What Is a Smart Contract Audit? Process and Deliverables

By the Guardian team Updated November 2026 4 min read

Quick answer. A smart contract audit is an independent security review of code at a fixed commit, for flaws that could lose or lock funds. You get severity-ranked findings with recommended fixes, usually a fix review, and the reviewed commits.

Watch: What Is a Smart Contract Audit? Process and Deliverables 1:43

Video transcript

Smart contracts move money with no one in the loop. An independent audit looks for flaws that could lose or lock those funds.

Reviewers outside your team examine named files at one commit and rank each finding, usually Critical, High, Medium or Low, with a recommended fix.

Guardian's audit, for example, covers design, economic assumptions, solvency and rounding, protocol logic and oracles, and what admins can do.

From a full engagement, expect a severity-ranked report, proofs of concept, a fix review, finding statuses, reviewed commits and an invariant suite. Not every firm delivers all six, so ask first.

An audit is not a guarantee. Ethereum's official site says audits won't catch every bug. It covers only the reviewed commits, not later changes or offchain systems.

Audits are priced mostly by engineer time. Arbitrum's eighteen completed subsidized audits averaged fifty thousand, seven hundred and six dollars.

Guardian runs three passes: a design review before implementation locks in the costliest risks, an invariant suite around solvency and accounting, then a manual audit by senior researchers.

Vanguard puts Helix, Guardian's AI auditor, on one of two independent teams, and keeps only human-verified findings. Guardian has reported more than three hundred Critical vulnerabilities and published three hundred twenty public reports.

Read the full article for timelines and preparation, then talk to Guardian at guardian.security to get your audit scoped.

Smart contracts move money with no one in the loop. A flaw in deployed code can be used by whoever finds it first.

Ethereum.org calls commissioning an audit "one way of conducting an independent code review".

This guide covers what auditors check, what you get at the end, what an audit leaves out, and what it costs.

A Plain Definition

An audit is a time-boxed security review of a fixed scope: named files in a repository, at a specific commit.

Reviewers outside the team that wrote the code look for ways it can lose, lock or misprice funds, or break its own rules.

Each issue becomes a finding with a severity, usually Critical, High, Medium or Low. Our guide to smart contract audit severity levels explains how each is judged.

The report is not the end. The team fixes or acknowledges each finding, and the auditors check the fixes.

What Auditors Look At

Guardian's smart contract audit, for example, covers:

Design: architecture, trust boundaries, governance, roles and upgrade paths.
Economics: economic assumptions and failure modes.
Accounting: solvency, rounding and math edge cases.
Logic and integrations: protocol logic, oracles and the protocols it calls.
Privileged flows: what admins and other roles can do.

Methods differ by firm

Manual review: OpenZeppelin says each line is inspected by at least two security researchers.
Fuzzing and invariant testing: properties tested against generated sequences of calls.
AI-assisted review: Guardian's Vanguard puts Helix, its AI auditor, on one of two teams.
Proofs of concept: code that shows a bug is real and exploitable.

For how a review runs day to day, see how to audit a smart contract.

What You Receive

At the end of a full engagement, expect these:

Deliverable	What it is	Why it matters
Audit report	Every finding with severity, location and a recommended fix	Your fix list and the public record
Proofs of concept	Code that reproduces a finding	Proves the bug is real, then tests the fix
Fix review	Auditors recheck each fix at a new commit	Fixes can miss the bug or add new ones
Finding status	Resolved, partially resolved or acknowledged	Shows what was left as is
Reviewed commits	Commit hashes for the audit and each fix round	Lets anyone match deployed code to the audit
Invariant suite	Safety properties written as executable tests	Can rerun against later changes

Not every firm delivers all six. Ask which are included before you sign.

Guardian's EthenaLock report (October 2026) shows the pattern: a main review at one commit, then a remediation review at another.

Guardian has published 320 reports in its public portfolio. Most of its 2026 onchain reports, 52 of 75, record a remediation review.

What an Audit Is Not

Not a guarantee. Ethereum.org says audits "won't catch every bug" and warns against treating them "as a silver bullet".
Not a review of later code. The report covers the commits reviewed. Anything changed after is unaudited.
Not an offchain review. Keys, signers, cloud, front ends and APIs need their own assessments.
Not a bug bounty or monitoring. Those keep watching the code once it is live.

Teams often change code after an audit and are exploited through those changes. Review every change at the same standard.

Cost and Timeline at a Glance

Audits are priced mostly by engineer time.

Rate: Arbitrum's Audit Program proposal says it is not uncommon to pay $10,000 to $40,000 per auditor per week, depending on complexity.
Price: Arbitrum's 18 completed subsidized audits averaged $50,706, about $15 per line of code.
Time: in Guardian's public reports, main reviews of 1,001 to 2,000 nSLOC took a median of 8 working days.
Then: fix reviews, once your team has made its changes.

Estimate your own scope with our smart contract audit cost estimator.

Preparation cuts both time and cost. See how to prepare for a smart contract audit.

How Guardian Audits

Guardian's smart contract audit runs in three passes:

A design review, before implementation locks in the costliest risks.
An invariant suite around solvency, accounting, rounding and edge states.
A manual audit by senior researchers, with proof-of-concept depth.

Vanguard puts two independent teams on one scope: expert manual review with fuzzing, and Helix. Only human-verified findings reach the final result.

It adds a $100,000 Defender contest, a hosted bug bounty and six months of update review.

Guardian has reported 300+ Critical vulnerabilities, and 150+ teams trust it with their smart contracts. Its audits and pentests also cover the offchain systems around the code.

Frequently Asked Questions

What is a smart contract audit in blockchain?

It is an independent review of onchain code, such as Solidity contracts on Ethereum or Rust programs on Solana. Auditors look for flaws that could lose or lock funds and report each with a severity and a recommended fix.

What does a smart contract audit include?

A review of a fixed scope at a fixed commit, a report of findings ranked by severity with recommended fixes, and a review of your fixes. Many firms add proofs of concept, fuzzing or invariant suites, and a public report.

Does an audit guarantee my contracts are safe?

No. Ethereum.org notes that audits won't catch every bug. An audit also covers only the commits reviewed, not later changes, keys or offchain systems. Pair it with fix reviews, a bug bounty and monitoring.

How long does a smart contract audit take?

It depends on size. In Guardian's public reports, main reviews of 501 to 1,000 nSLOC took a median of 4 working days, and 3,001 to 5,000 nSLOC a median of 14. Fix reviews follow.

Sources

Get your smart contract audit scoped

Send Guardian your repository and commit, and see exactly which deliverables your audit includes.

Get a Vanguard quote Explore audits and pentests