Audit Firm
A specialized security company that systematically reviews smart contract code for vulnerabilities before or after deployment, producing a public report of its findings.
A smart contract audit firm is a specialized security company that systematically reviews a protocol's code, looking for known classes of vulnerabilities — such as reentrancy (see Kaavon's "Reentrancy Attack" glossary definition), access-control flaws, and arithmetic errors — using a combination of manual code review, automated analysis tools, and sometimes formal verification (see Kaavon's "Formal Verification" glossary definition) techniques. The firm typically produces a public report detailing any issues found, their severity, and whether the project has since fixed them.
An audit is a point-in-time review of the specific code version examined, not an ongoing guarantee, and it can't catch every possible vulnerability — audited protocols have still been exploited, sometimes through bugs an audit missed, and sometimes through code changes made after the audited version was reviewed. Because of this, a protocol's audit history (including how many firms reviewed it, how recent the audit is relative to the current deployed code, and how the project responded to findings) is generally treated as one meaningful input into assessing its security posture, rather than a sufficient guarantee on its own.
Examples
- A protocol might undergo audits from multiple independent firms before launch, since different audit firms often catch different categories of issues.
- An audit only covers the specific code version reviewed at the time, so a protocol that deploys new, unaudited code after its audit reintroduces unreviewed risk.