Solidity audit
quotes from
70+ vetted firms
Post your scope once. Matched firms quote it, broken down by review depth.
Five layers of Solidity review, from automated tooling at the surface to economic attack analysis at the base. Three example quotes reach different depths: one stops at tooling, one at manual review, one at formal verification. None covers economic review.
- 01ToolingKnown patterns
- 02ManualIntended behaviour
- 03FuzzingMillions of paths
- 04FormalProved for every input
- 05EconomicGamed for profit
Procur3 shows how deep each quote really goes.
56 FIRMS ON PROCUR3 AUDIT SOLIDITY
THE PROBLEM
Why your quotes come back 5x apart
Put the same codebase to five qualified firms and the quotes land three to five times apart.
That's rarely brand pricing. The five firms are proposing different work. "Audit" covers at least five depths of review, from running a static analyser over the repo to mathematically proving invariants hold for every possible input. Most proposals never say which ones they include.
Until you know the depths, you aren't comparing prices at all.
- IN RFP BUDGETS POSTED
- $1.2M
- AVERAGE SAVED PER PROTOCOL
- $6,242
- FIRMS ON PROCUR3 AUDIT SOLIDITY
- 56
- TO FIRST QUOTE
- <1 hour
THE FIVE DEPTHS
What "audit" actually covers
DEPTH 01 · ALWAYS QUOTED
Automated analysis
Static analysers sweep the codebase for patterns the tooling already knows. Fast, cheap, and blind to anything novel.
- REVIEWED
- Known vulnerability patterns, compiler warnings, anti-patterns, code quality
- FINDS
- Textbook reentrancy · Unchecked return values · Unsafe compiler constructs · Obvious access-control gaps
- NEEDS
- Slither, Mythril, Aderyn
- IN A QUOTE
- Always. In essentially every proposal.
DEPTH 02 · ALWAYS QUOTED
Manual review
Senior reviewers read the code against what the protocol is meant to do. Logic bugs live here, and so does most of the price difference.
- REVIEWED
- Business logic, access-control paths, state transitions, integrations, upgrade and admin flows
- FINDS
- Logic errors that pass every check · Privilege escalation through admin paths · Cross-function state confusion · Wrong assumptions about integrations
- NEEDS
- Named senior reviewers with relevant protocol experience, and the hours to read the whole scope
- IN A QUOTE
- Always. Hours and seniority vary enormously.
DEPTH 03 · SOMETIMES QUOTED
Fuzzing and invariant testing
Generated inputs hammer the contracts against rules like "total shares never exceed total assets", reaching states no reader and no unit test will.
- REVIEWED
- Protocol invariants, edge-case inputs, multi-step call sequences, accounting and precision
- FINDS
- Rounding and precision drift · Sequence-dependent accounting bugs · Boundary cases · Invariants that break after long call chains
- NEEDS
- Written invariants, a harness (Foundry, Echidna, Medusa), compute time
- IN A QUOTE
- Sometimes. Often listed as a capability rather than scoped in.
DEPTH 04 · RARELY QUOTED
Formal verification
Critical properties are written as specs and proved to hold for every possible input. Applied where failure would be catastrophic, not across the whole codebase.
- REVIEWED
- Selected critical invariants: solvency, conservation of funds, access rules
- FINDS
- Violations a fuzzer statistically misses · Proof a property holds, rather than just no counterexample turning up
- NEEDS
- Formal specs, specialist engineers, Certora / Halmos / Kontrol, stable code
- IN A QUOTE
- Rarely. Usually quoted separately, at a premium.
DEPTH 05 · RARELY QUOTED
Economic and incentive review
Models what happens when someone attacks the protocol for profit. Code can be correct line by line and still get drained through its prices.
- REVIEWED
- Oracle design, liquidation and pricing logic, incentive and governance mechanics, flash-loan exposure
- FINDS
- Oracle manipulation paths · Flash-loan amplified attacks · Incentive loops that pay attackers · Governance capture
- NEEDS
- Mechanism designers, market data, adversarial simulation
- IN A QUOTE
- Rarely. Most oracle attacks break nothing in the code, so code review doesn't look for them.
Contracts are one layer of your attack surface. See what a full dApp audit covers.
