What Top Auditors Charge: OpenZeppelin Audit Cost and More

Updated October 2026 7 min read

Quick answer. DAO records show OpenZeppelin's Compound partnership cost $4M a year from December 2021, and Trail of Bits bid $1M a quarter for the same mandate. Halborn priced an Arbitrum DAO retainer at $500,000 per six months.

Watch: What Top Auditors Charge: OpenZeppelin Audit Cost and More 1:40

Video transcript

OpenZeppelin, Trail of Bits and Halborn don't publish price lists. But DAO governance records show exactly what they quoted.

Guardian publishes this comparison and quotes each engagement, so it has no row here. Most public prices are retainers, bundling governance reviews, monitoring and advisory work.

OpenZeppelin's Compound deal cost four million a year from 2021. Trail of Bits bid one million a quarter for the same mandate. Halborn proposed half a million per six months for an Arbitrum seat it did not win.

Audit quotes are built from engineer weeks. Arbitrum's program says ten to forty thousand dollars per auditor per week is common, and Halborn put its own retainer at about twenty one thousand per engineer week.

For one-off audits, the Arbitrum Audit Program's eighteen completed audits averaged fifty thousand seven hundred six dollars by August 2026, about fifteen dollars per line of code.

Code size drives cost, though not linearly. Complexity and language add premiums, urgent timelines cost more, and re-reviews may be billed separately. Retainers are not comparable to single audits.

Two quotes at the same price can buy very different coverage. Ask how many engineer weeks you get, and who the named reviewers are. Ask how many fix review rounds are included, which methods apply, and what happens after the report.

Read the full comparison, then get a scoped quote from Guardian at guardian.security and compare it line by line.

The OpenZeppelin audit cost, like any top firm's price, is normally a private quote.

The exception is work paid for by DAOs, whose forums publish proposals, quotes and reimbursements.

Two caveats. Most public prices are retainers, not single audits, and bundle governance reviews, monitoring or advisory work.

And the sample is small for a reason. The Arbitrum Audit Program's proposal said it would not publish individual subsidy payments, noting that “auditors are sensitive to revealing their rates to competitors.”

Disclosure: Guardian publishes this page. It is one of 13 approved auditors in the Arbitrum Audit Program's June 2026 transparency report, and three projects chose Guardian in Arbitrum's 2024 Security Subsidy Fund. Guardian does not publish prices.

Public Prices by Firm

Each date links to the public record it comes from.

Retainers and security partnerships

Firm	Client and scope	Price	Date and status
OpenZeppelin	Compound: audits, proposal reviews and monitoring	$4M a year, paid in COMP	Dec 2021, won the vote; renewed until the 2025 handover
Trail of Bits	Compound: the same mandate, at least one full-time engineer	$1M per quarter for one year	Dec 2021, not selected
Certora	Aave: formal verification and manual review	$2.7M for a year	Oct 2022, renewed
Certora	Aave: one-year renewal	$1.7M (Certora cites a $2.7M regular price)	Oct 2024, passed
Certora	Aave v4: 4.5 full-time staff plus an account manager, 12 months	$2.39M; list price $780,000 per dedicated engineer a year	Oct 2025, Snapshot passed
Certora	Balancer: setup, rule writing, 12 months of platform access	$250K a year	Apr 2023, rejected in the Snapshot vote
ChainSecurity and Certora	Compound: audits, formal verification, advisory and vCISO	$1.75M a year	Jul 2025, selected from 16 proposals
ChainSecurity and Certora	Compound renewal: 58 audit weeks a year plus vCISO	$1,324,000, or $1,024,000 without the $300,000 vCISO	Sep 2026; the Snapshot vote failed, and the Treasury Management Committee's move to fund it anyway is disputed
Cyfrin	Compound shortlist: four full-time lead researchers plus vCISO	$1.75M a year in the Foundation's table; cut to $1.5M before the vote	Jul 2025, not selected
Halborn	Arbitrum DAO: continuous security, up to two workstreams a month	$500,000 per six months ($20,833 per engineer week, by Halborn's math)	Feb 2024 application; not elected

Single audits

Firm	Client and scope	Price	Date
Trail of Bits	Aave: one Chainlink PR modified for the GHO and sGHO swap layer	50,000 GHO	Jul 2026
Trail of Bits	Aave: second audit of the V4 Reinvestment Controller's GHO and sGHO swap layer	25,000 GHO	Aug to Sep 2026
ChainSecurity	Aave: the same second audit	44,939.27 GHO	Aug to Sep 2026
ChainSecurity	Aave: Gho Router	21,322.38 GHO, plus a final installment of 11,655 GHO	Apr and Jun 2026
Sherlock	Aave: two PRs (sGHO update and sGhoSteward)	24,900 USDC	Mar 2026
Sigma Prime	Lido: Easy Track security assessment, four weeks	$83,125, plus a 5% surcharge for payment in crypto	Jul 2021
Neodyme	Lido on Solana: the Solido program; later the Anker integration	$90,000 each	2021 and early 2022
Bramah Systems	Lido on Solana: initial audit	$15,000 stated; the payments listed total $17,500	2021
Oxorio	Lido on Polygon: audit payments to date, with one V1 PR still pending	48,300 USDC	Feb 2022
PeckShield	Lido on Polygon: V2 additions for referral mechanics	6,000 USDC	Dec 2022
Dedaub	Lido on Polkadot and Kusama: additional audit, then a delta audit for sunsetting	$23K, then $7K	Aug 2022, Apr 2023

GHO is Aave's stablecoin; some reimbursements were paid in aEthLidoGHO, its Aave deposit token.

The Aave figures are reimbursements requested in the DAO's monthly funding updates.

