Same Code, Different Results: Guardian vs. Other Auditors

Video transcript

In 17 cases where Guardian and another firm audited the same code at about the same time, Guardian reported more findings every time.

A case counts when both firms reviewed the same codebase at about the same time, and both reports are public. Counts come from each report's summary table, at Low and above.

Guardian reported more findings in all 17 cases, against 15 different firms.

Summed across cases, Guardian reported 102 more Criticals and Highs than the strongest other firm. It led in 14 cases. In the other three, no firm reported any.

The widest gaps came on complex DeFi code, like perpetuals, vaults and leveraged yield. On a small, well-tested multisig, every firm found little.

Guardian chose these cases and wrote this page, so treat them as evidence, not a neutral ranking. Firms grade issues differently, so every case links both reports.

To compare firms, read their reports on similar code. Weigh Criticals and Highs, check findings were fixed, and ask teams who used two firms which found what.

Vanguard puts two independent teams on one scope. One uses manual review and invariant fuzzing. The other is driven by Helix, Guardian's AI auditor. Only human-verified findings reach the report.

Read the full article for every case and both reports. Or get a Vanguard quote at guardian.security.

Most teams pick an auditor without seeing what a different firm would have found. The reports exist, but rarely side by side.

Some codebases have been reviewed by Guardian and another firm at about the same time. Their public reports give a rare like-for-like comparison.

This analysis collects 17 of those cases, against 15 other firms. Every count links to the report it came from.

How We Compared

A case qualifies when both firms reviewed the same codebase at or near the same time, and both reports are public.

• Counts come from each report's own summary table, not from our reading of its findings.
• Bars count findings at Low and above. Informational findings vary too much between firms to compare.
• Tiers keep each firm's own names. Where a firm has no Critical tier, or combines Low and Info, the case says so.
• Adjustments are rare and shown. In three cases the bars move findings between tiers so both firms count alike, and the case says why.
• Timing is in each case, with both report dates. Where one firm reviewed code that already held the other's fixes, the case says so.

The Results

On each case's measure, Guardian reported more findings than every other firm in all 17 cases.

On Criticals and Highs, Guardian reported more in 14 cases. In the other three, no firm reported any.

The widest gaps came on complex DeFi code: perpetuals, vaults and leveraged yield.

The Cases

Each case shows both firms' counts by severity, with dates and report links. Filter by firm to see every case against it.

What the Counts Don't Show

Guardian chose these cases and wrote this page. Read them as evidence, not as a neutral ranking.

A count is not a quality score. Firms split and grade issues differently, and one well-argued Critical can matter more than ten Lows.

Timing differs too. Where one firm reviewed a later commit, it may have seen fixes the other firm prompted.

That is why every case links both reports. The findings, not the totals, are the real comparison.

How to Compare Audit Firms

1. Read reports on similar code. A firm's work on your kind of protocol says more than its client list.
2. Weigh severe findings. Count Criticals and Highs, and check that each one names a file, a line and a fix.
3. Check fix status. A resolved finding shows the firm followed through.
4. Ask about overlap. Teams that used two firms on the same code know which one found what.

For more, see the top smart contract auditors in 2026 and what top auditors charge.

How Guardian Reviews Code

Guardian's flagship audit, Vanguard, puts two independent teams on the same scope. One uses expert manual review and an invariant fuzzing suite.

The other is driven by Helix, Guardian's AI auditor. Only human-verified findings reach the report.

Guardian publishes its reports in the audit portfolio, so you can read the work behind these numbers.

Frequently Asked Questions

Do different audit firms find different bugs in the same code?

Yes, often by a wide margin. In these 17 cases, the strongest other firm reported between none and 59 findings, and Guardian between 5 and 150. Two careful reviews of one codebase can disagree on what matters most.

Is finding more bugs the same as a better audit?

Not on its own. Counts depend on how a firm grades and splits issues. Severe findings are the better signal: here, Guardian reported more Criticals and Highs than the strongest other firm in 14 of 17 cases, and the same number in the other three.

Can I check these numbers?

Yes. Every count comes from the summary table of a public report, and each case links both firms' reports. Where a case moves findings between tiers, its notes say how.

How should I compare smart contract audit firms?

Read their public reports on code like yours. Look for Criticals and Highs, how specific each finding is, and whether issues were fixed. Ask clients who used more than one firm on the same code which one found what.

Sources

Each case links the reports its counts come from. Most are published by the client or the firm:

• GitHub: GuardianAudits/Audits, Guardian's published reports
• Guardian: Public audit portfolio
• GitHub: LayerZero-Labs/Audits
• GitHub: OrderlyNetwork/Audits
• GitHub: gmx-io/gmx-synthetics audits
• GitHub: sherlock-protocol/sherlock-reports
• GitHub: pashov/audits
• GitHub: Cyfrin/cyfrin-audit-reports