Pricing guide
What a smart contract audit costs
Most audit quotes are opaque. Here is what the work actually costs, what moves the number, and what a cheap quote usually leaves out.
Pre-launch review from $6,500 · larger scopes quoted in writing
The short answer on smart contract audit cost
A smart contract audit is priced like a short, senior consulting engagement, not like software. For a small pre-launch scope, independent reviewers typically charge $5,000 to $15,000. A full protocol with several contracts and integrations usually lands between $15,000 and $60,000. Firm-brand audits above that are common.
My work is fixed fee, because an hourly audit rewards the wrong behaviour:
| Engagement | Scope | Delivery | Fee |
|---|---|---|---|
| Pre-launch review | Up to 1,500 nSLOC, 1–3 contracts, 1 integration | 5 business days | $6,500 |
| Full protocol audit | Up to 4,000 nSLOC, up to 6 contracts, 2 integrations | 10 business days | $18,000 |
| Security retainer | Monthly review window, deploy diffs, advisories | Monthly | $4,500 / month |
The tiers are the floor for the scope described, not a menu. Every engagement is quoted in writing after a scoping call, and the fee is fixed before any testing starts. Larger scopes are quoted per 1,000 nSLOC rather than billed by the hour.
Rush starts add 40%. Non-EVM runtimes such as Solana add 25%. The full scope and the exclusions are written down before the invoice.
What drives the price
Two audits with the same line count can differ by 10x. These are the variables that actually move a smart contract audit price:
| Driver | Effect on price |
|---|---|
| Code size | The base unit. More code means more paths, more state and more review time. |
| Contracts and integrations | Every external contract, oracle, token or bridge adds assumptions to check and attack paths to model. |
| Runtime | EVM Solidity is the default. Rust programs and non-EVM runtimes carry different tooling and a surcharge. |
| Novel mechanism | A standard vault is well-trodden. New perp math, a novel AMM curve or a custom liquidation engine needs first-principles review. |
| Timeline | A rush start compresses scheduling and adds a surcharge. A normal queue is cheaper. |
| Fix rounds | Verification after remediation is part of the product. Extra rounds cost extra. |
| Report scope | A public-ready report with a coverage statement and redactions is more work than an internal memo. |
| Who does the work | A named senior reviewer costs more than a junior subcontractor. It also produces a different report. |
What a cheap quote usually leaves out
The cheapest quote is not always the worst deal, but the missing items tend to be the same. Ask any auditor, including me, which of these are included:
- A named auditor. Not a firm logo with an unnamed team behind it. Ask who writes the report and who answers the questions.
- Proof of concept for every High and Critical finding. A finding without a reproduction is an opinion.
- Fix verification. The second pass after remediation, where each finding is marked fixed, partially fixed or acknowledged.
- A coverage statement. Which commits, which files, which integrations, and what was explicitly not reviewed.
- An exit call. Engineers need to hear the finding from the person who found it.
- A frozen scope. A low quote that grows during the engagement is not a low quote.
How to compare two audit quotes
Put both quotes next to each other and compare the same four things: the commit reviewed, the contracts in scope, the deliverables, and the person doing the work. If one quote does not name a commit or a reviewer, it is not comparable yet.
The useful question is not "what is the cheapest audit" but "what does this audit leave me able to prove". A report with a coverage statement, reproductions and a fix addendum is evidence you can show a chain team, an exchange, or your users. A PDF of generic advice is not.
Why fixed fee
An hourly audit makes the invoice a function of how long the reviewer takes, which is the wrong incentive. A fixed fee ties the price to the scope and the deadline. If the review takes longer because the code is harder than the sample, that is my problem, not a change order.
Questions buyers ask
How much does a smart contract audit cost?
For a small pre-launch scope, independent reviewers typically charge $5,000 to $15,000. A full protocol with several contracts and integrations usually lands between $15,000 and $60,000. Firm-brand audits above that are common. My fixed tiers are $6,500 for a five-day pre-launch review and $18,000 for a ten-day protocol audit.
Why do some audits cost $5,000 and others $150,000?
Scope, seniority and brand, in that order. A 600-line token is not a 6,000-line lending market. A review done by the person you hired is not the same product as a review subcontracted to a junior. And a firm with a sales team and a logo premium charges for both.
Is a cheaper audit worth it?
Only if the scope and the deliverable are the same. Compare the commit reviewed, the number of contracts, whether High and Critical findings come with a proof of concept, and whether fixes are verified. A cheap review that misses one Critical costs more than the difference.
Can I pay in USDC?
Yes. Invoices are in USD, paid by bank transfer or USDC. Fifty percent on signature, fifty percent on delivery.
What if I only have a small token contract?
That is the pre-launch review: up to 1,500 nSLOC, one to three contracts, five business days, $6,500. If the scope is smaller than that, the price does not go below $5,000, but the timeline can shrink.
If you want a number for your specific repo, send the commit and the architecture note. I will send a one-page scope with a fixed fee and a date. See the smart contract audit engagement, the pre-audit checklist, or the audits for DeFi protocols and Solana programs.
Get a fixed quote
Send the repo and the architecture note. Scope, price and date in one page.