Quick answer: To get smart contract audit quotes, describe your code once: what it does, the language and chain, the repository, and when you need the audit. Send that to several qualified firms at the same time, then compare their quotes on price, timeline, team and approach before choosing. On Procur3 that takes four steps, it's free for teams, and a typical request gets around 20 quotes.
This guide walks through each step on Procur3, with screenshots, so you know exactly what you'll be asked for and what you'll get back.
Before you start: what to have ready
You can post with less, but you'll get more accurate quotes if you have:
- Your repository link, or links if the code is split across several. Private repos are fine; more on that below.
- The specific commit or branch you want audited, so every firm quotes on the same code.
- A rough idea of size. The number of lines of code, ideally as nSLOC (lines of code without comments and blank lines). The audit cost calculator explains it if you're unsure.
- Any documentation: a whitepaper, architecture notes, or a short write-up of how the contracts fit together.
- When you need it: your target start date, and your launch date if there is one.
If you want a fuller checklist, read how to prepare for a smart contract audit. It covers what auditors need to quote accurately.
Step 1: Basics. Describe what you're building
Go to procur3.io/new-request. You don't need an account to start; your draft stays private and nothing is sent to firms until you publish.
Fill in four things:
- Project title. Plain and specific. "Lending protocol audit, v2 contracts" tells firms more than "Audit request".
- Service category. Pick every type of work you need. Most teams choose smart contract audits; if you also want your app, servers or infrastructure checked, add penetration testing or cloud and infrastructure review in the same request.
- Language of the work. Optional, but it's the fastest way to make sure only firms that work in your stack see it. Solidity, Rust, Move, Noir and others are listed.
- Description / scope of work. What the code does, what's in scope and what isn't, and anything unusual: upgradeable contracts, oracles, bridges, cross-chain messaging.
A good description, as an example:
Fixed-rate lending protocol on Base. Six contracts, about 2,400 nSLOC in Solidity. In scope: the lending pool, the interest-rate model, liquidation logic and the oracle adapter. Out of scope: the token contract, which was audited in March. Contracts are upgradeable through a proxy with a 48-hour timelock. We'd like the audit to start in early December, ahead of a January mainnet launch.
Not sure how to scope it? Tick "Get help from the Procur3 team" in the panel beside the form. Write what you know, and the team will get in touch to scope the request, shortlist firms and compare the quotes with you.
Step 2: Technical. Share the code
- Repository links. Add as many as you need.
- Code size. Your nSLOC estimate. Firms use it to work out how many reviewer-days the audit will take.
If your repo is private, you don't need to make it public. Firms that want to quote send you their GitHub usernames in Messages, and you add only the ones you choose.
Need an NDA, or want to attach documents? If you already have an account, post from your dashboard instead. The full request form there adds attachments, such as docs, diagrams or a previous audit report, and an NDA upload. Firms sign your NDA before you give them access to anything sensitive.
Step 3: Budget. Timing and money
- Budget. Optional. You can post without one, and many teams do. If you have a ceiling, adding it helps firms quote realistically. For a sense of typical prices, see what smart contract audits cost in 2026.
- Proposal deadline. How long firms have to send quotes. We recommend at least five days, so that firms with full calendars still have time to look properly. You can set it shorter if you're in a hurry.
- Target start date. When you want the audit to begin. Good firms are often booked weeks ahead, so the earlier you post, the more choice you'll have.
Step 4: Review. Check, choose who sees it, publish
Check the summary. The "Who sees it" row tells you exactly who will receive your request:
- Matched firms. By default, every approved firm on Procur3 that works with your language and service is notified. This gets you the most quotes.
- Private. Only the firms you invite can see it. Choose this from the dashboard request form if your scope is sensitive or you already have a shortlist.
Either way, nothing you post is ever visible to the general public.
Want a quote from one particular firm? Start from that firm's profile in the audit firms directory and click "Request a quote". The request is set up as private to that firm, and you can switch it to every matched firm before you publish if you'd like to compare.
When you're happy, publish. You'll create an account at this point if you haven't already, and your draft carries straight through.
What happens next: the quotes arrive
The first quote usually arrives within 30 minutes. On a typical request you'll receive around 20.
Every firm quotes on the same fields, so you're comparing like with like:
- Price
- Timeline: start date and how long the audit will take
- Team: who will actually do the review
- Approach: how they'll review your code and what's included
Firms can message you in the app if they have questions about the scope. Answer them there so every firm gets the same information.
How to compare the quotes
Don't just pick the cheapest. The same code can get quotes three to five times apart, usually because firms are offering different amounts of work. Ask three questions of every quote:
- What exactly is included? Manual review, automated tools, fuzzing, formal verification? If it isn't listed, assume it isn't included.
- Who is on the team, and for how long? Named senior reviewers for three weeks is a different product from one junior reviewer for six.
- Is the fix review included? After you fix the problems the auditors find, they should check your fixes. Confirm whether that's in the price or billed again.
Most teams choose within 48 hours on average, and most of that is the time it takes to read the quotes properly. It can be done in a few hours.
Choose a firm and get started
When you've decided, award the work to your chosen firm. From there you agree the start date, give the firm access to your code, and keep the engagement and its conversations in one place.
You can also award different parts to different firms: one for the smart contract audit and another for a penetration test, for example.
Running several audits a year?
If your team sources security work regularly, across several contracts, products or teams, Procur3 for Enterprise is built for that. Keep the auditors you already work with, source new specialists when you need them, and track every budget, approval and finding in one place.
Frequently asked questions
How do I get a quote for a smart contract audit? Describe your code once: what it does, the language and chain, the repository, what's in and out of scope, and when you need it. Send it to several qualified firms at once and compare the quotes. On Procur3 that's a four-step form, free for teams, and a typical request gets around 20 quotes.
How long does it take to get audit quotes? On Procur3 the first quote usually arrives within 30 minutes, and most quotes come in before the proposal deadline you set. We recommend giving firms at least five days. Teams choose a firm within 48 hours on average once the quotes are in.
Do I need to make my code public to get a quote? No. Firms that want to quote ask for access in the app, and you invite only the ones you choose. You can also require an NDA before anyone sees your code.
How many quotes should I get? Enough to compare properly. One quote gives you nothing to compare it with. A typical request on Procur3 gets around 20, which shows you the real range of prices and approaches for your scope.
Is it free to post a request? Yes. Posting a request and comparing quotes on Procur3 is free for teams. You pay the firm you choose for its work.