How to Check if a Smart Contract Is Really Audited
Quick answer. Find the report on the auditor's own website or GitHub, not just the project's copy. Then match its final commit to the deployed contracts, check for upgrades since, and read the status of every High and Critical finding.
Video transcript
Audited is the easiest claim a project can make. In April 2024, CertiK and HashEx both denied auditing ATMA, which claimed audits from both.
Start with the auditor, not the project. Type its address yourself, find its reports page or GitHub, and compare its copy with the project's.
Take the final commit, not the first round. Get addresses from the project's docs, check verification on an explorer or Sourcify, and follow any proxy to its current implementation.
Guardian ran this check on 25 deployed contracts from its own public reports. Fifteen, or 60 percent, matched the final reviewed commit.
Weeks after a CertiK audit, Swaprum disappeared with about 3 million dollars, Decrypt reported. CertiK said the deployer used a proxy upgrade to swap in an unaudited malicious contract.
Then check upgrades since the report and who holds the upgrade keys. Confirm the scope covers every contract holding funds. Read the status of every High and Critical finding.
Watch for red flags like an auditor's logo with no report link, a look-alike domain, a missing commit hash, or an auditor messaging you on Telegram.
Guardian publishes its public reports in a searchable portfolio, 320 so far. If a claimed Guardian report is missing, ask the project which one it means.
Read the full checklist below, or talk to Guardian about an audit anyone can verify.
"Audited" is the easiest security claim a project can make. A logo on a website costs nothing.
In April 2024, CertiK and HashEx both said they were not auditing ATMA, a project that claimed audits from both. ATMA then deleted its social accounts, IBTimes reported.
A real report can still mislead if the code changed after it. This checklist works for any auditor.
Find the Report at the Source
Start with the auditor, not the project. A PDF on the project's site is a copy that anyone could have edited.
- Reach the auditor's website by typing its address, not through a link the project gives you.
- Find its public reports page or GitHub repository.
- Search for the project's name and the report date.
- Compare the two copies: title, dates, findings, statuses and commit hashes.
In November 2025, Least Authority reported finding a modified copy of one of its reports. The copy sat at a URL "designed to resemble our official domain."
Its fix is for auditor and client both to publish, so readers can "compare both instances to verify that they match."
When there is no public copy
Not every audit is public. Least Authority, for one, publishes a report when the client authorizes it.
Ask the project which report it means, then confirm with the auditor through contacts on the auditor's own site. Until it confirms, treat the report as unverified.
Match the Commit to the Deployed Code
A report covers one commit. Users interact with whatever was deployed. Check that the two match.
- Take the final commit: the last fix-review round, not the first.
- Get the addresses from the project's docs or deployment files, not a social post.
- Check verification on a block explorer or Sourcify.
- Follow the proxy to its current implementation.
- Compare each in-scope file with the final commit.
Read the verification label
Etherscan labels verified contracts in several ways:
- Exact Match: the deployed code and constructor arguments match.
- Runtime Match: only the runtime bytecode matches; deployment details may differ.
- Similar Match: the bytecode matches another verified contract. It "does not take into account constructor arguments."
Sourcify's "match" allows different comments and variable names; its "exact match" does not. Sourcify says both function the same.
Follow the proxy
Upgradeable contracts split into a proxy and an implementation. ERC-1967 sets a standard storage slot for the implementation address, so explorers can show it.
Compare the implementation the proxy points to now. The address in a deploy script may be out of date.
What a check turns up
Guardian ran this check on contracts from its own public reports. In 25 deployed contracts from five reports, 15 (60%) matched the final reviewed commit and 10 differed.
Nine of the 10 came from one report. And 12 of the 15 matches would have failed against the first-round commit, because they include the reviewed fixes.
Our deployed vs audited code study has the method.
Check the Date and Later Changes
A report is a snapshot. Anything deployed or upgraded after its final commit sits outside it.
Swaprum shows the gap. In May 2023, weeks after a CertiK audit, the Arbitrum DEX disappeared with about $3 million in user funds, Decrypt reported.
CertiK said the deployer replaced the audited contract with "an unaudited malicious contract" through proxy upgradability. It said its audit had flagged that upgradability as a major vulnerability.
So check three things:
- Upgrade events on each proxy since the report date.
- Who can upgrade, and whether it is a multisig, a timelock or one wallet.
