We manage your security to weather the AI storm →
Get a quote

← Resource Hub

Smart Contract Auditor: Role, Skills, Pay and How to Start

By Owen Thurm Published 9 min read

Smart Contract Auditor: Role, Skills, Pay and How to Start

Quick answer. A smart contract auditor, or web3 security researcher, reviews blockchain code for vulnerabilities before attackers find them, and proves each finding with a test. Auditors work at audit firms, in public contests, on bug bounties or in-house.

Watch: Smart Contract Auditor: Role, Skills, Pay and How to Start 1:42
Video transcript

A smart contract auditor reads blockchain code like an attacker, and proves each finding with a test. That code may hold hundreds of millions of dollars on launch day.

Auditors work from four seats: at a firm, in public contests paid per valid finding, on bug bounties for live code, or in-house on a protocol's own team.

Most of an audit is understanding, not bug hunting. A kickoff call on the design, a first pass through each job, deep passes with new questions, then a fix review and the report.

Contest pay is public, and it is steep. Code4rena's all-time median award is 341 dollars. The top earner made over 1.3 million dollars.

Full-time pay is harder to pin down, so treat these as data points. One senior CertiK posting targets 102 to 180 thousand dollars, and Morpho's head of security 265 to 345 thousand.

Code4rena is winding down, and Sherlock replaced its contests with Audit Engine, mixing AI and human researchers. CTFs remain the free way to practice.

Firms hire on evidence, not resumes: unique Highs in judged contests, published reports, tools and write-ups, and code you built before auditing.

AI changed the job without removing it. At Guardian, Helix covers the codebase, but only human-verified findings reach the report.

Read the full article for the skills and pay data, or see Guardian's open research roles at guardian.security.

Few jobs put as much money behind one person’s attention. The code you review may hold hundreds of millions of dollars on the day it launches.

I have spent five years and hundreds of security reviews in this work, and taught much of it on YouTube along the way. This page is what I tell people who ask what the job really is.

For the step-by-step learning plan, see how to become a smart contract auditor. This page covers the job itself: the work, the pay, the hiring and where it leads.

What the Job Is

A smart contract auditor reads a protocol’s code the way an attacker would. Then they report every way it can lose funds or break.

The titles vary: auditor, security researcher, web3 security researcher. The work is the same.

Each finding gets a severity, an impact and, at good firms, a proof of concept that demonstrates it. Severity sets how urgently each one gets fixed; see severity levels.

The auditor then reviews the fixes, because a fix can introduce a new bug.

Auditors work from four main seats:

  • At a firm: paid to cover a client’s whole scope, usually as a team.
  • In public contests: paid per valid finding, alongside many other researchers.
  • On bug bounties: paid for bugs in live code, often the largest single payouts.
  • In-house: on a protocol’s own security team.

A Day on an Audit

Most of an audit is understanding, not bug hunting. Bugs jump out once you know what the system is for.

Before the code

A firm audit starts from a repository, a commit and the files in scope.

On a kickoff call, the client walks the auditors through the design. The researchers stress-test it with precise questions.

The first pass

I start by listing the system’s jobs to be done. For an exchange: swap, add liquidity, remove liquidity, collect fees.

Then I walk each job through the contracts, function by function, the way the developers built it.

Ideas that come up get an @audit comment in the code, to search for later. Rabbit holes wait until I have context.

I also keep a list of knobs: behavior that could be twisted into a bug. External calls to arbitrary addresses, divisions that round to zero, subtractions that can underflow.

The best knobs are specific to the codebase. In a live audit I recorded of Uniswap’s V3 Staker, anyone could unstake for another user once an incentive ended.

That one knob led to a high-impact finding: a way to steal rewards from other stakers.

The deep passes

Then come the second, fifth and ninth passes. Each asks the same lines a new question.

What happens in an insolvent liquidation? What if someone swaps right after this call?

A lead goes to the team once I am about 60% sure of it, tagged by severity. Many die. The rest become findings with a proof of concept.

Beside the manual review, invariants are written and fuzzed. A broken invariant hands you the impact first, and you debug back to the root cause.

The habits

  • Fixed-length sessions, such as 90 minutes, each with a written goal.
  • Phone in another room, social media closed.
  • A whiteboard within reach for math and attack paths.
  • Walks to think through attacks away from the code.

