Smart contract audit

Auditors read the code line by line, compare it with the intended behaviour described in the documentation and test it with automated tools such as static analysers and fuzzers. Some audits add formal verification, which mathematically proves that certain properties always hold. The result is a public report that classifies each finding by severity and records whether the team fixed it.

Most DeFi users treat an audit as a minimum requirement, and serious protocols often commission several from different firms, run audit contests where many reviewers compete for rewards and keep a bug bounty open after launch. Audits cover a specific version of the code, so any later change needs a new review.

An audit lowers risk but does not guarantee safety. Audited protocols have been exploited through bugs that were missed, code deployed after the review, flawed integrations or compromised keys. Reading the report, not just the badge, shows what was checked and what was left open.