What is a smart contract audit?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
An audit is an independent review of contract code that reports vulnerabilities and design problems. Being audited is not a guarantee of safety — it records that specific code was examined at a specific time within a specific scope. The report only becomes useful when you read its date, its scope, and how the findings were resolved.
Key points
- An independent review that reports code vulnerabilities
- Audited does not mean safe
- Read the date, the scope and how findings were fixed
- Code changed after the audit is outside its coverage
Definition
A systematic review by specialists outside the development team, covering a contract's code and design for vulnerabilities, privilege issues and mismatches with the stated specification, delivered as a written report.
Deployed contracts are hard to change, which is why an outside review before launch carries so much weight. An audit looks for known vulnerability patterns, questionable privilege design, conditions under which the economic assumptions break, and places where the code and the specification disagree.
Scope is the detail people skip. A report names the exact files and commit it covered. Anything changed afterwards was not audited. Problems that only appear when the contract is composed with other protocols also tend to fall outside a single-contract review.
What you should look at is the report, not the badge. Were the findings fixed, are any still open, and is there a stated reason for the ones left alone? A high-severity finding marked as acknowledged rather than fixed is a decision you are inheriting, so decide whether you accept it.
Confidence builds when several independent firms have reviewed the code, a bug bounty is genuinely paid out, and the contracts have held significant value for a long time without incident. A page listing auditor logos with no link to an actual report deserves the opposite reaction.
Watch out for
- · Never rely on an audited badge — read the report's date, scope and unresolved findings
- · Assume any code changed after the audit date is unreviewed
- · Avoid services that display auditor logos but publish no actual report