How Long Does a Smart Contract Audit Take?

By the Guardian team Updated November 2026 5 min read

Quick answer. A smart contract audit takes 1 to 2 weeks under 1,000 lines, 2 to 5 weeks up to 4,000, and 5+ weeks beyond, by SEAL's rough guide. Add lead time, fixes and a fix review.

Watch: How Long Does a Smart Contract Audit Take? 1:33

Video transcript

An audit date usually sets your launch date. So the real question is how long the whole cycle takes, not just the review.

Size comes first, and complexity moves the numbers. SEAL, the Security Alliance, roughly estimates one to two weeks under a thousand lines, two to five weeks up to four thousand, and five or more beyond.

Guardian's published reports put the median main review at eight working days for one to two thousand lines.

Review is one stage of seven. Scope and book a slot, then freeze the commit before kickoff. After the review and report come your fixes and a fix review.

No firm we read publishes a standard lead time. Sherlock says firm audits vary by team availability. Ask for a start date before you set a launch date.

Expect at least one remediation review. In two Guardian reports, fix reviews took two and four days, after a one to two week gap.

The platforms name the usual delays: code that is not ready, missing payment or access, scope that grows once integrations are counted, and many findings.

To go faster, cut the waiting, not the review. Contact firms early, freeze code before your slot, add reviewers in parallel. Unreviewed fixes move risk, not time.

Read the full guide, or talk to Guardian at guardian.security to plan your audit around your launch.

An audit date usually sets a launch date. So the useful question is how long the whole cycle takes, not just the review.

That cycle runs from booking to a final report on fixed code. The review sits in the middle.

This guide covers each stage, with durations from the firms and platforms that publish them. For prices, see our audit cost estimator.

Review Length by Size

Size is the starting point, usually counted in nSLOC: non-comment source lines of code.

The Security Alliance (SEAL) publishes rough durations by size:

Codebase size	SEAL estimate
Under 1,000 lines	1 to 2 weeks
1,000 to 4,000 lines	2 to 5 weeks
Over 4,000 lines	5+ weeks

SEAL calls these "incredibly rough estimates." Actual timelines, it says, "will vary significantly based on the complexity of the codebase."

Guardian's published reports put the median main review at 8 working days for 1,001 to 2,000 nSLOC. Our cost estimator has the full table by size, and Sherlock's contest windows.

Oracles, external calls, novel math and multi-chain code all add time. Our guide to audit scoping covers what auditors weigh.

The Full Timeline

Review is one stage of seven. Here is what published processes say about each.

Stage	What happens	Published timing
1. Scoping	Repository, commit and files agreed	CodeHawks makes contact within two days
2. Booking	A slot is reserved	No published standard (see below)
3. Code freeze	Final commit and file list handed over	Sherlock: about 72 hours before kickoff
4. Review	Auditors read, test and write findings	The size table above
5. Report	Findings written up or judged	CodeHawks: a day or so after appeals close
6. Fixes	Your team patches the findings	Sherlock: depends on the number and complexity of findings
7. Fix review	Auditors check each fix	CodeHawks: "much faster than the initial audit phase"

Lead time

No firm we read publishes a standard lead time. Sherlock says firm audits "vary by team availability."

CodeHawks takes requests with at least three days' notice. Code4rena, which is winding down, locked audits into its schedule only after a deposit, "due to high demand."

Ask each firm for its next start date before you fix a launch date.

Fixes and fix review

The first report is not the end. Sherlock says "almost every protocol requires at least one remediation review."

Two Guardian reports show the shape:

Jones DAO jGM: main review April 2 to 15, 2024; fix review April 21 to 24.
Synthetix Auto-Compound LP Vault: main review April 14 to 23, 2025; fix review May 6 to 7.

The fix reviews ran four and two days. They began six and thirteen days after the main review ended.

Sherlock requires High findings fixed and signed off before a Collaborative Audit is complete. When a patch set is large, it recommends a short follow-up review.

What Slows Audits Down

These are the delays the platforms themselves name.

Code that is not ready. If the commit misses Sherlock's checklist, it may reschedule or extend the audit.
Missing logistics. Sherlock will not start an audit while payment or access is incomplete.
Scope growth. Sherlock says scope that looks small "often expands once integration dependencies are counted."
Undocumented work in progress. Trail of Bits warns auditors may "waste a week" on code that will soon be gone.
Many findings. More fixes mean a longer remediation and fix review.
Contest judging. On CodeHawks it scales with submissions, then an appeal period follows.

How to Shorten It Safely

Cut the waiting, not the review.

Contact firms when the design is stable, before the code is final.
Freeze the code and meet the readiness checklist before your slot.
Hand over documentation and tests. Our preparation guide lists what.
Split a broad scope into sequenced reviews, as Sherlock may recommend.
Add reviewers in parallel rather than cutting review days.
Keep the fix review. Unreviewed fixes move risk, not time.

Compressed timelines cost more: Sherlock's pricing reference says urgency premiums apply to them.

Plan Around Your Launch

Work backward from the launch date:

Launch: deploy the reviewed commit and verify the bytecode matches.
Fix review: allow days, plus room for a second pass.
Fixes: size them from the report; the examples above left one to two weeks.
Review: from the size table, adjusted for complexity.
Freeze: about three days before kickoff, per Sherlock.
Booking: as early as your scope allows.

A bug bounty and other non-blocking checks can start after launch. Code changed after launch needs its own review: see when you need a re-audit.

Guardian's Audit Timelines

Guardian scopes each smart contract audit from your repository and commit. Published engagements show the range:

Yuga Labs NFT Shadows: two one-week engagements.
IVX options protocol: six auditors over nine days.
Synthetix BFP Market: a four-week engagement.

In Vanguard, Helix, Guardian's AI auditor, spends "several days across hundreds of parallel agents" beside the manual team.

The Defender contest that follows has an adjustable timeline, typically 20 days, and is non-blocking for deployment. Six months of update review follow production.

See all audits and pentests.

Frequently Asked Questions

How long does a smart contract audit take?

SEAL's rough guide is 1 to 2 weeks under 1,000 lines, 2 to 5 weeks from 1,000 to 4,000 lines, and 5+ weeks beyond. Complexity moves those numbers. Fixes and a fix review come after the main review.

How far in advance should you book a smart contract audit?

No firm we read publishes a standard lead time. CodeHawks takes requests with at least three days' notice, while Sherlock says firm audits vary by team availability. Contact firms once your scope is stable, before the code is final.

How long does a fix review take?

It depends on how many fixes there are. In two published Guardian reports, the fix review took two and four days. CodeHawks calls its mitigation reviews much faster than the initial audit phase.

Can a smart contract audit be done in a week?

For a small scope, yes. Code4rena's standard audits ran for one week, and SEAL puts projects under 1,000 lines at 1 to 2 weeks. Sherlock's AI-only pass can run in as little as 2 days, as an extra check.

Sources

Plan your audit around your launch

Send Guardian your repository, commit and launch date, and get your audit scoped before you commit to a date.

Get a Vanguard quote Explore audits