My token uses OpenZeppelin. Does it still need an audit?

The library is well reviewed. What you add on top of it is not: custom fees, mint schedules, vesting, pausing, bridging hooks and owner powers. That is where token audits find problems.

How long does a token audit take?

Most token and ERC-20 audits take 2 to 5 days, depending on how much custom logic sits on top of the standard.

Will the audit check the tokenomics?

We check that the code enforces the supply and distribution rules you describe. Whether those rules are a good economic design is a separate question, and we will flag anything that looks exploitable.

Token and ERC-20 Smart Contract Audit

Token and ERC-20 audits

A token audit checks that an ERC-20 does exactly what its holders expect and nothing else: supply cannot be minted or burned outside the stated rules, transfers behave like a standard ERC-20, admin powers are limited and visible, and any tax, vesting or blacklist logic cannot be abused. Most token audits take 2 to 5 days.

What a token audit covers

Supply. Who can mint, how much, and when. Whether burn functions can be called on other people’s balances. Whether the cap holds in every path.
Transfer behaviour. Standard return values, events and allowance handling, so that wallets, DEXs and lending markets integrate safely.
Fees and taxes. Fee-on-transfer logic, exemptions, maximum rates, and whether the owner can raise fees to the point of trapping holders.
Blacklists and pausing. Who can freeze whom, and whether those powers are disclosed and limited.
Vesting and locks. That team and investor tokens cannot be released early, and that the schedule matches what was announced.
Ownership. What the owner can still do after launch, and whether renouncing ownership locks anything that should stay usable.
Bridging and multichain supply. If the token exists on several chains, how total supply is kept consistent.

Why tokens still get exploited

Tokens are simple compared with protocols, but they are often written quickly and launched to a market that moves fast. Typical findings include owners who can mint without limit, fee functions with no upper bound, and transfer hooks that let an attacker re-enter a DEX pool mid-swap. Holders and listing venues increasingly expect an audit before they will engage with a new token.

What you get

A private report classifying each finding by severity with remediation guidance, up to two rounds of review of your fixes, and a final report and certification you can choose to publish.