Best Arbitrum Auditors in 2026

By the Guardian team Updated November 2026 6 min read

Quick answer. Ranked on public reports, Guardian leads for Arbitrum DeFi as GMX’s primary auditor, Trail of Bits for Arbitrum’s own stack and OpenZeppelin for Stylus. Sherlock, Cyfrin, Certora, Pashov Audit Group and Spearbit follow.

Watch: Best Arbitrum Auditors in 2026 1:51

Video transcript

Arbitrum runs the EVM, but not exactly as Ethereum does. An auditor new to it can miss the differences.

Guardian publishes this guide and ranks itself first, using only public evidence: Arbitrum DeFi reports, audits of Arbitrum's own stack, Foundation standing, and coverage beyond the first audit.

Guardian leads for Arbitrum DeFi, Trail of Bits for Arbitrum's own stack, and OpenZeppelin for Stylus. Sherlock, Cyfrin, Certora, Pashov Audit Group and Spearbit follow.

Guardian has reviewed every GMX contract update since October 2022. Its portfolio lists 145 public Arbitrum reports, including Dolomite, Umami and Jones DAO.

Most Solidity runs the same on Arbitrum. Auditors check the exceptions: block numbers, timestamps, aliased senders, retryable tickets, sequencer downtime and Stylus reactivation.

In the Arbitrum Audit Program, 18 completed audits averaged 50,706 dollars, about 15 dollars per line of code. They found 385 vulnerabilities, 13 of them Critical.

Its successor, the Arbitrum Security Program, opened in September 2026. Apply, sign a Commitment Agreement and get matched with an approved firm. Expect about a month from approval to audit.

The subsidy covers the initial audit only. Guardian's Vanguard audit pairs human review with Helix, its AI auditor, then adds a Defender contest, a bug bounty and six months of update review.

Read the full guide for every firm's sources, or get a quote from Guardian at guardian.security.

Disclosure: Guardian publishes this guide, and we ranked ourselves first. Claims about other firms come from their public reports, protocol docs and Arbitrum Foundation pages, with sources at the end.

Arbitrum runs the EVM, but not exactly as Ethereum does.

Block numbers, timestamps, callers from Ethereum and sequencer outages all behave differently. An auditor who has not worked there can miss them.

The Arbitrum Foundation now subsidizes audits through the Arbitrum Security Program, with 13 approved firms. This guide ranks the firms with the most public Arbitrum work.

How We Ranked Arbitrum Auditors

We used only public evidence, on four criteria:

Arbitrum DeFi record. Public reports for protocols on Arbitrum, in the firm’s repo or the protocol’s docs.
Stack depth. Audits of Arbitrum itself: Nitro, BoLD, Stylus and governance.
Foundation standing. Approval for the Arbitrum Security Program, and selection in Arbitrum’s subsidy rounds.
Coverage. Keepers, backends and updates after launch, not only the first audit.

Arbitrum Auditors Compared

#	Firm	Public Arbitrum proof	Best for
1	Guardian	GMX’s primary auditor; Dolomite, Umami, Jones DAO, MUX	Arbitrum DeFi, onchain and offchain
2	Trail of Bits	42 of 49 reports on Arbitrum’s audit page	Rollup, bridge and ArbOS code
3	OpenZeppelin	Stylus SDK audits; Contracts for Stylus	Stylus contracts in Rust
4	Sherlock	GMX updates; JOJO, Perennial and Elfi contests	Contests on Arbitrum DeFi
5	Cyfrin	Dolomite Margin and modules	Lending and margin code
6	Certora	GMX Synthetics, November 2023	Formal verification
7	Pashov Audit Group	Ostium, Reya	Repeat reviews as teams ship
8	Spearbit (Cantina)	Chosen by 9 of 22 subsidy fund projects	Reviews from the Spearbit researcher network

The Top Arbitrum Auditors

1. Guardian

Arbitrum proof: primary auditor for GMX, per GMX’s docs, and an approved Arbitrum Security Program firm
Portfolio: 145 public reports for 30 clients under the Arbitrum filter of the portfolio (November 5, 2026)

Guardian has reviewed every smart contract update GMX has shipped since October 2022. Its lead auditor holds an elected seat on the GMX DAO Security Committee.

It has also audited several protocols in GMX’s ecosystem on Arbitrum, including Dolomite, Umami, Jones DAO and MUX.

Three projects chose Guardian in Arbitrum’s Security Subsidy Fund pilot. The full record is in the GMX client story.

2. Trail of Bits

Arbitrum proof: 42 of the 49 reports on Arbitrum’s security audit page
Scope: Nitro, BoLD, Stylus, the token bridge and ArbOS upgrades

Trail of Bits is the main auditor of Arbitrum’s own code, with reports from the 2022 Nitro reviews to October 2026. It is on the current approved list.

3. OpenZeppelin

Arbitrum proof: three Stylus SDK audits on Arbitrum’s audit page, 2024 and 2025
Known for: OpenZeppelin Contracts for Stylus, a Rust contract library for Arbitrum

Dolomite’s docs also list its audit of the original dYdX code behind Dolomite’s core contracts. It is an approved program firm.

