You've built a protocol. You know you should get the contracts reviewed before mainnet. So you ask around — and the answers range from "a friend will glance at it for free" to "$80k and a two-month waitlist." That spread is real, and it's paralyzing when you're a small team trying to ship.
Here's an honest breakdown of what actually drives the number, and how to spend a small budget well.
The honest ranges (2026)
Rough, real-world bands for EVM smart-contract security work:
- Community / friend review — free to a few hundred. Better than nothing, wildly variable, no accountability.
- Independent auditor, small scope — ~$1k–8k. A single experienced reviewer on a tight, well-defined scope (a token, a vault, a staking module). This is where most small protocols get the best value-per-dollar.
- Boutique firm — ~$10k–40k. A team, a formal report, a brand you can show investors.
- Top-tier firm / competitive audit — $50k+. Big scope, big name, big timeline.
If someone quotes you a flat number without asking about your scope first, be skeptical — the scope is the price.
Why the spread is so wide
Four things move the number:
- Lines of code in scope. Someone has to read the money-moving paths line by line. Cost scales with that, not with your repo size — a 20k-line repo with a 600-line core is a small job if you scope it right.
- Complexity. Novel math, cross-contract interactions, upgradeability, oracle dependencies, anything that "nobody drew on the whiteboard" — that's where time (and risk) lives.
- Brand. You pay a premium for a well-known name on the report. Sometimes worth it for fundraising optics; often not, if you just want the code to be safe.
- Timeline. Rush = premium.
What you're actually paying for
Not a list of findings. You're paying for judgment.
A scanner will flag 40 things. Usually 1–2 are real. The entire value of a good reviewer is telling you which — and staying silent on the 38 that aren't. A cheap review that cries wolf 40 times is worse than no review: it trains you to ignore the report, and the one finding that mattered goes out with the noise.
So when you compare quotes, don't compare "number of findings." Compare signal. Ask for a sample report. If it's 40 low-severity "consider using a constant here" items padding out two real issues, you're paying for noise.
How to spend a small budget well
- Clean the obvious stuff first. Before you pay anyone, run a self-check: who can call what, is the initializer locked, is there a first-depositor guard on your vault, do rescue funds go to a fixed address. Fixing the boring bugs yourself means the reviewer's time goes to the hard ones.
- Scope tightly. Get your core — the contracts that hold or move funds — reviewed deeply. Don't spread a small budget thin across peripheral code.
- Prefer someone who'll tell you plainly when your code is solid. An honest "this part is fine, spend your money on that part instead" is worth paying for. Overselling is the tell.
- Get a free first-pass before you commit. It shows you the reviewer's signal-to-noise before any money changes hands.
The uncomfortable truth
An audit is a snapshot. It expires the moment you change a line of code. And it catches classes of bugs — access control, vault math, reentrancy, oracle staleness — not your protocol's bespoke economic logic, the one where two functions interact in a way nobody modeled.
So budget for two things, not one: a deep review of the novel parts (where the real risk is), and ongoing monitoring so a later change doesn't quietly reopen a hole. A one-time stamp on code that keeps changing is a false sense of safety.
I run security reviews for small and new protocols — fast, honest, and I'll tell you plainly when your code is solid. I keep my open-source scanner at zero false positives across the entire OpenZeppelin library, because a tool (or a person) that cries wolf isn't worth listening to.
If you want a free first-pass before you ship, it's open source and runs in one command: https://github.com/juan23z/openclaw-audit
Good luck on mainnet. 🚀
Top comments (0)