Smart Contract Audit vs Continuous Security Monitoring
Quick answer. Yes, if your contracts hold value or anyone holds an admin key, signer seat or upgrade right.
An audit reviews code at one commit; monitoring watches the live system. In Guardian's database of $10M+ hacks since 2025, offchain attacks took 91% of the value.
Video transcript
An audit covers one commit, but your protocol keeps changing. If contracts hold value or anyone holds an admin key, you need monitoring too.
An audit reads the code before release. Monitoring watches the deployed system on every block.
Abu Dhabi's FSRA notes that audits lose validity when the code changes. Monitoring has the opposite gap: it sees an attack start, not the bug behind it.
TRM Labs found infrastructure and operational compromises were about 15 percent of hacks in the first half of 2026, but about 76 percent of funds stolen.
Guardian's crypto hacks database points the same way. In 41 hacks of 10 million dollars or more, offchain attacks took 91 percent of the value.
Audits still matter. But every upgrade, integration, key rotation or new chain reaches a live system holding funds. Over half of Guardian's public update reports found a Critical or High.
Before launch, get a full audit and a fix review. At launch, monitoring goes live before the first deposit. After launch and after every upgrade, review each change and keep watching.
Guardian audits end with a fix review, and Vanguard adds six months of update review. Managed Security watches every block and your offchain infrastructure, with a Guardian engineer responding.
Read the full article for what to ask a monitoring provider, or talk to Guardian about covering every change after the audit.
Most teams buy an audit before launch. The harder decision is what to buy after it.
The report covers one commit. The protocol keeps changing: new code, new integrations, new signers, new chains.
Here is what each control catches, where losses actually come from, and what to buy at each stage.
Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.
Point-in-Time vs Continuous Security
An audit reads the code. Monitoring watches what the deployed system does.
| Smart contract audit | Continuous monitoring | |
|---|---|---|
| When it runs | Before launch or a change, at one commit | Every block, for as long as the system runs |
| What it examines | Source code in a defined scope | Deployed contracts, roles, signers, dependencies and infrastructure |
| What it catches | Logic, accounting, access control and math bugs before release | Admin actions, upgrades, oracle moves, governance and signer activity |
| What it misses | Code changed later; keys, signers and infrastructure | Bugs nobody has triggered yet |
| What you get | A report with findings and reviewed fixes | Alerts, and a response if someone acts on them |
The FSRA, the regulator in Abu Dhabi Global Market (ADGM), sets out the audit's limits in its October 2026 draft DeFi guidance.
Audits "provide point-in-time assurance over a defined scope, may not identify novel attack vectors, and lose validity when the code changes."
Monitoring has the opposite gap. It sees an attack once it starts, not the bug that made it possible.
Where Losses Come From
Code bugs are the most common attack. Keys, signers and infrastructure are where most of the money goes.
TRM Labs counted 207 hacks in the first half of 2026, worth $972 million. Smart contract exploits were 125 of them.
Infrastructure and operational compromises were about 15% of incidents, but about 76% of the funds stolen.
Guardian's crypto hacks database shows where the money went in large incidents. It counts 41 hacks of $10 million or more from January 2025 to November 10, 2026, worth $10.58 billion.
Offchain attacks took 91% of that value, across 29 of the 41 incidents. Without Binance, the offchain share is still 78%.
Contract and protocol bugs were 9 incidents and 7% of the value.
None of this argues against audits. TRM says organizations should keep investing in them.
It argues against treating the audit as the whole program. For audited protocols specifically, see what the loss data shows about audits.
What Changes After Launch
Each change below reaches a system that already holds funds.
| Change | Review before it ships | Watch after it lands |
|---|---|---|
| Contract upgrade | Diff review against the audited commit | Implementation changes outside a planned release |
| New integration | Assumptions about the other protocol's behavior | That protocol's upgrades, pauses and admin actions |
| Parameter change | New limits and fees against the invariants | Changes that bypass governance or the timelock |
| Key rotation | New signers, threshold and signing setup | Owner, threshold, module and guard changes |
| New chain deployment | Deployed bytecode and config against the audited commit | Roles, peers and limits on the new chain |
Fixes are changes too
A fix is new code, often written fast, to close a finding. It needs the same review.
In Guardian's Synthetix update reviews, the fix review found that the changed code left the withdrawal request function with no access control.