4. Sherlock

Arbitrum proof: GMX Synthetics updates, per GMX’s docs, and contests for JOJO, Perennial and Elfi
Subsidy record: chosen by four Security Subsidy Fund projects; approved for the current program

Its contest repos are public and state the chains each team deploys to, so its Arbitrum record is easy to check.

5. Cyfrin

Arbitrum proof: Dolomite Margin (2023) and Dolomite POL vaults (2025) reports; Dolomite’s docs list it for core and modules
Subsidy record: chosen by three Security Subsidy Fund projects; approved for the current program

6. Certora

Arbitrum proof: audited GMX Synthetics in November 2023, per GMX’s docs
Known for: formal verification, which proves that specified rules hold for every input

It is an approved program firm.

7. Pashov Audit Group

Arbitrum proof: five reviews of Ostium, which its reports call built on Arbitrum
Also: seven reviews of Reya, an Arbitrum Orbit chain; approved for the current program

8. Spearbit (Cantina)

Arbitrum proof: chosen by 9 of the 22 projects in Arbitrum’s Security Subsidy Fund pilot, the most of any firm
Note: not on the Arbitrum Security Program’s current approved list

Cantina grew out of the Spearbit network of security researchers, which still powers its audits.

Arbitrum Gotchas Auditors Check

Most Solidity runs the same on Arbitrum. Per Arbitrum’s docs, these are the places it does not:

Block numbers: block.number estimates Ethereum’s block number. Use ArbSys(100).arbBlockNumber() for Arbitrum’s.
Timestamps: set by the sequencer, up to 24 hours behind or one hour ahead. Unreliable over minutes.
Randomness: block.prevrandao returns 1, and blockhash is insecure pseudo-randomness.
Aliased senders: a contract calling from Ethereum arrives as its address plus 0x1111…1111. Access checks must account for the alias.
Retryable tickets: a failed auto-redeem can be redeemed by hand for up to a week, then expires and refunds the call value.
Sequencer downtime: delayed-inbox transactions can wait up to 24 hours for force inclusion. Check what oracle updates and liquidations do meanwhile.
Stylus: WASM contracts must be reactivated every 365 days or after a Stylus upgrade, or become uncallable.

Stylus has a second catch. On October 2, 2026, the Security Council paused new Stylus activations on Arbitrum One and Nova.

Active contracts keep running and can be renewed before they expire. An expired one cannot be reactivated during the pause.

A constitutional proposal posted on October 23, 2026 would reopen activations on Arbitrum One for code signed off after a limited review by a Security Program auditor. It is still in forum discussion.

Using the Arbitrum Security Program

The Arbitrum Audit Program ran from August 1, 2025 and stopped taking applications on July 31, 2026.

By the Foundation’s August 2026 count, its 18 completed audits averaged $50,706, about $15 per line of code. They found 385 vulnerabilities, 13 of them Critical.

Its successor, the Arbitrum Security Program, opened on September 29, 2026 for 12 months. It covers AI-assisted screening, human audits, the Arbitrum bug bounty and the Security Council.

For an audit, the steps are:

Apply. Review weighs technical maturity, team, likelihood of success and fit with the Arbitrum ecosystem.
Once approved, confirm the code is audit-ready, agree the subsidy and sign a Commitment Agreement.
The Foundation matches you with an approved firm by scope, requirements and availability.
Expect about a month from approval to the audit’s start.

The subsidy covers the agreed initial audit only. Updates after launch need their own budget.

The other approved firms are ack3, Decurity, Hexens, Nethermind, Oak Security and OXORIO. For prices outside the program, see audit firm pricing compared.

How Guardian Audits on Arbitrum

A Vanguard audit puts two independent teams on your code: manual review with invariant fuzzing, and Helix, Guardian’s AI auditor. Only human-verified findings reach the report.

A $100,000 Defender contest, a hosted bug bounty and six months of update review follow.

Guardian’s audits and pentests also cover the keepers, relayers and web apps around your contracts, as in its GMX keeper review.

Building a perp DEX on Arbitrum? Read perp DEX security and the best perp DEX auditors.

Frequently Asked Questions

Which auditors are approved for the Arbitrum Security Program?

The Arbitrum Foundation lists 13: ack3, Certora, Cyfrin, Decurity, Guardian, Hexens, Nethermind, Oak Security, OpenZeppelin, OXORIO, Pashov Audit Group, Sherlock and Trail of Bits. The Foundation matches each accepted project with one of them.

Does the Arbitrum Foundation pay for audits?

In part. The Arbitrum Security Program subsidizes a portion of selected projects’ audits, depending on the agreement with each project. It covers the agreed initial audit only, not later reviews.

How much does an Arbitrum audit cost?

In the Arbitrum Audit Program, 18 completed audits averaged $50,706, about $15 per line of code, per the Foundation’s August 2026 program proposal. Scope and complexity drive the price.

Do Arbitrum contracts need a different audit than Ethereum contracts?

The Solidity is the same, but the environment is not. Block numbers, timestamps, aliased senders from Ethereum, retryable tickets, sequencer downtime and Stylus all behave differently, and an auditor should check each against your code.

Sources

Audit your Arbitrum protocol with Guardian

Guardian has reviewed every GMX update since 2022 and is approved for the Arbitrum Security Program.

Get a quote Explore audits and pentests