Code review. Security experts go through a smart contract looking for bugs, vulnerabilities, anything that could be exploited.

Matters more here than almost anywhere else in software. Smart contracts are immutable. Once deployed the code can't be changed. Bug exists after deployment, only fix is an entirely new contract. If funds are already inside and an exploit exists, attacker moves faster than any response can.

No patch cycles. No hotfixes. Has to be right before it goes live or it's right until someone finds it isn't.

How It Actually Works

Firm receives the codebase. Scope agreed upfront. Which contracts, what the protocol is supposed to do, any known complexity areas.

Automated tools run first. Scan for known patterns. Reentrancy vulnerabilities, integer overflow, access control gaps. Fast. Catches common issues.

Manual review is where most of the real value comes from. Researchers read through every function and interaction. Automated tools miss logic errors. Code that's technically valid but economically exploitable. Business logic flaws that make complete sense to a compiler and zero sense from a security standpoint.

Severity Classification

Findings graded by severity. Critical means funds at immediate risk right now. High means serious but requiring specific conditions. Medium affects reliability without direct fund loss. Low is minor. Informational is suggestions.

Team receives the report. Fixes the critical and high issues. Auditors verify fixes. Final report published. Publicly available if the project is doing things properly.

Why Traders Should Care

Halborn research found 90% of hacked DeFi projects never had an audit. That's the whole argument in one number.

Audited protocol means someone paid real money, anywhere from $10,000 to well over $100,000 depending on complexity, for independent security review. Fixed what got flagged. Published the results. Some level of professional accountability existed.

Unaudited means either couldn't afford it, moved too fast to bother, or didn't want outside eyes on the code. One of those is understandable. The other two aren't great.

Caveat that gets missed constantly: audits don't guarantee safety. Curve Finance was audited multiple times and still got exploited in 2023. Vulnerability in an older Vyper compiler version that reviewers hadn't covered. Euler Finance was audited. $197 million went anyway. An audit is evidence that someone looked carefully. Not evidence that someone found everything.

Unaudited protocol sitting on serious TVL is a different risk profile from one that went through a credible review. Both can fail. Chances aren't equal.

The Firms That Matter

CertiK

Largest by volume. Audited thousands of projects. Reputation complicated by the number of CertiK-audited projects that still got exploited. Volume model has critics in the security community who argue thorough review and high throughput don't coexist well.

Trail of Bits and OpenZeppelin

More selective. More expensive. Stronger reputation for depth. If a complex protocol has a Trail of Bits audit that's a more meaningful signal than many of the alternatives.

Sherlock

Runs competitive audit contests. Multiple independent researchers hunting for the same vulnerabilities simultaneously. Economic incentive to find things others miss. Different model. Growing reputation.

Others

Halborn, Cyfrin, Consensys Diligence all credible at different price points. An audit from a firm nobody has heard of that launched recently carries less weight than one from an established name. Not all audits equal regardless of what the badge says.

Audit FAQ

Audited means safe?

Safer. Not safe. Code reviewed at a point in time. Protocol updates afterward create unaudited code. New attack vectors emerge. Integrations introduce new risks. Signal of due diligence not a guarantee of security.