Each user can hold only one withdrawal at a time. So anyone could open a 1 wei withdrawal for any user, and keep them from withdrawing their funds (Critical, Synthetix review, resolved).
Updates carry their own risk. Guardian's public portfolio holds more than 40 onchain reports titled as updates or upgrades, and more than half found a Critical or High.
Which to Buy, by Stage
Use this as a starting point, and scale each line to the value at risk.
| Stage | Review | Monitoring |
|---|---|---|
| Pre-launch | Full audit at a frozen commit, then a fix review | Write detections for every role, pause and invariant |
| Launch | Deployed bytecode and config matched to the audited commit | Live before the first deposit, with a tested pause path |
| After launch | A bug bounty, and review of every change before it ships | Contracts, signers, oracles, governance and infrastructure, around the clock |
| After an upgrade | Diff review of the change and its fixes | Detections updated for new contracts, roles and events |
| Institutional deployment | Due diligence on audit scope, history and admin powers | The protocols you use, even though you cannot pause them |
ADGM's FSRA writes both controls into its draft DeFi guidance for institutions. The draft is open for comment until November 30, 2026, and applies to Authorised Persons and Recognised Bodies, not protocols.
Among its desired outcomes, a firm considers a protocol's audit history "before initiating engagement and at intervals during the engagement as part of its ongoing monitoring" (3.4.3).
Questions for a Monitoring Provider
Alerts are cheap. What you are buying is the response behind them.
| Question | Good answer | Red flag |
|---|---|---|
| Who acts, and how? | Actions, roles and escalation agreed in writing beforehand | Notification only, with no agreed actions |
| Do detections cover your audit's invariants? | Live checks for the invariants and roles your audit tested | Generic exploit signatures only |
The last row decides what a monitor can see. NEAR Intents' monitoring only compared origin-chain assets with NEAR-side token totals, ChainCatcher reported from its post-mortem.
It did not compare users' internal balances with the tokens the contract held. An attacker withdrew about $3.8 million between September 29 and October 1, 2026.
The funds were later returned. The team has since added that check, with an automatic pause on a mismatch.
To compare platforms, see the best smart contract monitoring tools. For the service model, read what Web3 MDR is.
Guardian's Update Review and Response
A Guardian smart contract audit ends with a fix review. The invariant suite stays with you for every later change.
Vanguard adds six months of update review after production, for changes to the audited scope: up to 2,500 smart contract SLOC, or 10,000 SLOC for offchain codebases. Every change is audited at the same standard.
Managed Security covers the live system. Guardian monitors your contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.
Offchain, Sentry watches your domains, DNS, certificates, cloud and code host. When something fires, a Guardian engineer responds.
Guardian's security operations team also reviews every multisig transaction before it is signed, and every deployment and configuration change as it lands.
Frequently Asked Questions
Is the deployed code always the audited code?
Not always. Guardian checked 25 deployed contracts from five of its public reports against the final reviewed commit: 15 matched. The other 10 matched later commits in the clients' repositories, and nine came from one report.
Can we monitor protocols we do not control?
Yes: chain state is public, so you can watch their admin actions, upgrades and oracles. The FSRA's draft lists, as a desired outcome, procedures for pausing your own engagement, withdrawing assets or revoking delegated permissions where you can (3.4.3).
Sources
- TRM Labs: H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion (July 1, 2026)
- Guardian: Crypto Hacks Database, Every Major Exploit Since 2025 (November 10, 2026)
- ADGM FSRA: Consultation Paper No. 5 of 2026, DeFi Risk Management Guidance (6 October 2026)
- ADGM FSRA: Attachment 1, Proposed DeFi Risk Management Guidance, paragraphs 3.4.2 and 3.4.3 (6 October 2026)
- ChainCatcher: NEAR Intents released a post-mortem report, revealing that the $3.8 million vulnerability originated from a deposit notification flaw (October 17, 2026)
- Guardian: Synthetix Update Reviews report (December 1, 2025)
- Guardian: Public audit portfolio (as of November 10, 2026)
- Guardian: Deployed vs Audited Code: What Bytecode Verification Found (November 5, 2026)
- Guardian: Smart Contract Audit Services
- Guardian: Vanguard, Enterprise Smart Contract Audit
- Guardian: Managed Security
Cover the commit and every change after it
Guardian reviews the updates you ship and puts an engineer behind the alerts on your live system, onchain and off.