Weekly Rates and Team Sizes

Audit quotes are built from engineer-weeks, so per-week numbers compare best.

Arbitrum, Halborn and Certora (2022) state weekly rates. The rest is our arithmetic on disclosed totals.

Arbitrum Audit Program proposal, 2025: projects commonly pay $10,000 to $40,000 per auditor per week, depending on complexity; about $20,000 is a common figure.
Halborn, 2024: $20,833 per engineer week, stated in its Arbitrum application.
Certora, 2022: $80,000 a week for two security engineers and one security researcher, about $26,700 per person-week.
Sigma Prime, 2021: $83,125 for a four-week Lido engagement, about $20,800 a week; team size not stated.
ChainSecurity and Certora, 2026 proposal: $1,024,000 for 58 audit weeks, about $17,700 a week. The fee also covers formal verification, security advice and a multisig signer seat.
Certora, 2025: a $780,000 list price per dedicated engineer a year, about $15,000 a week, before the roughly 32% discount Certora says Aave receives.
Team sizes: Certora committed 4.5 full-time staff to Aave v4; Cyfrin offered Compound four full-time lead researchers plus a vCISO.

What Subsidy Programs and Budgets Paid

Subsidy programs publish averages across many audits. That is the closest public view of single-audit prices for smaller teams.

Arbitrum Security Subsidy Fund (2024 pilot): 22 projects chose quotes from six firms. Quotes ran from $16,500 to $345,979 and averaged $140,134.
Arbitrum Audit Program (from August 2025): 14 audits completed by April 2026 averaged $46,363, or $45 per line of code, and about $15 per line above 3,000 lines.
The same program by August 2026: 18 completed audits covering 71,366 lines averaged $50,706.
Aave V4 (October 2025): a cap of up to 1.5M GHO for four manual reviews by firms, researcher reviews, Certora formal verification, an invariant suite and a contest.
Compound: the Foundation put its security cost at an annualized $4M from 2021, and said the 2025 selection would cut it to $2M a year.

Why Prices Differ

Code size. Cost scales with lines in scope, but not linearly: Arbitrum's data shows $45 a line on average, about $15 above 3,000 lines.
Complexity and language. Sherlock, which sells audits, estimates premiums over an EVM baseline: 25 to 40 percent for Rust-based Solana programs, 80 to 120 percent for ZK circuits.
Timeline. Sherlock estimates urgency adds 20 to 40 percent. More engineers in parallel shorten the calendar, not the engineer-weeks.
Re-reviews. Sigma Prime's Lido quote included a retest round; Dedaub's $7K delta audit was billed separately. Sherlock estimates $5,000 to $20,000 per re-audit pass.
Payment terms. Sigma Prime charged 5% more for payment in crypto, and Certora took part of its Aave fee in AAVE.

What to Compare Beyond Price

Two quotes at the same price can buy very different coverage. Ask each firm for:

Engineer-weeks and named reviewers, not just a total.
Whether fix reviews are included, and how many rounds.
The methods: manual review, fuzzing or invariant suites, formal verification, AI-assisted review.
What happens after the report: update reviews, contests, bug bounty support, monitoring.
Whether offchain systems are in scope. Our guide to Web3 pentest cost covers that side.

Guardian quotes each engagement, so it has no row above. What a Vanguard audit includes is public:

Two independent teams on one scope, plus Helix, Guardian's AI auditor.
An invariant fuzzing suite.
A $100,000 Guardian-funded Defender contest for Critical findings.
A hosted bug bounty with $50,000 in Critical matching.
Half of the package cost back as credits toward offchain assessments.
Six months of update review, up to 2,500 onchain or 10,000 offchain SLOC.

Teams can also apply to the Guardian Security Fund, which offers $1,000,000 in audit grants.

To compare firms on coverage rather than price, see our top smart contract auditors ranking.

Where the Data Is Thin

We found no published price list from OpenZeppelin, Trail of Bits, Halborn, Hacken, Cyfrin, PeckShield or CertiK.
Compound's 2025 RFP required vendors to submit pricing privately.
OpenZeppelin, Cantina and the Immunefi consortium did not go forward to the Snapshot vote, so their final prices were never posted.
We found no public single-audit price for Halborn, Hacken or CertiK in the DAO forums we searched.
DAO records skew toward large protocols and retainers, use mixed currencies, and span 2021 to 2026.

Treat these records as reference points, not a rate card.

Frequently Asked Questions

How much does an OpenZeppelin audit cost?

OpenZeppelin does not publish prices. Its Compound security partnership cost $4M a year from December 2021, covering audits, governance proposal reviews and monitoring. In its July 2024 to June 2025 term, it reported 119+ weeks of auditor time.

How much does Trail of Bits charge for an audit?

Trail of Bits does not publish prices. It bid $1M per quarter for Compound's 2021 security mandate. Aave's 2026 funding updates show Trail of Bits audits of GHO components at 50,000 GHO and 25,000 GHO.

How much does Halborn charge?

Halborn's 2024 application to the Arbitrum DAO proposed $500,000 per six-month term, which it calculated as $20,833 per engineer week. Halborn was not elected; OpenZeppelin won that seat. We found no public single-audit price.

How much does a smart contract audit cost on average?

In the Arbitrum Audit Program, 18 completed audits covering 71,366 lines of code averaged $50,706, about $15 per line. In Arbitrum's 2024 subsidy pilot, quotes for 22 projects averaged $140,134.

Sources

Get a scoped quote and compare it line by line

Send Guardian your scope for a Vanguard quote, and compare what it includes against the other quotes you hold.

Talk to Guardian Get a Vanguard quote