Audit the transaction. Not just the contract.
Follow the transaction from interface to execution. Procur3 connects you with the specialists to secure every layer.
One scope70+ vetted firmsFirst quotes typically within the hour
Transaction path from user through frontend, wallet, backend and contracts, all running on shared infrastructure. Risk concentrates at the seams between layers.
- Transaction path
- Seam · trust boundary
- Infra dependency
- 01FrontendWhat users see
- 02WalletWhat users sign
- 03BackendWhat gets relayed
- 04ContractsWhat executes
- 05InfraWhat everything trusts
The highest-risk failures live between the layers.
- in RFP budgets allocated
- $1.18M+
- saved, 44.5% vs single direct quotes
- $525K
- vetted firms quoting on the platform
- 70+
- first quotes typically land within the hour
- <1 hour
A dApp is not just its contracts.
Most dApp audits stop at the smart contracts. But a transaction also passes through the frontend, wallet, backend and infrastructure—each with its own failure modes.
Select a layer to see what gets reviewed, which threats matter and who should review it.
Vetted security firms, one request away
Contract auditors, application-security testers and infrastructure reviewers quote on the same request.
Compare firms
Compare coverage, not sales pitches.
Post the scope once and receive structured proposals from firms covering the required layers. Compare price, timeline, named reviewers, experience and coverage side by side—and award one firm or several.
- Reach relevant specialists with one scope
- Compare coverage, reviewers and pricing
- Award one firm or multiple firms
| Attribute | Firm AFull coverage | Firm B4 of 5 layers | Firm CSpecialist pair |
|---|---|---|---|
| Price | $38,000 | $29,500 | $24,000 |
| Timeline | 5 weeks | 4 weeks | 3 weeks |
| Reviewers | 3 named reviewers | 2 named reviewers | 2 named reviewers |
| Relevant experience | Contract audits and web pentests | DeFi contracts and wallet flows | Application and cloud security |
| Coverage | 5 of 5 layers | 4 of 5 layers | 3 of 5 layers |
| Frontend | In scope | In scope | In scope |
| Wallet and signing | In scope | In scope | Not in scope |
| API and backend | In scope | In scope | In scope |
| Smart contracts | In scope | In scope | Not in scope |
| Infrastructure | In scope | Not in scope | In scope |
Before selecting a firm, confirm:
- Which layers are explicitly included?
Ask for the scope in writing, layer by layer. If frontend and backend are not itemised, they are not included.
- Which named reviewer handles application security?
Contract auditing and web application testing are different disciplines. Ask who covers the frontend and API work, and what they have tested before.
- Does the methodology follow the transaction end to end?
Attacks in this class live in the gaps between interface, backend and contract. A review that stops at the contract boundary leaves those gaps unexamined.
Who needs a full dApp audit
Not every dApp needs all five. A read-only interface over audited contracts carries a different risk profile to a dApp that constructs transactions server-side. Scope to what your architecture actually does.
- Your backend constructs or relays transactionsThat server is part of the attack surface.
- Users sign through your interfaceWhat they see before signing shapes what they approve.
- Approvals or off-chain signatures can move fundsThey need review beyond the contract that consumes them.
- You deploy frontend or dependency changes frequentlyEvery release passes through your build pipeline and dependencies.
How it works
- 01
Post
Describe your scope once, in one form.
- 02
Compare
Matched firms respond with price, timeline and named team.
- 03
Select
Award the engagement and track delivery in one place.
Procur3 fills a gap no other platform serves: matchmaking between protocols and audit firms. No rounds of calls just to get a quote — we compared multiple high-quality providers at once and weighed their strengths per project. We'll keep doing business with them.
Security isn't an afterthought for TermMax. Thanks @procur3 for helping us run a clean RFP to find specialized Daml auditors ahead of our @CantonNetwork launch.
Frequently asked questions
What is a dApp audit?
A security review of a decentralised application across its full stack: smart contracts, frontend, wallet integration, APIs and infrastructure. It differs from a smart contract audit, which reviews only the on-chain code. Many firms sell contract audits under the "dApp audit" label, so confirm scope layer by layer before signing.
Is a dApp audit different from a smart contract audit?
Yes, and the difference matters. A smart contract audit reviews on-chain code. A dApp audit also covers the interface, the wallet integration and the backend. The two largest exchange losses of the past three years, Bybit and Bitget, both came through those non-contract layers while the contracts and cryptography behaved exactly as designed.
How much does a dApp audit cost?
A contract-only review for a typical dApp runs $5,000 to $60,000 depending on complexity. Adding frontend, wallet integration and backend review typically adds 30% to 60%, because those layers need different specialists. Use the cost calculator for an indicative range on your scope.
How long does a dApp audit take?
Two to four weeks for contracts alone on a mid-complexity dApp. Add one to two weeks for frontend and backend review. Full-stack engagements on complex applications run six to eight weeks plus remediation.
Which firms do dApp audits?
Many firms audit contracts; fewer genuinely cover the application layer. Compare dApp audit firms on the Procur3 directory by service category, filtering for penetration testing and infrastructure review alongside smart contract audits. Ask any dApp audit company the three questions above before you sign.
Scope the whole transaction, once.
Post your dApp scope and compare quotes from firms that cover every layer.