Smart Contract Audit vs Pentest: What Each Covers
Quick answer. A smart contract audit reviews contract code at a fixed commit for flaws that could lose or lock funds. A pentest attacks the running systems around it, from apps and APIs to cloud, signers and keepers.
Video transcript
An audit and a pentest answer different questions. One reviews contract code. The other attacks the running systems around it.
Guardian's analysis found keys, signers, infrastructure and people caused most reported hack losses in 2024, 2025 and 2026 so far.
Guardian's audit reviews contract code at a pinned commit, through a design review, a fuzzed invariant suite and a manual audit. It stops at the code.
A pentest attacks running systems, from cloud infrastructure, web apps and APIs to browser extensions and offchain automation like keepers and signers.
They overlap where offchain code mirrors contract math. Guardian's GMX keeper review returned 55 findings, eight of them High. A liquidation that never fires won't show in a contract audit.
What you run decides what you need. Contracts need an audit, while logins, keepers and cloud keys need offchain pentests and reviews. Institutional due diligence calls for both.
Scope both from one threat model. Map what moves funds, name the seams, pin the commit and build, and share context. Then retest both and merge the results.
Guardian runs both. Carlos Polop, creator of HackTricks, leads offchain services, and two independent teams work every engagement. Helix, Guardian's AI auditor, backs them, and only human-verified findings reach you.
Read the full guide for the standards and scoping checklist, or talk to Guardian about scoping both together at guardian.security.
Buyers often use "audit" and "pentest" as if they meant the same thing. They answer different questions, and what matters is what sits in scope.
Many large losses never touched a contract. Guardian's analysis of onchain vs offchain attacks found that keys, signers, infrastructure and people caused most reported hack losses in 2024, 2025 and 2026 so far.
This guide sets out what each covers, where they overlap, which you need and how to scope both together.
Two Different Questions
In traditional security, an audit reviews records and controls. NIST's glossary defines a security audit as an "independent review and examination of records and activities to assess the adequacy of system controls."
In crypto, a smart contract audit is narrower: a code review. Ethereum.org calls an audit "one way of conducting an independent code review."
A pentest is different again. NIST defines it as testing in which assessors "attempt to circumvent or defeat the security features of a system."
So each answers its own question:
- Audit: can the contracts be made to lose, lock or misprice funds?
- Pentest: can an attacker get from the internet to something that signs?
What an Audit Covers
An audit reviews named contract files at a pinned commit. Guardian's smart contract audit runs three passes:
- Design review: architecture, roles, upgrade paths and economic assumptions.
- Invariant suite: solvency, accounting and rounding properties, fuzzed.
- Manual audit: protocol logic, integrations and privileged flows, with proofs of concept.
You get findings ranked by severity, recommended fixes and a review of those fixes. See what a smart contract audit is for the full deliverables.
An audit stops at the code. It does not test who holds the keys, what signers see, or the servers that build transactions.
What a Pentest Covers
A pentest attacks running systems under agreed rules of engagement. Guardian's offchain engagements show the range:
- Infrastructure: cloud accounts, pipelines and vendor consoles.
- Web app: login, authorization and the flows that move funds.
- API: what each key can reach, and what happens once one is stolen.
- Browser extension: what a hostile site can pull out of it.
- Offchain automation: keepers, relayers, bots and threshold signers.
The output is evidence: what testers reached, how they reached it, and what an attacker could do next.
For phases and methodology, see web3 penetration testing explained.
Where They Overlap
The two meet wherever offchain code reads, mirrors or signs for a contract.
Keepers that mirror contract math
GMX's keeper re-derives much of the contracts' pricing and risk math in TypeScript. Each copy can drift from the original.
Guardian's GMX keeper review returned 55 findings, eight of them High. Most Highs sat where the keeper's picture of a position or market disagreed with the contracts.
Keeper failures, such as a liquidation that never fires, do not show up in a contract audit. The contract behaves exactly as written.
Backends reviewed beside contracts
On the Avantis V2 backend, Guardian's offchain teams worked beside the researchers reviewing the V2 contracts. They returned 68 findings, two of them Critical.
Several could only be judged with both halves in view: acceptable in the backend alone or the contracts alone, but not together.