The engagement ends with a fix review and the report. For the full method, see how to audit a smart contract.

Skills That Matter

The foundations come first, and in my view the order matters: build, then understand, then attack.

  • Solidity, learned by building your own protocols.
  • DeFi primitives: DEXes, vaults, lending and staking.
  • Reading codebases quickly and at a deep level.
  • A toolbox of bug classes, applied to each codebase, not pattern-matched.
  • Testing: unit, integration, stateful fuzzing and proofs of concept.

There are three ways to find a critical bug. Read the code and notice it, write the test that exposes it, or write an invariant and let a fuzzer break it.

The best auditors use all three. For a starting toolbox, see common smart contract vulnerabilities.

What sets top auditors apart

I have worked with dozens of researchers. One can earn $43 from a contest while another earns over $23,000 from the same one, with the same hours in.

Seven traits show up again and again in the second group:

  1. Diagramming: they map every contract, actor and call.
  2. Perseverance: they assume bugs exist, and return to a file a ninth time.
  3. New perspectives: each pass uses a new lens, or a partner.
  4. Tooling: PoCs, fuzzing harnesses and formal verification, not just an editor.
  5. Organization: session goals, a timer, and every idea written down.
  6. Questions: of the code, of teammates and of the developers.
  7. Iteration: after each contest, they study every missed finding.

Not every top auditor does all seven. Most do three or four very well. The flip side is in ways to miss vulnerabilities in an audit.

Levels and Pay

Levels

Guardian’s published research roles show a typical ladder:

Level What it means
GSR-1 Security ResearcherMostly autonomous manual analysis, with senior guidance
GSR-2 Security ResearcherFully autonomous analysis, testing and client communication
GSR-3 Security ResearcherLeads high-impact reviews and mentors others
GSR-4 Lead ResearcherLeads reviews, mentors and works with clients
GFE-1 Fuzzing EngineerBuilds fuzzing suites; turns counterexamples into PoCs

Time is the real ladder. I needed at least six months to get a handle on reviews, and roughly 1,000 hours of auditing before it clicked.

Contest earnings

Contest pay is public, and it is steep. Here is Code4rena’s leaderboard, as its public API reported it on November 10, 2026:

Period Handles paid Median award 90th percentile Top earner
20231,408$244$8,438$160,116
20241,162$232$8,163$681,333
2025886$148$4,260$84,646
All time3,346$341$12,092$1,316,376

Across all years, 45 handles earned $100,000 or more. The top 100 took 60% of the $24.6 million paid. Some handles are teams.

That is the gap between $43 and $23,000. Duplicates split a reward, so the largest shares go to unique Highs.

Salaries

Full-time pay is harder to pin down. Few firms publish ranges, and salary sites mix auditors with developers.

Public postings give a sense of the range:

  • CertiK, Blockchain Security Engineer, Senior Level (US, remote): a target salary of $102,000 to $180,000, with at least three years’ experience.
  • Morpho, Head of Security (Paris or remote): a US base salary range of $265,000 to $345,000, posted October 13, 2026.
  • Solidity developers, for comparison: web3.career puts the average at $150,000, within $65,000 to $257,000 (November 2026).

Two postings are not a survey. Treat them as data points, and ask any employer for its range.

Bounties

Bug bounties pay the largest single sums. Wormhole paid $10 million in 2022 for one uninitialized proxy bug.

The rest of the list is in the biggest crypto bug bounties.

Contests, Solo Work and Hiring

Public contests are the open door. Anyone can enter, and the results are published.

In my view, the contest model aligns incentives better than almost anything: you are paid only for real bugs.

Its weak spots are coverage nobody can measure, and fixes the contestants never review.

The platforms are changing

After five years of contests, Code4rena announced on May 13, 2026 that it is winding down. Immunefi said it would onboard Code4rena’s bug bounty customers.

Sherlock’s docs now file its audit contests as deprecated and replaced by Audit Engine.

Audit Engine runs AI auditors and human researchers on one engagement. Humans join by application or invitation, and most engagements require KYC and an NDA.

Accuracy now pays, too. An Audit Engine payout is automatic only if at least 20% of your judged issues are accepted.

Other platforms still run competitions. Compare their terms in audit contest vs private audit.

With two large platforms changing, open contests are scarcer. CTFs remain the free way to practice: start with the best smart contract CTFs.

