Smart contract audit

A smart contract audit is a security review of a blockchain program's code, carried out by specialists who look for bugs, vulnerabilities and design flaws before or after it goes live. Well-known audit firms include Trail of Bits, OpenZeppelin, ConsenSys Diligence, Certik and Spearbit.

Auditors combine manual code review, automated tools and sometimes formal verification. Their report lists issues by severity and notes which ones the developers fixed. Projects also run bug bounty programmes, often through platforms like Immunefi, paying hackers who responsibly disclose flaws.

An audit reduces risk but does not guarantee safety. Many hacked protocols had been audited; auditors only check the code version they were given, may miss complex economic attacks and cannot stop a team that controls admin keys from acting maliciously. When researching a project, read the audit itself rather than trusting an "audited" badge, check whether critical findings were fixed, and look at who can upgrade the contracts.