Labels that cross over
Some offchain work is a code review. Guardian audits SDKs, reviews keepers from source, and maps keys and signers in an OpSec audit.
Contract testing has its own guides too. OWASP's Smart Contract Security project publishes the Smart Contract Security Verification Standard (SCSVS) and a testing guide (SCSTG).
Which You Need
| If you | You need |
|---|---|
| Deploy or upgrade contracts | A smart contract audit before deployment |
| Let users log in, deposit or withdraw | Web app and API pentests |
| Run a keeper, relayer or order backend | An offchain automation review, beside the contract audit |
| Hold keys in cloud or a signing service | An infrastructure pentest and an OpSec audit |
| Ship a wallet extension or SDK | An extension pentest or an SDK audit |
| Face institutional due diligence | Both, with reports tied to commits and builds |
The CryptoCurrency Security Standard (CCSS) v9 asks for both, level by level:
- Level 1: an external audit of every smart contract version in production.
- Level 2: adds a regular independent assessment that includes penetration testing.
- Level 3: adds a security audit similar to SOC 2 or ISO 27001, at least yearly, with pentesting and, if applicable, code audit.
Scoping Both Together
Scope both from one threat model of your funds:
- Map what can move funds: contract roles, keys, signers, keepers and services.
- Name the seams: every offchain component that calls, mirrors or signs for a contract.
- Pin versions: the contract commit and the backend build, so findings line up.
- Share context: pentesters get the contracts' assumptions; auditors get the backend's guarantees.
- Overlap the windows where components interact, as on GMX and Avantis.
- Retest both: a fix review for contracts, a retest for pentest findings.
- Merge the results into one view of risk, ranked by what reaches funds.
Price follows scope. See what a web3 pentest costs.
How Guardian Runs Both
Guardian's audits and pentests cover the contracts and the systems around them. Offchain, that means infrastructure, web app, API, browser extension and automation pentests, plus SDK and OpSec audits.
Offchain services are led by Carlos Polop, Head of Offchain Services and creator of HackTricks and the PEASS privilege escalation tool.
Every engagement runs two independent teams, backed by Helix, Guardian's AI auditor. Only human-verified findings reach the client.
Every Guardian pentest closes with a retest. Vanguard returns half the package cost as credits toward offchain assessments.
Frequently Asked Questions
What is the difference between a smart contract audit and a pentest?
An audit reviews contract code at a fixed commit for flaws that could lose, lock or misprice funds. A pentest simulates attacks on running systems, such as apps, APIs, cloud, signers and keepers, to show what an attacker can reach.
What does a pentest find that an audit misses?
Problems outside the contract code: weak login and authorization, exposed secrets, over-privileged API keys, cloud paths to signing keys, and keepers whose math drifts from the contracts. In those cases the contracts behave exactly as written.
Is there such a thing as a smart contract pentest?
The phrase is used loosely. OWASP publishes a testing guide for contract code, while NIST defines a pentest as an attempt to defeat a system's security features. Ask whether the work covers contract code, the systems around it, or both.
Do I need both an audit and a pentest?
If your system holds funds and has offchain parts, usually yes. CCSS v9 requires an external audit of production smart contracts at Level 1, and an independent assessment that includes penetration testing at Level 2.
Sources
- NIST CSRC: Glossary, security audit (definitions from CNSSI 4009-2022 and NIST SP 800-82r3)
- NIST CSRC: Glossary, penetration testing (definitions from NIST SP 800-53 Rev. 5 and SP 800-115)
- ethereum.org: Smart contract security (updated October 22, 2026)
- OWASP: Smart Contract Security project, SCSVS and SCSTG (accessed November 5, 2026)
- CryptoCurrency Certification Consortium (C4): CCSS v9.0 matrix, aspect 2.01 (accessed November 5, 2026)
- Guardian: Audits and Pentests
- Guardian: Smart Contract Audit
- Guardian: GMX keeper review case study
- Guardian: Avantis offchain review case study
- Guardian: Guardian Announces Vanguard
- Guardian: Team
- Guardian: Onchain vs Offchain Attacks: Where Hack Losses Came From
Scope your audit and pentest together
Send Guardian your repositories and a map of your system, and get one scope for the contracts and everything that signs for them.