Going solo

Solo auditors take private reviews directly from protocols. Their reputation is the business, so they publish every report a client lets them release.

Many solo auditors do excellent work. In my experience, though, collaboration multiplies the quality of an audit.

A group learns a large codebase faster, and teammates kill false positives before they reach the client.

Bounty hunting suits researchers who prefer live code to pre-launch reviews. Learn how to report a vulnerability before you need to.

How firms hire

In my experience, firms hire on evidence. Findings anyone can read count for more than a resume.

OpenZeppelin’s current researcher posting is a fair picture of the industry.

  • Required: experience designing and building smart contracts, not only auditing them.
  • Nice to have: a contest or bounty track record, and public research.
  • Process: recruiter call, manager interview, technical interview, a paid code review, references.

In my view, these are the strongest signals.

  • Unique Highs and Criticals in judged contests.
  • Reports you published, from contests or private audits.
  • Tools, write-ups and threads that show how you think.
  • Code you built before you audited.

Guardian’s own team shows the pattern: #1 finishers in public audit contests, former audit leads at other firms and whitehats with live Critical disclosures.

Several started as builders. One was a lead protocol developer at a perps exchange; another moved over from frontend development in 2023.

One warning. Fake recruiters target crypto developers with malware hidden in interview tasks. Read how fake job interview malware works before you run anyone’s code.

What AI Changes

AI has already changed the job. It has not removed it.

OpenZeppelin now asks researchers to drive audits “with AI as your primary collaborator”, and to build agents and workflows the team can reuse.

Sherlock’s Audit Engine benchmarks every participant, human or AI, on precision, recall and unique findings.

At Guardian, Team B runs Helix, our AI auditor, across every corner of the codebase. Team A pairs expert manual review with the fuzzing suite.

Only human-verified findings reach the report. AI output is non-deterministic, and a real High can surface labeled Low.

Validating what AI raises is harder than raising it. That validation is human work.

In 2024, I predicted that researchers would stay, but that the work would move to the long tail of complex, novel code.

There may be fewer researchers per developer, each more specialized.

So use AI daily, and invest in what it does worst: complex, novel code and the rounding cases that matter. The evidence is in will AI replace smart contract auditors.

Career Paths

The skills carry into several careers:

  • Lead researcher: leading reviews, mentoring, owning the client relationship.
  • Fuzzing engineer: invariant suites that stay with the client after the audit.
  • Independent researcher: contests, bounties and solo reviews.
  • In-house security: a protocol’s own security lead, like Morpho’s posting above.
  • Offchain security: APIs, cloud and offchain logic, where many big exploits start.
  • Founder: a firm of your own.

That last one was my path. Daniel Gelfand and I built a vault protocol, and its first audit came back with nothing significant.

We then found bugs it had missed, and started Guardian to build the audit we had wanted.

Research at Guardian

Guardian hires security researchers from GSR-1 to GSR-4, fuzzing engineers and Web2 security engineers.

If you have put in the hours, see the open roles on our careers page.

Frequently Asked Questions

Do you need a degree to become a smart contract auditor?

Not always. I studied computer science, but I would not delay auditing to get one. OpenZeppelin’s researcher posting asks for practical experience, not a degree, though CertiK’s senior posting lists one. The findings and code you can show count most.

Is smart contract auditing a remote job?

Usually. OpenZeppelin’s researcher role is remote worldwide, and CertiK’s senior posting is remote in the US. Contests and bounties are online by design. Firm work still includes live calls, such as the client’s design kickoff.

Which language should a new auditor learn first?

Solidity, which OpenZeppelin’s posting requires along with the wider EVM ecosystem. Then add a second stack. Guardian has audited 10+ languages, including Rust on Solana and DAML on Canton; OpenZeppelin lists Move, Cairo, Go and Rust as nice-to-haves.

What is the difference between an auditor and a web3 security researcher?

Mostly the title. Many firms say researcher because the work goes past checking code: design review, fuzzing, proofs of concept and tooling. Web3 security research can also reach offchain systems, such as keepers, APIs and backends.

Sources

Audit alongside Guardian’s researchers

Guardian hires security researchers and fuzzing engineers at every level. Building a protocol instead? Get it reviewed by the same team.

Talk to Guardian See open roles