Security research
Smart Contract Audits Pricing Explained
Compare audit prices only after matching scope and retest terms. Our three-page source check separates published price bands from quote-only models and provides a downloadable brief for comparing offers.
How much does a smart contract audit cost?
There is no single price for every smart contract audit. A token review, a lending protocol and a bridge expose different logic and dependencies. A number becomes useful only when the quote names the code revision, reviewer effort and deliverables it buys.
On , DeFiSec inspected three primary pages for a numeric audit fee and a payment model. One of those pages published a numeric starting price or range. This bounded comparison does not estimate the market average; it shows why a price table needs scope labels.
| Provider and page | Observed terms | What the page cannot price |
|---|---|---|
| Pharos Production | Single contract from $8,000; standard DeFi protocol $25,000-$60,000. | These are provider-listed terms, not a quote for your repository. Confirm which contracts and retest are included. |
| ImmuneBytes | Fixed-price quote, retainer or pay per vulnerability. No numeric fee on the inspected engagement page. | A separately linked pricing calculator was not used. Ask for the base fee and any variable payout cap. |
| OpenZeppelin | The readiness article describes code review followed by a quote and timeline. | The inspected article is not a rate card and does not publish an audit fee. |
Download the dated source comparison CSV or inspect the method and observations in JSON. Other pages or private proposals may contain different terms.
The original version of this article grouped auditors into cheap, medium and luxury tiers. Its old figures lacked a common scope and current supporting sources. They have been removed from the buying guide rather than treated as current offers.
What changes a scoped audit quote
- Logic and dependencies
- Ask which asset flows, permission checks and integrations the review must cover. Equal line counts can contain different amounts of custom logic.
- Review effort
- Separate calendar duration from engineer-days. Two reviewers working five days contribute ten engineer-days; a two-week delivery window does not by itself establish that effort.
- Code readiness
- A frozen revision, runnable tests and current documentation give reviewers a defined starting point. Ask whether missing setup or later changes will incur extra work.
- Fix verification
- Specify the included retest window, which changed files it covers and whether further remediation rounds are charged separately.
- Release surface
- A contract-only scope may leave deployment configuration, administrator controls or off-chain services outside the engagement. Record these exclusions before comparing totals.
The audit preparation checklist helps assemble those inputs. Pharos Production publishes smart contract audit scope and pricing terms; compare the written proposal with the deliverables you need rather than assuming every listed method applies to every project.
Fixed price, retainer and vulnerability-based fees
| Model | Question for the agreement | Budget boundary |
|---|---|---|
| Fixed price | Which frozen revision, contracts and fix reviews are included? | A later scope change may require a new fee; agree the change procedure first. |
| Retainer | How much reviewer capacity is reserved and how is new work prioritized? | A monthly payment does not by itself establish unlimited review work. |
| Pay per vulnerability | What are the base fee, severity payouts, duplicate rules and cap? | The final amount depends on the agreed findings schedule. Confirm who resolves classification disputes. |
These distinctions follow the models named on the ImmuneBytes engagement page. They are contract questions, not an assessment that one model produces better audits. For a contest, compare the platform terms separately; the contest versus private audit guide explains that decision.
Compare offers against the same brief
Send each provider the same scope record. Keep a separate column for exclusions so that a lower total does not hide omitted work.
- Freeze the repository revision and list the contracts, deployment assumptions and external dependencies.
- Request reviewer roles and allocated effort alongside the delivery date.
- Record methods, report contents and the included remediation review. Use a report reading guide to check what the promised document must establish.
- Confirm the currency, payment milestones and change fees. If payment includes tokens, agree valuation and settlement terms in writing.
- Compare availability and publication terms after the technical scope matches. A cheap quote with no named retest cannot be compared directly with one that includes fix verification.
Download the 12-field quote checklist, then use the audit request form to send the scoped enquiry. Submission does not book an auditor or confirm a price.
Sources
Checked . Local examples include their inputs and limits.
About this revision
Updated October 4, 2026 with a dated primary-source comparison and a quote checklist. Removed unsupported historic price tiers and company claims. The original URL is preserved.
Suggest a correction with evidence