Audit Remediation Timelines: Data From 93 Guardian Reports
Quick answer. In 93 Guardian audit reports with dated rounds, the fix review began a median 11 days after the main review ended. Fixes were verified a median 14 days after it; the reports hold no fix-commit times.
Video transcript
How long do smart contract teams take to fix audit findings? Guardian measured 93 of its own public reports to find out.
The fix review began a median 11 days after the main review ended. Fixes were verified a median 14 days after it.
Reports date review rounds, not fix commits, so the gap mixes fix work with scheduling.
The fix review itself is short. Extra rounds stretch the timeline: two or more fix rounds took a median 57.5 days to verify, against 13 for one.
Reports with a Critical do not move faster. The number of findings tracks the window more closely than severity.
Not everything gets fixed. Across 320 reports, 24.9 percent of Criticals and Highs were not fully resolved, so read each resolution text.
Fix reviews find new bugs too, with a new Critical or High in 39 reports. At Abracadabra Money a fix introduced a denial of service, at ULLR a High was only partially fixed, and at Synthetix a function lost access control.
To shorten the cycle, book the fix review with the audit, fix Criticals and Highs first, keep the fix branch small, add a test for every fix, and re-run the full test and fuzzing suite.
Read the full benchmark, or plan your fix review with Guardian at guardian.security.
Mean time to remediate is a standard web2 security metric. For smart contract audits, the closest public record is the audit report itself.
So we measured what Guardian's public reports record: when each review round ran, and what happened to each finding.
This is a benchmark of the fix window between review rounds, not of how fast anyone writes code.
It is a companion to our Critical findings report, which uses the same portfolio.
How We Counted
The dataset is Guardian's public portfolio as of November 5, 2026: 320 reports for 99 clients, dated March 2022 to October 2026, with 9,617 findings.
Our Critical findings report counted 337 reports and 360 Criticals before 17 reports left the portfolio; here the counts are 320 and 343.
Each report lists its review rounds, and each finding records its severity, status and the round it was raised in. We used three measures:
- Fix window: days from the main review's last day to the first remediation review's first day.
- Time to verified fixes: days from the main review's end to the end of the last fix round.
- Fix rate: each finding's final status in the published report.
124 reports record a remediation round. 93 of them, for 52 clients from 2024 to 2026, date both rounds. Those 93 are the timing sample.
What the data cannot show
- When a fix was written. Rounds list commit hashes, not commit times.
- When each finding reached the team. The reports date rounds, not individual findings.
- Who was waiting. The gap mixes the team's fix time with scheduling.
- Single-round reports. 193 reports record statuses but no separate fix review dates.
Dates are whole days. GMX accounts for 10 of the 93 reports, the most of any client.
How Long the Fix Window Runs
The median fix window is 11 days. Half of the reports fall between 5 and 17 days.
The mean is 13.8 days, pulled up by eight gaps of more than a month. The longest is 100 days.
| Fix window | Reports | Share of 93 |
|---|---|---|
| Same day or overlapping | 7 | 7.5% |
| 1 to 7 days | 25 | 26.9% |
| 8 to 14 days | 30 | 32.3% |
| 15 to 30 days | 23 | 24.7% |
| Over 30 days | 8 | 8.6% |
Two in three fix reviews (66.7%) started within two weeks of the main review.
Four reports date the fix round before the main review's recorded end. We kept them as negative gaps.
Time to verified fixes
Fixes were verified a median 14 days after the main review ended, and 82.8% within 30 days.
The fix review itself is short. The first fix round spanned a median 1 day from start date to end date, against 6 days for the main review.
Extra rounds are what stretch the timeline. 14 of the 93 reports (15.1%) needed two or more fix rounds.
Their fixes took a median 57.5 days to verify, against 13 days for reports with one round.
By Severity, Size and Sector
A report's findings are fixed together. So we grouped reports by the most severe finding in the main review.
| Top severity | Reports | Median fix window | Median to verified | Median main-review findings |
|---|---|---|---|---|
| Critical | 23 | 13 days | 17 days | 38 |
| High | 33 | 13 days | 18 days | 34 |
| Medium | 19 | 12 days | 14 days | 18 |
| Low or Info | 18 | 4.5 days | 5 days | 8.5 |
Reports with a Critical do not move faster. Their fix window matches reports topped by a High or Medium.
The number of main-review findings tracks the window more closely than severity. Reports with a Critical carry a median 38.
- 1 to 9 findings: median fix window of 5.5 days (18 reports).
- 10 to 24 findings: 10 days (33 reports).
- 25 or more findings: 14.5 days (42 reports).
Among sectors with eight or more reports, stablecoins had the shortest median window: 5 days across 13 reports. Lending had the longest, 14 days across 8.
Perpetuals, the largest group, sat at 11 days across 25 reports. The reports do not record team size, so we cannot split by it.
