Smart Contract Audit Pricing Models Compared
Quick answer. All three. Many firms size work by nSLOC, build the quote from auditor-weeks and sign a fixed fee for a frozen scope. Retainers instead buy hours over months, and contests fund a prize pool for open competition.
Video transcript
Do auditors charge per line, per week, or a fixed fee? Often all three, and the unit decides who pays when scope grows.
Many firms size by lines, build quotes from auditor-weeks, and sign a fixed fee. Retainers buy hours, and contests fund a prize pool.
Arbitrum's final audit program report averaged 14.8 dollars a line across 24 funded audits. That is one subsidized program, not a tariff.
Underneath most quotes is staff time. Equal totals can hide different staffing, so ask for named reviewers, weeks and rate, and cap extra weeks.
A fixed fee covers a frozen scope. Write in the commit hash, fix-review rounds, change-order triggers and your right to publish.
Retainers buy hours over months. CertiK's 2024 renewal proposal to Venus was 420,000 dollars over 24 months. Unused hours rolled forward, then reset at term end.
A contest buys a window, not a named team, so coverage is uncertain. Code4rena says it is winding down. Contests and bounties add reviewers, but do not replace a scoped audit.
Match the unit to how settled your code is: fixed fee for frozen code, capped auditor-weeks for novel designs, a retainer for monthly upgrades.
Guardian publishes no rate card and quotes each audit per scope. Read the full guide, or request a scoped quote at guardian.security.
Pricing Models Side by Side
Most audit quotes arrive as one number. The pricing unit behind it decides who pays when the scope grows.
Sherlock, which sells audits, puts many 2026 DeFi audits between $25,000 and $100,000, inside a wider range of $5,000 to $250,000 or more. Sherlock
Arbitrum's final Audit Program report, published November 9, 2026, puts its 24 budget-funded audits at an average of $61,575. Arbitrum Foundation
This guide compares the pricing units and where scope risk sits. For a size-based estimate, use our smart contract audit cost estimator.
| Model | You pay for | Who absorbs overruns | Fits best |
|---|---|---|---|
| Per line (nSLOC) | Lines in scope at a quoted rate | Buyer, if the line count grows | Small, stable codebases |
| Auditor-week | Reviewers times weeks times a weekly rate | Buyer, if weeks are added | Novel or complex designs |
| Fixed fee | An agreed total for a frozen scope | Auditor, inside the written scope | Launch audits with frozen code |
| Retainer | A block of hours each month over a term | Buyer: extra hours billed; unused hours reset at term end | Teams shipping frequent upgrades |
| Contest pool | A prize pool shared among valid findings | Buyer sets the pool up front | Code already through a private audit |
| Bug bounty | Rewards per valid finding, by severity | Buyer, as findings arrive | Live code |
Audit Cost per Line of Code
Sherlock says many firms and platforms size audits by nSLOC: non-comment source lines of code. Sherlock
Arbitrum's program shows the rate falling as code grows. Average quoted rates were $47 a line under 1,000 lines, $30 from 1,000 to 3,000, and $15 above. Arbitrum Foundation
Its 24 budget-funded audits covered 99,998 lines for $1,477,810, or $14.8 a line. Arbitrum says that sat very close to the lowest quotes it saw. Arbitrum Foundation
These are figures from one subsidized program, not tariffs. Arbitrum does not say its lines are nSLOC, so compare them with Sherlock's guidance with care. Arbitrum Foundation
Line counts ignore difficulty. Sherlock estimates premiums over EVM code of 25% to 40% for Rust on Solana and 80% to 120% for ZK circuits. Sherlock
The risk sits in the count. Ask which files, interfaces and libraries are counted, and which tool counted them.
Auditor-Week Pricing
Underneath most quotes is staff time. Guardian's estimator models cost as auditors times review weeks times a weekly rate, plus premiums and fix reviews. Guardian Resource Hub
In February 2025, the Arbitrum Foundation argued for a fixed cost per auditor-week with each firm, so every project could share negotiated rates. Arbitrum Foundation forum
The same discussion records a lesson: after terms were agreed, many projects and auditors wanted to change the scope and the terms. Arbitrum Foundation forum
Weekly pricing makes quotes comparable. Two equal totals can hide very different staffing.
Ask for reviewer count, named reviewers, weeks and the weekly rate. Sherlock estimates that a rushed schedule adds 20% to 40%. Sherlock
The risk here is overrun. On a time-based quote, agree a cap and who approves any extra weeks.
Fixed Fee Audits
A fixed fee is an agreed total for a defined commit, file list, methods, deliverables and fix-review rounds. It is not a universal per-line rate.
The fee can be derived from lines or weeks. What changes is who absorbs an overrun inside the agreed scope.
Remediation is where fixed fees drift. Sherlock says re-audit rounds typically add $5,000 to $20,000 per pass and should be budgeted up front. Sherlock
Code changed after the freeze is new scope. Put these terms in the contract:
- The commit hash and file list, with the line-count method named.