THREE TYPICAL PROPOSALS
Three quotes, same codebase
- Firm A5 OF 5 DEPTHS
$62,000
- TIMELINE
- 6 weeks
- REVIEWERS
- 3 named senior
- EXPERIENCE
- Lending protocols, formal methods
- 01 Automated analysisIn scope
- 02 Manual reviewIn scope
- 03 Fuzzing and invariantsIn scope
- 04 Formal verificationIn scope
- 05 Economic reviewIn scope
Everything, down to proofs and market attacks.
- Firm B3 OF 5 DEPTHS
$34,000
- TIMELINE
- 4 weeks
- REVIEWERS
- 2 named
- EXPERIENCE
- DeFi contracts, AMM design
- 01 Automated analysisIn scope
- 02 Manual reviewIn scope
- 03 Fuzzing and invariantsIn scope
- 04 Formal verificationNot in scope
- 05 Economic reviewNot in scope
Every code path. Nothing about the market.
- Firm C2 OF 5 DEPTHS
$12,500
- TIMELINE
- 10 days
- REVIEWERS
- 1 reviewer
- EXPERIENCE
- General Solidity
- 01 Automated analysisIn scope
- 02 Manual reviewIn scope
- 03 Fuzzing and invariantsNot in scope
- 04 Formal verificationNot in scope
- 05 Economic reviewNot in scope
Tooling plus one careful read-through.
COST AND TIMELINE
What a Solidity audit costs
A simple token contract runs $1,000–$15,000. A mid-complexity DeFi protocol runs $20,000–$100,000. Formal verification or economic review adds significantly on top.
The spread matters more than the midpoint: the same scope lands 3–5x apart across qualified firms, because each one prices a different depth.
- 1 to 2 wksSmall contract
- 3 to 4 wksStandard DeFi protocol, plus remediation review
- 4 to 12 wksBooking queue at top firms, before work starts
Audit cost calculatorEthereum / EVM, Solidity
Indicative market range
$52K to $92K
3 to 4 weeks. An estimate, not a quote.
Get quotes for this scopeOther chains and languages
HOW PROCUR3 WORKS
How Procur3 works
Post your scope once
Repo, commit, chains and deadline. One brief instead of five sales calls.
Matched firms quote
Firms with relevant Solidity experience quote against the same brief.
Compare by depth
Price, timeline, named reviewers, methodology and all five depths, side by side.
Award on specification
Pick a firm knowing exactly which depths you're paying for.
Ready for your audit?
Get competing quotesProcur3 fills a gap no other platform serves: matchmaking between protocols and audit firms. No rounds of calls just to get a quote — for our Base contracts we compared multiple high-quality providers at once and weighed their strengths per project. We'll keep doing business with them.
Antonio ViggianoRheo (prev. Size Credit)Security isn't an afterthought for TermMax. Thanks @procur3 for helping us run a clean RFP to find specialized Daml auditors ahead of our Canton Network launch.
TermMaxFAQ
Frequently asked questions
A security review of Solidity smart contracts before deployment. The term covers a wide range of depth, from automated static analysis through manual review, fuzzing, formal verification and economic modelling. Two firms can both deliver a "Solidity audit" with very little overlap in the work performed, which is why confirming scope by depth matters more than comparing headline prices.
A simple token contract runs $1,000–$15,000. A mid-complexity DeFi protocol runs $20,000–$100,000, and formal verification or economic review adds significantly on top. The same scope routinely lands 3–5x apart across qualified firms, because each prices a different depth of work.
Partly firm utilisation and brand, but mostly depth. A quote covering automated analysis and a fast manual pass is a different product from one including fuzzing, invariant testing and formal verification. Quotes rarely state which layers are included, so the comparison is unreadable until you ask.
One to two weeks for a small contract, three to four weeks for a standard DeFi protocol, plus remediation review. Top firms also carry four to twelve week booking queues before work starts.
56 firms on Procur3 audit Solidity, including Quantstamp, Nethermind, Consensys Diligence, Sigma Prime, Sherlock, Hacken and Halborn. Compare their services, chains and audit history on the auditors page.
Get quotes on your Solidity scope
Get matched with a firm from our network of 70+.