What Gets Fixed
Across all 320 reports, the share of findings resolved rises with severity.
| Severity | Findings | Resolved | Acknowledged | Other |
|---|---|---|---|---|
| Critical | 343 | 84.5% | 7.0% | 8.5% |
| High | 845 | 71.2% | 17.6% | 11.1% |
| Medium | 2,133 | 52.9% | 36.1% | 11.0% |
| Low | 4,234 | 49.4% | 43.2% | 7.3% |
| Info | 2,062 | 41.8% | 48.4% | 9.8% |
"Other" is mostly partially resolved findings and findings with no final status.
296 of the 1,188 Criticals and Highs (24.9%) were not fully resolved in the published report.
Acknowledged means no fix was recorded in that report. It can reflect a design decision or a later fix, so read the resolution text.
Fix reviews find new bugs
116 of the 124 reports with a remediation round record new findings raised during it: 1,381 in all.
Most are Low or Info. But 39 reports record a new Critical or High, 127 in total.
The reports do not tag which new findings came from a fix. Some say so directly:
- Abracadabra Money OFT (H-01): a fix for an earlier finding "introduces a more serious problem", a High denial of service.
- ULLR Token Locker (H-02): an earlier High was only partially fixed, so the owner could still exit a lock early.
- Synthetix Update Reviews (C-01): a function "no longer has access control", letting anyone block a user's withdrawals.
All three were resolved in the final report.
How Web2 Benchmarks Compare
A large web2 benchmark is Cobalt's State of Pentesting Report 2025, analyzed by the Cyentia Institute. It covers over 16,000 pentests across more than 2,700 organizations.
| Measure | Cobalt pentests | Guardian audits |
|---|---|---|
| Median time, all findings | 67 days to resolve | 11 days to fix review; 14 to verify |
| Median time, serious findings | 37 days to resolve (2024) | Not measured per finding |
| All findings resolved | 48% | 51.7% |
| Serious findings resolved | 69% | 75.1% (Critical and High) |
Cobalt calls a finding serious when it is rated high or very high. Its 37 days is down from 112 in 2017.
Three-quarters of the organizations Cobalt surveyed set a deadline of two weeks or less for fixing pentest findings.
The clocks are not the same. Cobalt measures from a finding to its resolution in running systems.
Ours measures calendar gaps between review rounds, usually on code that is not yet live. Treat the comparison as context, not a ranking.
The resolution rates are close. In both, about half of all findings are not resolved, and so are a quarter to a third of serious ones.
Shortening Your Fix Cycle
The data points to two levers: fewer open findings at the end of the main review, and fewer extra fix rounds.
- Book the fix review with the audit. Eight of the 93 fix windows ran past a month.
- Fix Criticals and Highs first. Start on them as soon as they are confirmed.
- Keep the fix branch small. One change per finding, tagged with its ID, and no new features.
- Add a test for every fix. Reproduce the finding, then prove the fix stops it.
- Re-run the full test and fuzzing suite. New bugs in fix rounds are common.
- Explain every acknowledged finding. A public report shows every open finding and its resolution text.
If the fixes grow into new features, plan a new review. Our guide on when you need a re-audit covers the triggers.
Preparation matters before the main review too. See how to prepare for a smart contract audit.
How Guardian Handles Fixes
A Guardian smart contract audit makes three passes over one codebase: design review, an invariant fuzzing suite and senior manual review.
On a Vanguard audit, the invariant suite outlives the audit as a reusable harness for fixes, retesting and later changes.
Vanguard also reviews changes to the audited scope for six months after production, up to 2,500 smart contract SLOC.
Guardian's public reports are in the portfolio, with the round and final status of each finding.
Changes need review after launch too. Our report on Critical bugs in post-launch updates shows why.
Frequently Asked Questions
How long do teams take to fix smart contract audit findings?
In 93 Guardian reports with dated rounds, the fix review began a median 11 days after the main review ended, and fixes were verified a median 14 days after it. Two in three fix reviews started within two weeks.
What is mean time to remediate?
Mean time to remediate (MTTR) is the average time from finding a vulnerability to fixing it. Guardian's reports record review rounds, not fix commits, so we report the gap between rounds: a mean of 13.8 days, median 11.
Do teams fix every audit finding?
No. In 320 published reports, 84.5% of Criticals, 71.2% of Highs and 51.7% of all findings were resolved. Acknowledged findings have no fix recorded in that report, so read each resolution before relying on an audit.
Can a fix review find new bugs?
Yes. 116 of the 124 reports with a remediation round record new findings raised during it, including 16 Criticals and 111 Highs across 39 reports. Some reports say the new issue came from a fix.
Sources
- Guardian: Public audit portfolio, 320 reports and 9,617 findings (as of November 5, 2026)
- GitHub: GuardianAudits/Audits, the published report PDFs
- Guardian: Abracadabra Money OFT (December 14, 2024)
- Guardian: ULLR Token Locker (July 21, 2025)
- Guardian: Synthetix Update Reviews (December 1, 2025)
- Cobalt and Cyentia Institute: State of Pentesting Report 2025 (2025)
- Cobalt: Key Takeaways, State of Pentesting Report 2025 (April 14, 2025)
- Guardian: Vanguard audit
Plan your fix review with Guardian
Get an audit with an invariant suite your team keeps as a harness for every fix and retest.