- Methods included: manual review, fuzzing, AI-assisted analysis, proofs of concept.
- Fix-review rounds included, and the price of each extra round.
- Change-order triggers: new files, refactors or a moved commit.
- Report deliverables and your right to publish the report.
- Payment schedule, rescheduling rules and cancellation terms.
Retainers and Evergreen Coverage
A retainer buys review capacity over time rather than one report. It suits teams that ship upgrades every month.
In April 2024, CertiK proposed a renewal on the Venus forum: $420,000 over 24 months, or 50 hours a month at $350 an hour. Our CertiK audit cost guide breaks down that record and the Venus payments that followed. Venus Community, Guardian Resource Hub
Unused hours rolled forward within the term but reset to zero at its end. Hours beyond the monthly block were billed at the same rate. Venus Community
Work was to start within 7 business days for jobs of 40 hours or less, and within 14 for larger ones. Venus Community
Each engagement was staffed by two auditors and a security engineer, with at least two returning auditors. Venus Community
Retainers trade flexibility for a fixed monthly commitment.
Contest Prize Pools and Bounties
In a contest, the sponsor funds a prize pool and independent researchers compete to find issues. You pay for a window, not a named team. Code4rena
On Code4rena, submission phases typically ran one to three weeks; judges then rated findings and awards followed its algorithm. Code4rena
Code4rena's homepage says it is winding down and only completing active competitions and bounties. For the terms live platforms publish, see our audit contest vs private audit comparison. Code4rena
Sherlock's February 2026 pricing reference tied contest windows to nSLOC, from about 3 days for 500 nSLOC to 38 for 6,000, with cost scaling in proportion. Its docs now mark audit contests as replaced by Audit Engine. Sherlock, Sherlock Protocol
Coverage is the uncertain part. Who takes part, and how hard they look, is not fixed in advance.
Bug bounties pay per valid finding after launch. Immunefi's own program pays 10% of directly affected funds for Smart Contract Criticals, capped at $50,000 with a $10,000 minimum. Immunefi
A contest or bounty adds reviewers. It does not replace a scoped audit with fix reviews.
Which Model Fits Your Stage
Match the unit to how settled your code is. The less settled it is, the more a fixed price will hide.
Retainers and contests do not restate cleanly in reviewer-weeks. Compare them on hours, start times and pool rules instead.
Guardian publishes no rate card; each smart contract audit is quoted per scope. Guardian Security
| Stage | Model to ask for | What to check |
|---|---|---|
| Pre-launch, code frozen | Fixed fee from a scoped quote | Commit, fix rounds, change orders |
| Novel or complex design | Auditor-weeks with a cap | Named reviewers, weeks, weekly rate |
| Small, simple contracts | Per line or fixed fee | Line-count method, language premium |
| Shipping upgrades monthly | Retainer | Rollover, start times, returning reviewers |
| After a private audit | Contest pool or bug bounty | Platform status, judging, payout terms |
Frequently Asked Questions
What did Arbitrum's audit program find for the money?
Arbitrum's final report counts 510 findings across 25 completed audits for 22 projects, including 17 Critical and 54 High severity issues. Arbitrum Foundation
Do larger audits cost less per line?
In Arbitrum's program, completed audits above 3,000 lines cost $11.5 a line, against $14.8 overall. Arbitrum Foundation
Can an audit retainer be cancelled early?
It depends on the contract. CertiK's 2024 renewal proposal to Venus let Venus terminate at the start of the following month, with at least ten business days' prior written notice. Ask for a similar clause. Venus Community
Related reading
- smart contract audit cost estimator
- audit firm pricing compared
- how to choose a smart contract auditor
- what is a smart contract audit
- audit contest vs private audit
Sources
- Arbitrum Foundation: Arbitrum Audit Program: Q4 & Final Transparency Report
- Sherlock: Smart Contract Audit Pricing: A Market Reference for 2026 (February 18, 2026)
- Arbitrum Foundation forum: Arbitrum Audit Program proposal discussion
- Code4rena: Code4rena Competitions
- Code4rena: Code4rena status
- Immunefi: Immunefi Vault bug bounty information
- Venus Community: Proposal: CertiK Audit Subscription Agreement Renewal
- Guardian Resource Hub: Smart Contract Audit Cost Estimator and Calculator
- Guardian Security: Smart Contract Audit
- Sherlock Protocol: Sherlock v2 documentation index
- Sherlock Protocol: About Audit Engine
- Cyfrin CodeHawks: Payouts and Rewards
- Cyfrin CodeHawks: CodeHawks FAQs
- Venus Protocol: Submitting a VIP
- Guardian Resource Hub: CertiK Audit Cost: What CertiK Charges and What You Get
Get an audit quote tied to a frozen scope
Two independent teams combine expert manual review, Helix AI analysis and invariant fuzzing on one scope. Request a scoped quote and compare reviewer-weeks, fix reviews and change terms.