A smart contract audit is a systematic review of smart-contract source code intended to identify vulnerabilities, logic errors, access-control problems, and other issues that could cause loss of funds or unexpected protocol behavior.

Auditing is particularly important for contracts that manage large amounts of capital. This includes liquidity pools, lending protocols, bridges, staking systems, and other DeFi applications.

What an audit may examine

  • access control and administrative functions;
  • mathematical calculations and balance handling;
  • input validation and edge cases;
  • repeated execution and state-transition issues;
  • economic attack scenarios and incorrect protocol assumptions;
  • integrations with oracles and other contracts;
  • ways in which funds could become locked, drained, or incorrectly allocated.

An audit may combine manual code review, automated static-analysis tools, testing, and simulation of potential attacks. Automated tools are useful for identifying classes of defects, but they cannot guarantee that all logical or economic vulnerabilities will be found.

An audit report does not mean that a smart contract is absolutely safe. The code may change after the audit, new attack techniques may emerge, or a vulnerability may exist outside the scope of the review.

Users of decentralized finance applications should therefore consider not only whether an audit exists, but also its scope, date, reviewed contract version, stated limitations, and subsequent protocol changes.