- Whether a later report covers the new code.
For when changes need a new review, see when you need a re-audit.
Read Scope, Severity and Status
A genuine, current report can still cover less than you think.
- Scope: does the file list include every contract that holds funds, mints tokens or controls upgrades?
- Gaps: look for oracles, bridges, deployment scripts and offchain keepers left out.
- Severity: read the report's definitions before comparing counts.
- Status: check every High and Critical. Acknowledged means no fix recorded in the report.
- Privileged roles: read the findings on owners and upgrade keys.
The last point tells you who can change the code you just verified. Swaprum's audit, Decrypt noted, listed three major risks, including that the protocol was "heavily centralized."
Our guide to reading an audit report walks through each section. For what each status implies, see audit finding statuses explained.
Spot Fake or Edited Reports
CertiK says phishing and fraudulent sites have falsely claimed its audits. It reports them to their hosting providers for takedown.
One project, Lymex, listed CertiK as its auditor. CertiK says Lymex never received its services, after failing CertiK's KYC checks.
These signals call for a closer look:
| Signal | What to do |
|---|---|
| An auditor's logo with no report link | Search the auditor's own report list |
| A report only on the project's site | Find the auditor's copy and compare |
| A look-alike auditor domain | Type the auditor's address yourself |
| "Audit in progress" with no auditor statement | Ask the auditor to confirm |
| No commit hash | Ask which code was reviewed |
| An "auditor" messaging you on Telegram | Verify through the auditor's official channels |
| A report older than the last upgrade | Look for a review of the new code |
CertiK points readers to Skynet, its project listing, and to a tool that checks whether an email or social account belongs to its staff.
Where Guardian's Reports Live
Guardian publishes its public reports in a searchable portfolio, 320 so far. Each report page lists every finding with its severity and status, and links the full PDF.
The PDFs sit in Guardian's GitHub repository, GuardianAudits/Audits. Some clients, including GMX and LayerZero, also host Guardian reports in their own repositories.
Not every engagement is public. If a claimed Guardian report is missing, ask the project which report it means.
Guardian also verifies deployments. For USDT0, it matched deployed proxies, implementations and admins byte-exact against the audited source, as the case study describes.
After launch, Managed Security checks deployed addresses, privileged roles and configuration against review. Every deployment and configuration change is reviewed as it lands.
Frequently Asked Questions
How can I tell if a crypto project's audit is real?
Find the report on the auditor's own website or GitHub and compare it with the project's copy. If the auditor does not list it, ask the auditor directly. Until it confirms, treat the claim as unverified.
Does an audit badge prove a project was audited?
No. A badge is an image anyone can copy. CertiK says fraudulent sites have falsely claimed its audits, and CertiK and HashEx both denied auditing ATMA, which claimed both. Check the auditor's own list.
How do I check that deployed code matches the audit?
Take the final reviewed commit from the report. Read the verified source on an explorer or Sourcify, follow any proxy to its current implementation, and compare the in-scope files. Check again after every upgrade.
Can an audited project still rug pull?
Yes. An audit covers code at one commit, not who holds the keys. At Swaprum, CertiK said the deployer swapped in an unaudited malicious contract through an upgrade path its audit had flagged as a major vulnerability.
Sources
- CertiK: Misuse of the CertiK Brand: Fake Audits and Social Media Frauds (January 17, 2024)
- Least Authority: Lessons Learned from a Typosquatted Audit Report (November 26, 2025)
- IBTimes: Protocol Project That Claimed Fake Blockchain Security Audits Vanishes After Callout (April 12, 2024)
- Decrypt: Another CertiK Audited Project Rugs as $3M Disappears From Arbitrum DeFi Exchange (May 19, 2023)
- Etherscan Information Center: Types of Contract Verification (January 10, 2022)
- Sourcify Docs: Exact Match vs Match
- Ethereum Improvement Proposals: ERC-1967, Proxy Storage Slots
- Guardian: Public audit reports on GitHub
- Guardian: Public audit portfolio (320 reports, November 2026)
- Guardian: Deployed vs Audited Code: What Bytecode Verification Found
- Guardian: USDT0 Deployment and Configuration Verification
- Guardian: Managed Security
Ship an audit anyone can verify
Guardian publishes its reports with every finding and status, and verifies that what you deploy is what was reviewed.