How to choose a smart contract auditor
Choose an auditor on evidence of their work, not their marketing. Read their published reports, check who does the review and how senior they are, ask how much is manual, confirm fix reviews are included, and look for track record in public: rescues, CTF results and disclosed vulnerabilities. A quote based on line count rather than your code is a warning sign.
Questions to ask
- Who will review our code, and what have they found before?
- How much of the audit is manual? Tools support a good audit. They do not replace it.
- Do you read the code before quoting? A price from a line count says nothing about risk.
- How do you handle critical findings? They should be raised as soon as they are confirmed, not saved for the report.
- Are fix reviews included? At HYDN, up to two rounds are.
- Can we see sample reports? Look for clear explanations and remediation guidance, not just severity labels.
- Who decides whether the report is published? It should be you.
Evidence worth more than marketing
- Published reports and disclosed vulnerabilities.
- Public incident work, such as HYDN’s SushiSwap rescue.
- CTF results. HYDN won the EthernautDAO CTF in 2022, and our lead auditor was the highest-placed solo competitor in the Paradigm CTF 2023. See our CTF results.
- Certifications and backgrounds of the team.
Red flags
- Fixed prices by line count.
- Turnaround that seems too fast for the scope.
- Reports that are mostly automated output.
- No fix review, or fix reviews charged as a new audit.
Questions
Frequently asked questions
Are bigger audit firms better?
Not automatically. What matters is who reviews your code, how much time they spend on it, and whether they understand your type of protocol.
How many audits do we need?
One thorough audit with fix review is the baseline. High-value protocols often add a second independent audit, a contest or a bounty.
Published Updated