Smart Contract Audit RFP Template for Institutions

Video transcript

Institutions need audit proposals they can compare, file and defend to a risk committee. A request for proposal gives every firm the same scope and the same questions.

Settle the scope first. Freeze a commit, count source lines in each file, sign NDAs before sharing a private repository, and take pricing privately, as Compound's 2025 security RFP did.

The template has six sections: background and scope, timeline, deliverables, team and methodology, conflicts and disclosure, and finally response format and evaluation.

Ask for more than a report. SEAL lists fix review, re-review of fixes and residual risk analysis as deliverables. Settle publication rights up front too.

Then publish how you will score. In this example, team and track record carries thirty percent, methodology twenty five, and the rest fifteen each. Set your own weights before responses arrive.

SEAL advises choosing vendors on domain fit, method and evidence of quality, not logo count alone. Interview the leaders, and compare person-weeks and scope before price.

Guardian, which publishes this template, scopes institutional reviews by what the code can move. Two competing teams, one manual and one AI-driven, work above invariant fuzzing, and findings are tracked through fix and re-review.

Read the full template and copy it into your document. Or send Guardian your audit RFP, starting with the low-commitment Digital Asset Assurance Pilot.

A call and a quote are enough for some audits. Institutions need something they can compare, file and defend to a risk committee.

A request for proposal gives every firm the same scope and the same questions. The answers then line up side by side.

Copy the six sections below. For follow-up questions and red flags, use our 15-question auditor scorecard.

Before You Send It

An RFP is only as comparable as its scope. Settle these first:

• Freeze a commit. Firms quote the code at one commit, so scope it there.
• Count nSLOC per file. Solidity Metrics, the tool Sherlock uses, does it.
• Shortlist firms with public reports on code like yours.
• Sign NDAs before sharing a private repository.
• Take pricing privately, as Compound's 2025 security RFP did.

Our guide to audit scoping covers how to set the file list and exclusions.

The RFP Template

Paste each section into your document. Keep the numbers, so responses map back to them.

1. Background and scope

• Organization: legal name, regulators and the audit owner.
• System: what it does, target chains and expected value held.
• Repository: URL, branch and how access is granted.
• Commit: the frozen commit hash to review.
• Files in scope: path and nSLOC for each, including scripts and config.
• Out of scope: excluded files, and what auditors may assume about them.
• Dependencies: libraries, oracles, bridges and admin roles the code trusts.
• Documentation: specifications, diagrams, test suite and coverage.
• Prior audits: earlier reports and known issues.

Ask each firm to confirm the scope, or say what it would add and why.

2. Timeline

• Response deadline: date, time and time zone.
• Questions: the window for vendor questions, and how answers are shared.
• Start: preferred start and latest acceptable start.
• Code freeze: when the final commit is handed over.
• First report: target date.
• Fix review: the window for fixes and re-review.
• Launch: target date, and whether it can move.

Ask for each firm's earliest start and review length. Our guide to how long an audit takes gives published benchmarks.

3. Deliverables

• Report: each finding with severity, impact, proof of concept and recommended fix.
• Severity scale: its definitions, and who settles disputes.
• Commits: the commit reviewed in every round.
• Fix review: rounds included, and the status given to each finding.
• Residual risk: what remains open or out of scope at the end.
• Readout: a walkthrough of findings with your engineers.
• Public report: whether you may publish it, when, and any embargo.

SEAL lists a fix review period, a re-review of fixes and a residual risk analysis as audit deliverables. Trail of Bits lists a live walkthrough and fix-review retest.

4. Team and methodology

• Named reviewers: role, past reports and time on this engagement.
• Staffing: reviewer count and total person-weeks.
• Continuity: whether the same people run the fix review.
• Subcontractors: any reviewer who is not an employee.
• Methods: manual review, fuzzing, formal verification and AI tools, and what each covers.
• Coverage: how you will show every file in scope was reviewed.
• Relevant work: three public reports on similar code.

Keep this section to facts you can check. Save judgment questions for the interview.

5. Conflicts and disclosure

• Conflicts: current or recent work for competitors, or on forks of this code.
• Confidentiality: how code, findings and drafts are stored and shared.
• Disclosure: who learns of a finding, and when, before fixes ship.
• Third-party bugs: how you report a flaw found in a dependency.
• Liability: insurance held, and the liability cap proposed.
• Assurance: attestations held, such as SOC 2, and their status.

Compound's 2025 RFP asked vendors to disclose work with competitors or forks, and their confidentiality safeguards.

6. Response format and evaluation

• Format: answers in the section order above, with pricing sent separately.
• Pricing: total, person-weeks, fix-review rounds, and anything billed extra.
• Submission: where to send the proposal, and to whom.

Then publish how you will score. Here is an example; set your own weights before responses arrive.

Compound's RFP was for a 12-month security provider, not one audit. It named four criteria: technical expertise, reputation and track record, familiarity with Compound, and capacity and communication.

SEAL advises picking vendors for domain fit, method and evidence of quality, "not logo count alone."

After the Responses

1. Score each response against the published weights.
2. Interview the leaders. Compound held interviews within its evaluation window.
3. Compare person-weeks and scope before price. Our cost estimator helps check a quote.
4. Write the chosen scope, rounds and dates into the contract.

Reviewing the vendor itself, beyond the audit? Use our vendor due diligence questionnaire.

How Guardian Responds

Guardian scopes each smart contract audit from your repository and commit. For institutions, it scopes pre-production reviews "by what the code can move rather than by line count alone."

• Method: two competing teams, one manual and one AI-driven, with invariant fuzzing beneath both.
• Fix review: findings tracked through fix and re-review; without that, a report is "half a deliverable."
• Vendor assurance: aligned with NIST CSF 2.0 and CCSS; SOC 2 Type II auditor engaged.

The Digital Asset Assurance Pilot is a low-commitment start, built for vendor approval.

Frequently Asked Questions

What should a smart contract audit RFP include?

The scope (repository, commit, files and nSLOC), the timeline, and the deliverables, including fix review and publication rights. Add questions on the team, methods and conflicts, a response format, and the criteria you will score against.

How long should vendors get to respond to an audit RFP?

Long enough to read the code before quoting. Compound's 2025 security RFP took proposals from July 7 to 18 and interviewed from July 15 to 22. Answer vendor questions in writing and share the answers with every firm.

Should pricing be public in an audit RFP?

Usually not. Compound's 2025 security RFP took pricing privately, separate from the public proposals. Ask for person-weeks and fix-review rounds next to the price, so quotes compare like for like.

What evaluation criteria should an audit RFP use?

Weigh the team and track record, methodology, deliverables, timeline and price, and publish the weights. SEAL advises picking vendors on domain fit, method and evidence of quality, not logo count alone.

Sources

• Compound forum: Request for Proposal, Compound DAO Security Service Provider (July 7, 2025)
• Security Alliance (SEAL) Frameworks: Vendor Selection (v0.0.2, accessed Nov 5, 2026)
• Security Alliance (SEAL) Frameworks: What to Expect from a Smart Contract Audit (v0.0.2, accessed Nov 5, 2026)
• Sherlock docs: Audit Contest Timeline, nSLOC sizing (accessed Nov 5, 2026)
• Trail of Bits: Blockchain assessments, deliverables (accessed Nov 5, 2026)
• Guardian: Institutional
• Guardian: Digital Asset Assurance Pilot
• Guardian: How to Choose a Smart Contract Auditor