What Is a Smart Contract Audit and What Does It Miss?

A smart contract audit is a review of a protocol’s code by security specialists looking for bugs, design flaws and ways funds could be stolen. Audits reduce risk but do not remove it. Euler Finance had been audited repeatedly before losing about $197 million in March 2023, and most hacked contracts in one study were audited.

What auditors check

Auditors read the code line by line, run automated tools and test how contracts behave in unusual situations. They look for common flaws, such as ways to withdraw more than deposited, broken access controls, unsafe external calls and mistakes in financial logic. The result is a report listing issues by severity and whether the team fixed them.

Why audited protocols still get hacked

An audit covers one version of the code. Euler’s exploit came through a feature added after earlier reviews; the July 2022 audit of that change missed the flaw. Euler had received 10 audits from six firms.

Figure: Three large losses, three different causes. Only one was a code flaw an audit could have caught.

Scope is limited. One firm that worked with Euler said it had reviewed only a price-feed integration, not the code that failed.

Complex interactions. Flaws often appear only when a protocol interacts with others, through flash loans, oracles or other contracts.

Configuration and setup errors. The Nomad bridge lost about $190 million in 2022 because of a bad initialization setting.

Problems outside the code. The Ronin bridge lost about $625 million in 2022 after attackers compromised validator keys; no code audit could have caught it. See the Ronin bridge hack.

What the data shows

AnChain.ai found that about 92% of hacked smart contracts it studied had been audited. That partly reflects the fact that almost every serious protocol gets audited. Halborn found that audited protocols accounted for only about 11% of the dollar value lost, suggesting audits still matter.

What an audit report contains

An audit report usually lists every issue found, ranked by severity, typically critical, high, medium, low and informational. For each, it describes the problem, how it could be exploited and a recommended fix, followed by the team’s response: fixed, partly fixed or acknowledged but left as is. Many reports end with a note on what was out of scope. The most revealing parts are often the acknowledged issues and the scope section, because they show which risks the team chose to accept and which code nobody reviewed.

Who pays, and why it matters

Projects pay auditors, which creates an obvious tension: the auditor’s client is the team, not the users. Reputable firms protect their name by reporting honestly, but time and budget limits shape how deep a review can go. Competitive audits, in which many independent researchers examine the code for prize money, and permanent bug bounties that pay for vulnerabilities found after launch, add different incentives. A protocol that combines a private audit, a public contest and a large standing bounty has invited far more scrutiny than one with a single report.

Security beyond the audit

• Bug bounties pay researchers who report flaws instead of exploiting them.
• Formal verification uses mathematical methods to prove that specific properties of the code always hold.
• Monitoring watches for unusual transactions and can trigger alerts or pauses.
• Timelocks delay upgrades so users can react before changes take effect.
• Limits cap how much can be deposited or withdrawn while new code proves itself.

Signs of a thorough audit

Quality varies widely between audits. Stronger signs include a reputable firm with a public track record, a report that lists the exact code version reviewed, a realistic time frame for the amount of code, findings of every severity rather than a suspiciously clean result, and a follow-up review confirming that fixes were made correctly. A one-page certificate with no findings, or a report covering only a small part of the protocol, says much less than its badge on a website suggests.

Reading an audit without reading code

You do not need to be a developer to get value from an audit report. Check that the report names the protocol’s current contracts and date. Read the summary of findings and count how many critical or high issues there were and whether all were fixed. Look for any finding marked as acknowledged rather than fixed, and read why. Check the scope section for anything important that was excluded. Then compare the dates of the audits with the dates of later upgrades; code changed after the last review is code that may not have been reviewed at all.

How to read an audit

• Check the date and version. Is the audited code the code that is running now?
• Check the scope. Which contracts were reviewed, and which were not?
• Read the findings. Were critical and high-severity issues fixed and re-checked?
• Look for more than one review, plus a public bug bounty and ongoing monitoring.

When audits do help

Despite the limits, audits catch a great deal. Many serious flaws are found and fixed before launch and never make the news, precisely because they were caught. Protocols that combine several audits with bug bounties, gradual deposit limits and careful upgrade processes have generally fared better than those that skipped them. The statistics showing that most hacked contracts were audited mainly reflect how common audits have become, not that they are useless. For users, the practical lesson is to treat an audit as a necessary bare minimum rather than a guarantee, and always to look for the many other layers of security that show a team takes risk seriously after launch as well as before it.

Where audits fit

An audit is one signal among several. Our guide on how to check a DeFi protocol before depositing covers the rest. For the basics, read what a smart contract is and what DeFi is.

This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.

Frequently asked questions

Does “audited” mean a protocol is safe?

No. It means specific code was reviewed at a specific time by a specific firm. Audits reduce the chance of known types of bugs, but many hacked protocols had been audited, and risks outside the code are not covered.

How long does an audit take?

It varies with the size and complexity of the code, from days for a small contract to weeks or months for a large protocol. Rushed audits before a launch deadline are a common weak point.

Sources

• Crypto auditor Sherlock to pay out $4.5 million to Euler Finance ($197 million exploit; scope of another auditor’s review) — The Block, March 2023
• Euler Finance team blocks vulnerable module (July 2022 audit missed the flaw) — ForkLog, March 2023
• The Audit Paradox (91.96% of hacked contracts audited; audited protocols 10.8% of value lost; 10 audits from 6 firms) — Zealynx Academy
• Why some smart contracts pass an audit but still get hacked (Nomad initialization; Ronin key compromise) — QuillAudits