Smart Contract Audits
Tomohiro Iida · Published April 7, 2026
A smart contract bug cannot be fixed once deployed. This article covers why an audit is necessary, the three main audit methods, how to choose an audit firm, and typical cost and timeline ranges.
Key takeaways
- A smart contract audit is a third-party security check, before deployment, of an automatically-executing program on a blockchain (typically written in Solidity or Vyper) — because a bug generally cannot be fixed after the contract goes live.
- The three main methods are static analysis, dynamic testing, and formal verification, typically used in combination.
- Typical cost ranges from roughly JPY 500,000 for a small, single contract to JPY 8,000,000 or more for a large DeFi protocol, over a timeline of one to two weeks up to two to three months. Ranges vary by audit firm and scope.
Why an audit matters
Once deployed to a blockchain, a smart contract generally cannot be changed. If a bug or vulnerability is discovered afterward, the options are pausing the contract or migrating to a new version — both costly, and both damaging to trust. Past hacks illustrate the scale: the 2022 attack on Ronin Network resulted in losses of roughly JPY 62 billion, and the 2016 DAO hack resulted in losses of roughly JPY 6 billion at the time. Across the DeFi sector as a whole, cumulative hacking losses from 2020 through 2024 have exceeded USD 3 billion.
- Immutability: a contract generally cannot be modified after deployment, making the cost of fixing a bug extremely high.
- Public exposure: because contract code is typically open source, an attacker can study it directly to look for vulnerabilities.
- Concentration of value: contracts that hold large amounts of assets are a correspondingly stronger target for attackers.
- External dependencies: a contract that relies on oracles or other protocols can be attacked through a vulnerability in one of those external dependencies.
- Cases where an audit matters most: DeFi protocols that custody or transfer assets (lending, DEXs, bridges)
- Security tokens (STOs) that function as a legal security
- DAO contracts that underpin governance decisions
- Cross-chain bridges — historically the category with the largest losses
Three audit methods
- Static analysis: analyzing source code without executing it, using tools such as Slither, MythX, or Solhint to automatically detect known vulnerability patterns (reentrancy, overflow, access-control mistakes, and similar). Combined with manual code review, it can also catch logic bugs that tools alone miss.
- Dynamic testing: actually running the contract against a wide range of inputs. Fuzzing (large-scale random input testing) and symbolic execution can surface runtime issues that static analysis has trouble finding; pairing this with a Foundry or Hardhat test suite is recommended.
- Formal verification: mathematically proving a contract's correctness against a written specification (for example, "this function always satisfies this precondition and postcondition"), checked with a proof tool such as Certora Prover or the K Framework. Implementation cost is high, but adoption is growing for DeFi protocols and financial contracts.
A standard audit combines static analysis, dynamic testing, and manual code review. For DeFi protocols and financial STOs requiring the highest security, adding formal verification is also worth considering. Having a test suite with 80%+ coverage in place beforehand can reduce both audit cost and duration.
Three criteria for choosing an audit firm
- Track record and disclosure: check whether past audit reports are public. Major firms such as Certik, OpenZeppelin, Trail of Bits, and Quantstamp publish their reports, letting you evaluate technical quality from past findings; as a rule, a firm that does not disclose any track record should be ruled out.
- Fit with your technology stack: confirm the firm has relevant experience with your contract's language (Solidity, Vyper, Rust, and similar), chain (Ethereum, Solana, Cosmos, and similar), and framework (OpenZeppelin, Hardhat, and similar). A track record with DeFi-specific vulnerabilities, such as flash-loan attacks or price manipulation, is also an important factor.
- Support for remediation: check whether the firm supports fixing vulnerabilities after the audit. Choosing a firm that offers a re-audit once fixes are in place reduces the risk of an incomplete fix or a newly introduced vulnerability. Confirm their communication process and working language in advance.
Domestically in Japan, using an English-speaking overseas audit firm (such as Certik or OpenZeppelin) is the common route, but a domestic vendor can also be a valid option where Japanese-language support or familiarity with domestic regulation matters. Scope, contract terms, and confidentiality clauses should all be made explicit up front.
Cost and timeline
Audit cost varies considerably by code volume, complexity, chain, and audit firm. The following are rough market ranges for commissioning an external audit firm.
| Tier | Cost range | Timeline | Scope |
|---|---|---|---|
| Small | JPY 500,000 – 2,000,000 | 1–2 weeks | A single contract, 1,000 lines of code or fewer, potentially including standard implementations like ERC-20/ERC-721 (example: a simple NFT contract, a DAO voting contract) |
| Standard | JPY 2,000,000 – 8,000,000 | 3–6 weeks | A mid-size project with multiple interdependent contracts, or the core functions of a DeFi protocol (example: a DEX pair contract, a staking protocol) |
| Enterprise | JPY 8,000,000+ | 2–3 months | A large-scale DeFi protocol, cross-chain support, or a high-security project that includes formal verification (example: a lending protocol, a bridge contract, an STO platform) |
- Code volume and complexity: the number of lines and the complexity of the logic directly drive the effort required.
- How complete your test suite is: a well-developed test suite lowers the cost of dynamic testing.
- Chain and language: firms that can audit languages other than Solidity (Rust, Move, and similar) are more limited.
- Schedule urgency: a compressed timeline can carry a premium.
Building toward audit readiness from early in development, with test coverage in mind from the start, is the most effective way to lower audit cost. Incorporating a security review at the design stage can reduce the number of issues an audit later finds.
Summary
Because a smart contract cannot be changed once deployed, an audit before going live is essential. Many of the largest past hacks trace back to insufficient auditing. The three audit methods — static analysis, dynamic testing, and formal verification — are combined according to your use case and required security level, and an audit firm is chosen against three criteria: disclosed track record, technical fit, and remediation support. Cost runs roughly from JPY 500,000 for Small, JPY 2,000,000 for Standard, and JPY 8,000,000 for Enterprise; building toward test readiness from early in development helps keep audit cost down.