One-time

One-time Smart Contract Audit

A single point-in-time audit of your codebase, delivered as a written report — the same work as the retainer, without the recurring component.

For teams that want one thorough review rather than ongoing coverage: before a launch, before a major version, or to see how I work before committing to anything monthly. Still scoped to small and independent teams — I am one reviewer, not a firm bidding on large protocol audits.

From $1,200, priced per project on scope and fixed in writing before the work starts.

Get a quote

or book a 30-minute call

Medium: Code4rena finding on Megapot
Critical: Finding on BulkSender
2 paid: Audits: KoinArcade and BulkSender
3 disclosed: Ronin projects: Fableborne, Apeiron, MoTZ

Several of these are Ronin ecosystem projects, because that is where a lot of small GameFi teams ship. The work itself is not Ronin-specific: the review covers Solidity and Vyper on any EVM-compatible chain, including Ethereum, Base, Arbitrum, BNB Chain, and Polygon.

Best fit for

You are about to launch and need one thorough review of the whole system

You are shipping a major version and want a report you can publish

You want to see how I work before committing to a retainer

Your contracts change rarely enough that a monthly retainer would be poor value

Focus areas

What I look at on this kind of codebase

Security and exploitability only. Gas optimisation, code style, and general code quality are explicitly out of scope.

Access control

Owner and role boundaries, upgrade paths, emergency functions, and every privileged call that could be reached by the wrong address.

Accounting and token flows

Balance tracking, fee-on-transfer and rebasing assumptions, rounding direction, and the arithmetic that silently drains a pool.

External call safety

Reentrancy across the whole call graph, untrusted callbacks, return-value handling, and assumptions about integrated protocols.

Economic logic

Incentives, reward emission, liquidation and slippage parameters — the sequences of entirely legal transactions that end badly.

Oracle and price assumptions

Manipulation windows, stale data handling, and what happens to your protocol when a feed reports something absurd.

Upgrade and deployment risk

Proxy storage layout, initialiser protection, and the deployment scripts that ship a different contract than the one reviewed.

Deliverables

What you receive

Severity-rated findings report

Every issue written up with impact, likelihood, the exact affected lines, and a concrete remediation step you can hand straight to a developer.

Proof-of-concept exploits

Where a finding is exploitable I include a reproducible test, so your team can confirm the severity instead of debating it.

Prioritised fix list

Findings ordered by what actually threatens funds first, so a short remediation window is spent on the right things.

Follow-up support

Questions about a finding or a proposed patch get answered while you are still shipping the fix, not after the invoice clears.

Pricing

What this costs

Project-based pricing, fixed in writing after I read the repo and before any work starts. There are no hourly overruns.

One-time Full Audit

From $1,200

Project-based, not monthly

Priced per project on the size and complexity of the scope, agreed in writing before the work starts. Typical engagements for the teams I work with land between $1,200 and $5,000; larger scopes are quoted after reading the repo.

Turnaround depends on scope and is fixed on the scoping call — usually 1 to 3 weeks from the day the code is frozen.

Get a project quote

Who this is not for

This is still scoped to small and independent teams. I am one reviewer, not a firm, and I do not bid on large protocol audits that need a multi-person team and a months-long timeline.

Scope is security only

I review whether the changed code can be exploited, and what it breaks in the code it touches. I do not review gas optimisation, code style, naming, architecture preference, or general code quality. If something is inefficient but safe, I will not spend your review on it.

Shipping regularly rather than once? Ongoing review starts at $300/month.

The quoted price is the price

Your monthly number is set after the Onboarding Review, agreed in writing before the first month starts, and does not move inside the term. No hourly overruns, no scope-creep invoices, no surprise line items.

Confidential by default

Your code and findings are never published or shared without your written permission. NDA on request, signed before you send anything.

Get your next deploy reviewed before it goes live

Send me your repo, your chain, and roughly how often you ship contract changes. You get a monthly number and a start date back, usually the same day.

Get a quote

or book a 30-minute call

No obligation, and no sales sequence. Ongoing Review runs for a 3-month minimum, then month to month with 30 days' notice.

FAQ

Questions before you start

What is included in a one-time smart contract audit?

A manual line-by-line review of the contracts in scope, exploit testing of the paths that look breakable, a written findings report with severity ratings and remediation steps, and follow-up support while you patch.

Should I take an audit or the ongoing retainer?

Take the audit if your code is about to be frozen for a launch or a major version, or if your contracts rarely change, and note that it does not require an Onboarding Review first. Take ongoing review if you are shipping contract changes regularly and want each change reviewed before it goes live. Teams that do both keep ongoing review running and book an audit at each major release.

How much does a one-time smart contract audit cost?

One-time Full Audits start from $1,200 and are priced per project on the size and complexity of the scope. Typical engagements for the small teams I work with land between $1,200 and $5,000. The price is fixed in writing after I read the repo, before any work starts.

How long does a one-time audit take?

Usually one to three weeks from the day the code is frozen, depending on scope. The delivery date is agreed on the scoping call rather than estimated afterwards.

Can I see an example report first?

Yes. The full BulkSender and KoinArcade reports are published on this site, so you can judge the depth and format before committing to anything.