How much does a smart contract audit cost?
There is no fixed price, because the cost depends on the risk in the code. Logic density, external integrations, upgradeability, test coverage and how quickly you need it all move the number. HYDN reads your code before quoting, prices it against your actual contracts, and tells you what is driving the figure.
What moves the number
Logic density
How much novel, high value logic sits behind each function matters far more than how many lines there are. A small contract that moves funds between chains, prices collateral or settles derivatives is slow to review properly. A large contract that mostly reuses well understood library code is quick.
External integrations and oracles
Every external call is a trust assumption. If your protocol reads a price from an oracle, routes through a DEX, accepts tokens you do not control or talks to a bridge, those integrations and their failure modes have to be reasoned about too. Protocols with many integrations take longer.
Upgradeability and admin surface
Proxies, timelocks, role based access and emergency functions all expand what has to be checked. The upgrade path itself is in scope, because an admin key that can replace the implementation is often the single largest risk in the system.
Test coverage and documentation
Well tested, documented code audits faster. Time we spend working out what a function is meant to do is time we are not spending trying to break it. A specification, a list of invariants and a passing test suite all bring the cost down.
Turnaround
Compressing a six week review into two means putting more senior people on it at once, and that carries a premium. Some deadlines are worth paying for. Others buy you a worse audit, and we will say so.
Typical turnaround by project type
| Project | Typical duration |
|---|---|
| Token or ERC-20 | 2 to 5 days |
| Standard DeFi protocol | 2 to 4 weeks |
| Bridge, L1 or ZK system | 1 to 3 months |
How HYDN quotes
- You send the repository, the commit hash you want reviewed, and a description of what the protocol is meant to do.
- We read the code before we price it, and come back with a quote that names what is driving the cost.
- Scope is fixed to that commit. Anything changed after the audit starts is outside the agreed scope, which protects you as much as us.
- The price includes up to two rounds of remediation review, so you are not charged again to confirm your fixes.
Ways to bring the cost down
- Freeze the code before the audit starts and resolve compiler and linter warnings.
- Write down the invariants: what must always be true about balances, shares, prices and permissions.
- Get your test coverage up, especially for the paths that move funds.
- Remove dead code and unused contracts from the repository you share.
- Tell us which risks already worry you. It points us at the right places sooner.
See also our guide on how to prepare for a smart contract audit.
Frequently asked questions
Why don't you publish a price list?
Because line count, the usual basis for a price list, tells you very little about risk. A 300 line bridge can carry more risk than a 3,000 line token. We would rather read the code and quote for what is there.
How long does an audit take?
Most token and ERC-20 audits take 2 to 5 days. A standard DeFi protocol takes 2 to 4 weeks. Bridges, L1s and ZK systems take 1 to 3 months.
Can we pay less by giving you less code?
You can narrow the scope, and sometimes that is the right call. But anything left out is unreviewed, and an attacker will not respect the boundary. We will tell you which contracts we think must be in scope.
Are remediation reviews extra?
No. Up to two rounds of remediation review are included in every HYDN audit.
Published Updated