A smart contract audit is a snapshot of code quality at a point in time. It is not a guarantee. Reading audits well — and knowing what is missing — is the most underrated skill in DeFi.
What an audit actually is
A team of auditors (Trail of Bits, ChainSecurity, OpenZeppelin, Spearbit, Code4rena, Cantina, Sherlock) reviews the code for vulnerabilities and writes a report. Findings are categorised by severity (critical, high, medium, low, informational). The protocol typically fixes issues and the auditor signs off on the patched version.
What to look at first
- Date — Has the code changed substantially since the audit?
- Scope — Which contracts were reviewed? Is the deployed contract the same?
- Critical and high severity findings — Were they fixed, mitigated, or accepted?
- Auditor reputation — Established firms have higher quality but no firm catches everything.
- Number of audits — A single audit is okay; multiple from different firms is stronger.
Red flags
- Audit predates major code changes — Common in fast-moving protocols.
- Critical findings marked "acknowledged" rather than "fixed" — The protocol decided not to fix a serious issue.
- Scope excludes the contracts handling user funds — Often deliberate, often dangerous.
- No public bug bounty — Audits catch a fraction of issues; bug bounties find the rest.
- Audits from unknown firms — Some "auditors" rubber-stamp for fees.
What audits do not catch
Economic / game-theoretic exploits (Beanstalk, Mango Markets). Oracle manipulation that is technically valid. Governance attacks. Composability issues across protocols. Front-running and MEV opportunities. Most major DeFi exploits since 2022 were not bugs in the audited code — they were design flaws or interactions the audit was not asked to consider.
Beyond audits
- Time in production — Code that has held billions of dollars for years has proven more than any audit can.
- Active bug bounty — Immunefi and Hats bug bounties pay real money for real findings.
- Formal verification — Some protocols (Maker, Aave) use mathematical proofs for critical invariants.
- Incident response history — How a team handled past issues is a strong signal.
Building a simple checklist
- Is the protocol > 12 months old with > $100M TVL?
- Has it been audited by ≥ 2 reputable firms?
- Is there an active bug bounty paying meaningful amounts?
- Are critical findings from past audits clearly resolved?
- Has the team handled past incidents transparently?
See our phishing and wallet drainer guide for adjacent personal security, and our yield farming 2026 guide for protocol stack risks.
