problems, such as an oracle that can be moved with a flash loan or a price oracle that can go stale.

They are much weaker at the following:

• Code that changed after the audit. A later upgrade or a new module is unaudited unless it was reviewed separately.
• Economic attacks. Code can do exactly what it was written to do and still be drained by market manipulation or bad incentive design.
• Integrations. Risk often sits in how a protocol talks to other protocols, oracles and bridges, which may be outside the scope.
• Operational risk. Leaked admin keys, malicious upgrades and front-end compromises are not code bugs at all.
• Intentional fraud. An audit cannot stop a team that plans to rug pull through powers it kept for itself.

The Euler example

Euler Finance, a lending protocol, lost about $197 million on 13 March 2023 in a flash-loan attack, The Block reported. The flaw was in a function added in a later code change, donateToReserves, which lacked the health check that other functions ran, according to CertiK's analysis. Euler had completed 10 audits from six firms between May 2021 and September 2022, Cointelegraph reported, and Sherlock, whose review had covered that change, agreed to pay a $4.5 million claim. The attacker later returned all recoverable funds, a total of over $177 million, by early April 2023, per The Block.

The lesson is not that audits are useless. It is that a single missed check in a single change can be enough, and that "audited" describes a moment in time.

How much does a smart contract audit cost?

Prices depend on code size, complexity, language, the firm's reputation and how urgently you need the work. Published ranges come mostly from audit firms themselves, so treat them as market signals rather than fixed rates.

Sources: Sherlock, 18 February 2026 and QuillAudits' 2026 cost guide.

Sherlock also says quotes for functionally similar scopes can range from $15,000 to $150,000 between firms, that urgent timelines add 20 to 40 percent, and that protocols with meaningful TVL often spend $150,000 to $500,000 a year on security in total. One audit is rarely the whole budget: serious teams pair it with a contest, a bug bounty and monitoring.

Audit contests, bug bounties and formal verification

Audit contests

In a contest, a protocol posts a prize pool and many independent researchers review the same code for a fixed window. Payouts go to whoever finds valid issues, weighted by severity. More eyes for a set budget is the appeal; uneven coverage and noisy submissions are the trade-off.

The market has shifted in 2026. Code4rena, the platform that popularised the model, announced in May 2026 that it would wind down, with Immunefi taking on its bug bounty customers, AMBCrypto reported on 14 May 2026. As of 17 October 2026, Sherlock lists more than 300 contests, and Cantina shows a live competition and reports $56 million paid out to researchers across its programmes.

Bug bounties

A bug bounty is a standing reward for anyone who responsibly discloses a vulnerability in live code. It covers the period after launch, which is exactly where audits stop. Immunefi, the largest Web3 bounty platform, says it has paid more than $110 million in bounties, including $10 million for a critical Wormhole bug and $6 million for one in Aurora (figures from its site as of 17 October 2026). A bounty that is small compared with the funds at risk gives a finder little reason to report rather than exploit.

Formal verification

Formal verification proves mathematically that code satisfies written rules, such as "total deposits always equal the sum of user balances". It can rule out whole classes of bugs, but only for the properties someone thought to write down. Tooling has become cheaper: Certora open-sourced its Prover on 24 February 2025 and made it free to use.

Notable smart contract audit firms

There is no licence or regulator for auditors, so reputation rests on track record, published reports and the people doing the work. Well-known names include Trail of Bits, OpenZeppelin, ChainSecurity, Spearbit (which built the Cantina platform), Zellic, Certora and OtterSec. Move-based chains such as Sui have a smaller pool of specialists; Sui named OtterSec and Zellic as ecosystem audit partners in a December 2023 announcement.

When judging any firm, look at three things rather than the logo:

• Relevant experience. Has it reviewed similar protocols in the same language?
• Named reviewers and time spent. Good reports state who reviewed the code and for how many days.
• Public reports with real findings. A history of clean reports with no findings is a warning sign, not a comfort.

How to read an audit report as a user

You don't need to read Solidity or Move to get value from an audit report. Check these points in order:

1. Is the report real? Find it on the auditor's own website or GitHub, not only on the project's site.
2. What was in scope? Compare the listed contracts and commit hash with what is deployed. A newer version means the report may not apply.
3. How serious were the findings? Count critical and high issues.
4. Were they fixed? "Acknowledged" means the team accepted the risk and did not fix it. Look for "resolved" or "fixed" with a verified fix review.
5. What about admin powers? Reports often flag centralisation risks, such as an owner who can upgrade contracts or pause withdrawals without a timelock.

Then step back. An audit is one input. Our guide on how to check a DeFi protocol is safe covers the rest: track record, TVL history, governance and exit liquidity. For cover against a hack, see DeFi insurance.

Where JewelSwap fits

We think users should know a product's audit status before depositing. JewelSwap's Ember Loop vault on Sui is a public beta and is unaudited, which we state on the Ember Loop page. It is not available to US or UK residents. Treat any unaudited contract, ours included, as higher risk and size positions accordingly.

Frequently asked questions

What is a smart contract audit?

It is an independent security review of a protocol's smart contract code. Auditors combine manual review with automated tools, then publish a report listing vulnerabilities by severity and recommended fixes.

How much does a smart contract audit cost?

Published 2026 ranges run from about $5,000 for a simple token to over $150,000 for complex multi-chain systems. Sherlock puts most DeFi protocol audits between $25,000 and $100,000, with re-audits adding $5,000 to $20,000 per pass.

How long does an audit take?

It depends on code size and complexity. A small token can take days, while a full DeFi protocol often takes several weeks of review plus time for fixes and a fix review.

Does an audit mean a protocol is safe?

No. An audit covers specific code at a specific commit. It can miss bugs, and it does not cover later upgrades, economic attacks, leaked keys or a dishonest team. Euler was audited and still lost about $197 million in 2023.

What is the difference between an audit, a contest and a bug bounty?

An audit is a paid review by one firm. A contest pays many independent researchers to review the same code for a fixed period. A bug bounty is a standing reward for vulnerabilities found in live code after launch.

Is Code4rena still running?

Code4rena announced in May 2026 that it would wind down operations, with Immunefi onboarding its bug bounty customers. Sherlock and Cantina continue to run audit contests.

Keep reading

• How to check a DeFi protocol is safe
• What is a rug pull?
• What is a flash loan?
• DeFi insurance explained
• Address poisoning scams

This article is educational and is not financial, legal or security advice. Prices and platform figures are as of 17 October 2026 and come from the sources linked; audit quotes vary widely between firms and projects. JewelSwap operates the Ember Loop vault mentioned here, which is an unaudited beta.