How to Choose a Smart Contract Auditor: 15 Questions to Ask

By the Guardian team Updated November 2026 5 min read

Quick answer. Ask who will review your code, what similar code they have audited, which methods they use, how many fix reviews are included, and what the report will show. Then ask for proof: named reviewers and public reports.

Watch: How to Choose a Smart Contract Auditor: 15 Questions to Ask 1:34

Video transcript

Two firms can quote the same price for very different work. So ask the right questions, then demand proof.

Sherlock, which sells audits, says quotes for similar scopes can range from 15,000 to 150,000 dollars. Price alone tells you little.

The questions fall into five areas: the team, past work, methodology, fix review terms, and the report.

Ask for named reviewers and public reports on similar code. The Security Alliance says the best way to evaluate security reviewers is their historical performance.

Ask which methods they use, and whether serious findings come with a proof of concept. Scanners are the floor, not the audit.

The first report is not the end. Sherlock says each re-audit round typically adds 5,000 to 20,000 dollars, so budget for fix reviews up front.

Walk away from withheld reviewer names, logos with no reports, scanner-style reports, no fix review, or any guarantee of finding every bug.

Score each firm zero, one or two in six areas. The maximum is twelve, and ten or more earns a price conversation.

Guardian publishes this guide. Vanguard puts two independent teams on one scope, and only human-verified findings reach the report. A Defender contest and six months of updates follow.

Read the full article for all fifteen questions, then score Guardian against your other quotes at guardian.security.

Audit quotes look alike on paper. Two firms can quote the same price for very different work.

Sherlock, which sells audits, says in its 2026 pricing reference that quotes for functionally similar scopes can range from $15,000 to $150,000.

Price alone tells you little.

This scorecard turns the choice into 15 questions, the evidence to request for each, and the answers that should end the conversation. For firm-by-firm profiles, see our top smart contract auditors ranking.

Who Is on the Team

The firm's name goes on the report. The reviewers do the work.

Who are the named reviewers, and what have they found before?
How many reviewers, for how many engineer-weeks?
Will the same people run the fix review?

Ask for: names or handles, their past reports and contest results, and the staffing plan written into the quote.

Red flag: a firm that will not say who reviews your code until you sign.

Relevant Past Work

The Security Alliance (SEAL) puts it plainly: "the best way to evaluate security reviewers is their historical performance."

Which public reports cover code like ours: same language, chain and protocol type?
What did those reports find, and at which severities?
Were any audited protocols exploited later, and what did the firm do?

Ask for: links to three or more public reports on similar code. Then search the firm and its reviewers on Solodit, Cyfrin's open database of audit findings.

A past exploit is not a verdict on its own. SEAL notes that a hacked codebase "doesn't mean that the team is bad." Check what was in scope, and how the firm responded.

Red flag: a wall of client logos with no reports behind it. SEAL advises choosing on domain fit, method and evidence of quality, "not logo count alone."

Methodology

Methods differ by firm, and the method decides what gets found. Our guide to what a smart contract audit is covers the main ones.

Which methods will you use: manual review, fuzzing, formal verification, AI?
Will you review the design and economics, or only the code?
Will each serious finding come with a proof of concept?

Ask for: a sample report with proofs of concept, and a sample invariant suite if fuzzing is in the quote.

SEAL's checklist says to "verify they use appropriate automated security tools" and "ensure they conduct thorough manual code reviews." Scanners are the floor, not the audit.

Red flag: a report that reads like scanner output. SEAL's own red flags include "no clear methodology or standardized reporting process."

Fix Review Terms

The first report is the middle of an audit, not the end. Sherlock says "almost every protocol requires at least one remediation review."

How many fix-review rounds are included, and what does another cost?
Will each fix be checked at a new commit and given a status?
Who reviews code we change after the audit, and on what terms?

Ask for: fix-review rounds and update terms in writing. Sherlock says re-audit rounds typically add $5,000 to $20,000 per pass, so budget for them up front.

Red flag: a final report issued before anyone has checked your fixes.

Report and Publication

SEAL's guidance is blunt: audits assess code at a specific commit hash, and "any changes create unaudited code."

Will the report list the commit for every round?
Can we publish the full report, and when?
Who decides severity, and how do we dispute a rating?

Ask for: a sample public report. Guardian's EthenaLock report (October 2026), for example, names its four reviewers and the commit for each round.

Red flag: a guarantee. SEAL's red flags include "vendors who guarantee finding all vulnerabilities," and ethereum.org says audits "won't catch every bug."

The Scorecard

Score each firm 0, 1 or 2 in every row, then compare totals before you compare prices.

Area	2 points	0 points
Team	Named reviewers with relevant reports	Names withheld until signing
Past work	Public reports on code like yours	Logos with no reports
Methodology	Manual review plus fuzzing or proofs, in writing	Tools named, method unclear
Fix review	Rounds and update terms in the quote	No fix review included
Report	Commits per round, publishable	A badge or score, no findings
Price	Engineer-weeks and scope in writing	Very low price, vague scope

The last row follows SEAL, which flags "extremely low pricing without clear scope limitations."

The maximum is 12. A firm scoring 10 or more is worth a price conversation. Check the number against our audit cost estimator and what top auditors charge.

Changing firms mid-roadmap? Our CertiK alternatives guide has a handover checklist.

How Guardian Answers Them

Vanguard, Guardian's flagship audit, puts two independent teams on one scope.

Team A: expert manual review with an invariant fuzzing suite.
Team B: driven by Helix, Guardian's AI auditor.
The report: only human-verified findings reach it.
After the report: a $100,000 Defender contest and a bug bounty with $50,000 in Critical matching.
Updates: six months of review, up to 2,500 onchain or 10,000 offchain SLOC.

Guardian has reported 300+ Critical vulnerabilities. Its public reports are in the audit portfolio, so you can score its past work yourself.

Frequently Asked Questions

What questions should I ask a smart contract auditor?

Ask who reviews the code, what similar code they have audited, which methods they use, how many fix reviews are included, and what the report will show. Then request evidence for each answer.

How do I check an audit firm's track record?

Read its public reports on code like yours, and search the firm and its reviewers on Solodit. SEAL calls historical performance the best way to judge reviewers; a hacked client alone does not mean a bad team.

What are the red flags when hiring an auditor?

SEAL lists guarantees of finding all vulnerabilities, extremely low pricing without clear scope, no relevant experience, poor communication and no clear methodology. Add withheld reviewer names, no fix review, and reports without commit hashes.

Should I choose the cheapest smart contract audit?

Not on price alone. Sherlock says quotes for similar scopes can range from $15,000 to $150,000. Compare engineer-weeks, named reviewers, methods and fix-review rounds first, then price.

Sources

Score Guardian against your other quotes

Send your repository and commit, and get a Vanguard quote with the team, methods and fix-review terms in writing.

Talk to Guardian Get a Vanguard quote