Smart Contract Audit Statistics 2026: 320 Guardian Reports
Quick answer. Logic errors are the most common finding. Logical Error is 22.6% of the 9,617 findings in Guardian's 320 public audit reports, and 52.7% of Criticals and Highs. Validation is second, in 2026 too.
Video transcript
Guardian's 320 public audit reports hold 9,617 findings. The most common is not a classic exploit. It is logic errors.
Private work is not included. This is Guardian's own data: every report in our public portfolio, for 99 clients, from 2022 to 2026.
Logical Error leads at 22.6 percent of all findings. It also makes up 52.7 percent of Criticals and Highs.
Validation and Warning come next. DoS is smaller, but a quarter of it is Critical or High. Reentrancy has just 44 findings.
The median report has 21 findings, with about one Critical on average. 56.6 percent of reports have at least one Critical or High.
DEXs, vaults and token launches carry the most serious findings per report. Stablecoin and cross-chain reports carry the fewest, often deployment work.
Teams resolved 84.5 percent of Criticals. Still, about a quarter of Criticals and Highs were not resolved in the published report.
The data cannot say why, but the serious share has fallen each year since 2023, from 23 percent to 6.4 percent in 2026 so far.
Read the full report for chains, languages and trends, or ask Guardian about Vanguard: two independent teams on one scope, plus six months of review after production.
Audit reports are published one at a time. This post counts across all of Guardian's.
It is the 2026 baseline from Guardian's public audit portfolio: 320 reports, 9,617 findings and 343 Criticals. Every number traces back to a public report.
Companion reports go deeper on Critical findings, fix rates by severity and remediation timelines.
How We Counted
The dataset is every report in Guardian's public portfolio on November 5, 2026. That is 320 reports for 99 clients, dated March 2022 to October 2026.
315 are onchain reviews of contracts, deployments and chain configuration. Five are offchain reviews.
- Source. One script reads the portfolio's JSON entries with the site's own loader.
- Severity and status are as each published report records them.
- Categories are each report's own label. Merging spelling variants cut 374 labels to 205.
- Sectors and chains are the report's tags, or the client's when it lists none. They overlap.
- Years follow the final report date. 2026 runs to October 28.
Limits.
- Published reports only, so private work is missing.
- GMX holds 46 reports and 11.4% of findings. The top five clients hold 30.4%.
- Our Critical findings report counted 337 reports, before 17 left the portfolio.
Findings by Severity
Low is the most common severity, at 44.0% of findings. Critical and High together are 12.4%.
| Severity | Findings | Share | Reports with one | Per report |
|---|---|---|---|---|
| Critical | 343 | 3.6% | 91 (28.4%) | 1.07 |
| High | 845 | 8.8% | 179 (55.9%) | 2.64 |
| Medium | 2,133 | 22.2% | 228 (71.3%) | 6.67 |
| Low | 4,234 | 44.0% | 293 (91.6%) | 13.23 |
| Informational | 2,062 | 21.4% | 164 (51.3%) | 6.44 |
Findings per report
The median report has 21 findings. The mean is 30.1, pulled up by ten reports with 100 or more.
- 1 to 9 findings: 85 reports (26.6%)
- 10 to 24: 87 reports (27.2%)
- 25 to 49: 85 reports (26.6%)
- 50 to 99: 51 reports (15.9%)
- 100 or more: 10 reports (3.1%)
Two reports have no findings: USDT0's XAUT0 Solana deployment review and Yellow Network's Token.sol.
Criticals and Highs per report
The average report carries 1.07 Criticals and 2.64 Highs. The median report has no Critical and one High.
181 reports (56.6%) contain at least one Critical or High. Those reports hold a median of four.
By most severe finding, 91 reports top out at Critical, 90 at High, 56 at Medium, 61 at Low and 20 at Informational.
The largest, Perp City's protocol review (August 2026), holds 202 findings, including 4 Critical and 32 High.
Top Finding Categories
Ten labels cover 75.8% of findings. Logical Error, a protocol breaking its own rules, leads by a wide margin.
| Category | Findings | Share | Share that is Critical or High |
|---|---|---|---|
| Logical Error | 2,175 | 22.6% | 28.8% |
| Validation | 1,117 | 11.6% | 7.8% |
| Warning | 812 | 8.4% | 0.1% |
| Unexpected Behavior | 668 | 6.9% | 4.5% |
| DoS | 653 | 6.8% | 25.3% |
| Best Practices | 504 | 5.2% | 0.2% |
| Informational | 446 | 4.6% | 2.5% |
| Documentation | 376 | 3.9% | 0.0% |
| Configuration | 302 | 3.1% | 5.6% |
| Optimization | 239 | 2.5% | 0.0% |
Two labels carry two-thirds of serious findings. Logical Error is 52.7% of all Criticals and Highs, and DoS is 13.9%.
Nearly a third of findings are housekeeping. Ten labels such as Warning, Documentation and Optimization hold 2,969 (30.9%), and only 17 are Critical or High.
