How Much Does a Smart Contract Audit Cost?

“How much does a smart contract audit cost?” is difficult to answer publicly because the honest answer — it depends on scope — is useless to someone trying to budget. So here are actual numbers, the variables that move them, and how to tell whether a quote is reasonable.

The rough market rates

Broadly, the market splits into three tiers:

Who	Typical range	What you get
Independent auditor	€250 – €5,000	One experienced reviewer, direct contact, days not weeks. Best value for small-to-medium codebases.
Boutique firm	€10,000 – €40,000	Two or more reviewers, formal process, a brand investors may recognise. Multi-week lead times are normal.
Top-tier firm	€50,000 – €250,000+	Large teams, formal verification on request, the name that appears in exchange listing requirements.

Competitive audit platforms such as Code4rena and Sherlock sit alongside these. They put many researchers on your code for a fixed prize pool — typically €20,000 upwards — and are excellent for coverage breadth, but you are buying a contest, not a relationship, and the findings arrive as a firehose that someone still has to triage.

What actually drives the number

Auditors are pricing time, and these are the things that consume it:

Lines of code in scope. The headline variable, but the least informative one on its own.
Logical complexity. A 300-line AMM with custom curve maths takes longer than a 900-line standard ERC-20 with a vesting schedule. Novel mechanisms take longest of all, because there is no prior art to check against.
External dependencies. Every protocol you integrate drags its assumptions into your threat model, and those have to be read too.
Documentation quality. If the reviewer has to reverse-engineer what the protocol is supposed to do, that is billable time spent not looking for bugs. Good specs genuinely reduce cost.
Test coverage. A codebase with a real test suite signals a team that has already thought about edge cases, and the reviewer can move faster.
Urgency. A rush job displaces other work and is priced accordingly.

Notably absent: which chain you deploy to. Ethereum, Base, Ronin, BNB Chain, and Polygon are all EVM, and the review is essentially the same work. Anyone charging a premium for “Base support” is charging for nothing.

The per-line sanity check

Independent audits tend to land somewhere between €1 and €10 per line of code in scope. That is a wide band, and deliberately so — it is a way to notice that a quote is strange, not a way to produce one.

If you are quoted €200 for a 2,000-line lending protocol, nobody is reading 2,000 lines. That is roughly a day of work for something that needs a week. The number is telling you what you are actually buying.

Reading a cheap quote

Cheap is not automatically bad. An independent auditor has no sales team, no office, and no account managers, and can legitimately charge a fraction of firm rates for the same reading time. Early-career auditors also price low deliberately to build a public portfolio, which can be excellent value if they are genuinely capable.

Cheap is bad when it means:

The “audit” is a Slither run with the output reformatted.
The reviewer has no public work you can inspect, in any form.
The quote arrived without anyone asking what the protocol does.
The turnaround is implausible — nobody meaningfully reviews a multi-contract protocol in 24 hours.

The test is not the price. It is whether they can show you a report and whether they asked you real questions before quoting. More on evaluating an auditor.

Reading an expensive quote

Expensive is worth it when you genuinely need what it buys: multiple independent reviewers looking at the same code, a brand name that unblocks an exchange listing or an investor requirement, or specialist capability such as formal verification.

Expensive is wasted when you are paying firm overhead for a junior reviewer, or buying a €40,000 audit for a 400-line staking contract because the number felt reassuring. Ask specifically who will be reading the code and what their public record is. “A member of our security team” is not an answer.

What the budget should be anchored to

Not your funding round — the value the contract will custody. A rough heuristic that holds up reasonably well:

Under €50k expected TVL: an independent review is proportionate.
€50k – €1M: a thorough independent audit with a retest, ideally by someone with domain experience in your category.
€1M – €10M: a firm, or two independent auditors reviewing separately. Redundancy starts paying for itself here.
Above €10M: multiple firms, a competitive audit, and an ongoing bug bounty. At this point security is a line item, not a purchase.

Hidden costs to ask about

Is a retest included? Many quotes cover the initial review only, and re-reviewing your fixes is billed separately. This is the most common surprise.
What happens if scope grows? Get the policy in writing before you start, not after you add a contract.
Is follow-up support included, and for how long?
Do you get a publishable report? Some engagements deliver findings you are contractually restricted from sharing, which defeats half the point if you wanted it for investors.

The comparison that actually matters

Teams tend to weigh audit cost against their runway. The more useful comparison is against the cost of the alternative: an exploit takes the funds, then the users, then the exchange listings, then a year of rebuilding trust that may never fully return. Set against that, the spread between a €900 review and a €40,000 one is rarely the decision that determines whether you survive.

My own rates are published on the security review pricing page rather than quoted on request, for exactly the reasons above — you should be able to compare before you talk to anyone.