Smart Contract Audit & Web3 Security

Simple token/NFT contracts cost $5,000–$15,000, mid-complexity protocols (staking, vesting, governance) $15,000–$50,000, and full DeFi protocols (AMMs, lending, cross-chain) $50,000–$150,000+. Bridges and L1/ZK systems can reach $150,000–$500,000+. A re-audit of fixes adds 20–40% of the original fee.

Simple contracts take 2–7 days, standard DeFi protocols 2–4 weeks, and complex systems 4–8 weeks, plus 1–2 weeks for remediation verification. Total engagement is typically 4–10 weeks. Top firms book 2–4 months ahead, so schedule early.

An audit is a systematic security review where experts examine contract code line-by-line for vulnerabilities, logic errors, and economic exploits before deployment. Because deployed contracts are immutable and hold real funds, an audit is essential—the most expensive audit is the one you need after an exploit.

Reentrancy (an external call re-entering your contract before state updates), access-control failures (missing permission checks), oracle/price manipulation, integer issues, and unchecked external calls are the most common. Reputable audits combine automated tools (Slither, Mythril) with manual review to catch them.

Yes. After your team fixes findings, auditors must review the fixes, since changes can introduce new bugs. Most firms charge 20–40% of the original fee for re-review. Deploying a version the auditor hasn't reviewed defeats the purpose of the audit.

Formal verification mathematically proves that your contract's critical invariants can't be broken. It adds roughly $20,000–$50,000 and extra weeks. It's optional for simple tokens but effectively required for high-value bridges and institutional protocols where the bar for trust is highest.

A practical starting point is 5–10% of your development cost for security assessment. For production projects, smart-contract coding plus auditing together often account for 50–65% of the total build budget. Cutting the audit isn't a saving—it's transferring risk to your users.

Yes. Remediation engagements take an existing audit report, fix the critical/high/medium findings at root cause (not patches), add tests, and prepare the code for re-audit. This is common when a previous team or vendor left issues unresolved.

A proper audit delivers a findings report graded by severity (critical/high/medium/low/informational), a description and proof-of-concept for each issue, remediation recommendations, and a final report confirming fix status after re-review. Threat modeling and economic analysis may be separate line items.

For high-value protocols like bridges and large-TVL DeFi, multiple independent audits plus a public bug bounty are standard practice and expected by serious investors. For a simple token, one reputable audit is usually sufficient.

It's the hours spent testing versus writing code. For anything touching money, you want at least 1.5:1 to 3:1. A low ratio means under-tested code and higher exploit risk. Ask any development partner to break out code hours versus testing hours.

Solidity is the standard for Ethereum and all EVM chains (Polygon, BNB Chain, Arbitrum, Base). Solana uses Rust, and some ecosystems use Vyper, Move, or Cairo. Most projects choosing maximum tooling and liquidity build in Solidity on an EVM chain.

Web3 security also covers front-end and wallet security, private key/MPC custody design, oracle integrity, access-control and admin-key management, monitoring and alerting for live contracts, and incident response. It's a continuous lifecycle, not a one-time checklist before launch.