Classic attack labels are small. Access Control has 134 findings, Oracle 71 and Reentrancy 44.
Logical Error still leads in 2026, by a smaller margin. It is 14.7% of that year's findings and 27.7% of its Criticals and Highs.
For what the Criticals describe, read the Critical findings report. For the classic vectors, see our smart contract vulnerabilities list.
By Sector, Chain and Language
Sector
These are the sectors with 20 or more reports.
| Sector | Reports | Median findings | Critical or High per report | Reports with one |
|---|---|---|---|---|
| Perpetuals | 77 | 27 | 5.29 | 76.6% |
| Stablecoins | 57 | 4 | 0.32 | 10.5% |
| DEXs and AMMs | 32 | 42.5 | 8.16 | 84.4% |
| Infrastructure | 29 | 14 | 1.45 | 31.0% |
| Lending | 27 | 19 | 3.59 | 63.0% |
| Cross-chain | 25 | 4 | 0.52 | 12.0% |
| Yield and vaults | 24 | 35.5 | 6.33 | 83.3% |
| Token launches | 22 | 24 | 6.23 | 86.4% |
Of these, DEXs, vaults and token launches carry the most serious findings per report. Stablecoin and cross-chain reports carry the fewest.
Many of their reports are deployment work. 24 of 57 stablecoin titles and 14 of 25 cross-chain titles name a deployment, upgrade, configuration, verification or peer setup.
Perpetuals lean on one codebase: GMX accounts for 43 of the 77 reports.
Chain
Arbitrum appears on 145 reports (45.3%) and Ethereum on 134 (41.9%). Base follows with 64, then Avalanche 47, Optimism 45, Solana 40, Hyperliquid 36 and Polygon 34.
Chain tags come from the client when a report lists none. So a multichain client's reports carry every chain it lists.
Language
289 reports (90.3%) list Solidity. 18 list Rust or Soroban, two DAML and one Move.
For Criticals and Highs by language, see the best smart contract language for security.
Fix Status and Trends
How findings end
- Resolved: 4,974 (51.7%)
- Acknowledged: 3,772 (39.2%)
- Pending: 577 (6.0%)
- Partially resolved: 180 (1.9%)
- Reported: 104 (1.1%)
- Declined: 9, and out of scope: 1
Resolved rises with severity: 84.5% of Criticals and 71.2% of Highs, against 41.8% of Informational findings.
Still, 296 Criticals and Highs (24.9%) were not resolved in the published report. Our remediation rate report breaks this down.
By year
| Year | Reports | Median findings | Critical or High per report | Critical or High share |
|---|---|---|---|---|
| 2022 | 13 | 17 | 2.62 | 13.7% |
| 2023 | 21 | 22 | 7.95 | 23.0% |
| 2024 | 51 | 26 | 6.47 | 20.6% |
| 2025 | 156 | 20 | 3.03 | 11.4% |
| 2026 to Oct 28 | 79 | 21 | 2.33 | 6.4% |
Report size changed little: the median stayed between 17 and 26 findings.
The serious share has fallen each year since 2023, from 23.0% of findings to 6.4% in 2026 so far.
The data cannot say why. 2023 has only 21 reports, the client mix changes each year, and 2026 is a partial year.
What Guardian Publishes
Every report here is public in the Guardian portfolio, with the round and final status of each finding.
A Guardian smart contract audit makes three passes: design review, an invariant suite and senior manual review.
Vanguard puts two independent teams on one scope. It then keeps reviewing changes for six months after production, up to 2,500 smart contract SLOC.
Frequently Asked Questions
What are the most common smart contract audit findings?
In Guardian's 320 public reports, Logical Error is the most common label: 22.6% of 9,617 findings and 52.7% of Criticals and Highs. Validation (11.6%) and Warning (8.4%) come next.
How many findings does a smart contract audit have?
The median Guardian report has 21 findings, and the mean is 30.1. The average report carries 1.07 Criticals and 2.64 Highs, and 56.6% of reports contain at least one Critical or High.
What share of audit findings are Critical?
3.6%, or 343 of 9,617 findings. Highs are another 8.8%. 91 of the 320 reports (28.4%) contain at least one Critical.
Do teams fix smart contract audit findings?
About half: 51.7% of findings were resolved and 39.2% acknowledged. Teams resolved 84.5% of Criticals and 71.2% of Highs.
Sources
- Guardian: Public audit portfolio, 320 reports and 9,617 findings (as of November 5, 2026)
- GitHub: GuardianAudits/Audits, the published report PDFs
- Guardian: Perp City Protocol Review (August 7, 2026)
- Guardian: USDT0 XAUT0 Solana Deployment and Peer Verification (September 27, 2025)
- Guardian: Yellow Network Token.sol (March 3, 2026)
- Guardian: Smart contract audit
- Guardian: Vanguard audit
Find the logic errors before launch
Vanguard puts two independent teams and an invariant suite on your code, then keeps reviewing changes for six months after production.