How a coding error can cost millions: why smart contract audits matter

What is a smart contract audit and why is it conducted?

Security issues are one of the most common reasons for blockchain project failures. According to 2025 data, vulnerabilities in smart contracts resulted in losses of approximately half a billion US dollars. Furthermore, according to a report by Oak Security, the cumulative damage caused by smart contract vulnerabilities since 2020 has exceeded $2.4 billion.

Approximately 40% of all incidents were caused by reentrancy attacks*, which are often associated with insufficient smart contract auditing.

* Reentrancy Attack is a smart contract vulnerability that allows an attacker to repeatedly call a contract function before its initial execution is completed. How it works:

A smart contract sends funds to a user.
Before updating its internal balance, the contract receives a new call from the attacker.
Funds are withdrawn again.
The process can be repeated multiple times until the available funds are exhausted.

One of the most well-known examples is the 2016 hack of The DAO, in which approximately 3.6 million Ethereum were stolen through a reentrancy attack.

The ecosystems most affected by smart contract audit-related security issues are Ethereum, BNB Chain, and NEAR Protocol, which account for the overwhelming majority of successful hacking incidents.

What is a smart contract audit?

Before understanding what a smart contract audit is, it is necessary to understand what smart contracts are and why the security of blockchain projects depends on them.

A smart contract is a self-executing program on a blockchain that verifies whether transaction conditions have been met and carries out operations between parties.

Smart contracts replace centralized intermediaries such as brokers and exchanges, which is why smart contract audits are critically important for blockchain projects.

A smart contract audit is a comprehensive review and analysis of source code aimed at identifying and eliminating vulnerabilities that could lead to a smart contract exploit.

A smart contract audit helps identify:

Errors in decentralized protocol code;
Unintentional or intentionally embedded vulnerabilities that could be exploited in attacks;
Inefficient sections of code;
Logical flaws in smart contract functionality that may result in incorrect execution of operations;
Access control issues that could allow attackers to gain administrator privileges or control project funds.
Vulnerabilities arising from interactions between multiple smart contracts;
Risks related to price manipulation, oracles, and external data sources;
Problems with smart contract upgradeability when the project uses proxy contracts or other code-modification mechanisms.
Errors in tokenomics, fee distribution, reward calculations, or collateral calculations;
Discrepancies between the actual behavior of the code and the project's declared business logic.

The importance of smart contract audits for decentralized protocols and applications stems largely from the irreversibility of blockchain transactions. As a result, funds stolen by hackers are often nearly impossible to recover.

What does a smart contract audit consist of and who conducts it?

The number and sequence of measures used in a smart contract audit are determined by the auditing company. However, audits most commonly include a preparation stage, code analysis, vulnerability assessment and verification, and report generation.

The list of methods and tools used for smart contract auditing and eliminating project "bottlenecks" is quite diverse and includes:

1. Collaborative smart contract audits

Under this approach, a project hires several companies to audit its smart contracts simultaneously. This makes it possible to cover more attack vectors than if only one company conducted the review.

2. Competitive smart contract audits or Bug Bounty programs

This method involves organizing a competition among auditors and rewarding those who are the first to discover critical vulnerabilities in the source code.

3. Automated smart contract audits

Companies use software tools, including those based on artificial intelligence (AI), to identify and eliminate vulnerabilities. This method accelerates vulnerability detection but is typically combined with expert reviews.

4. Closed testing

This approach involves forming a dedicated group of cybersecurity specialists who jointly conduct a smart contract audit.

5. Open testing

If the project's source code is publicly available, independent specialists can participate in the smart contract audit. The more external auditors involved in analyzing the project's security, the lower the risk of overlooking critical vulnerabilities.

After completing the smart contract audit, the auditing company prepares a report listing all identified vulnerabilities and recommendations for remediation.

Typically, vulnerabilities are categorized as follows:

Critical — severe security issues that require immediate remediation;
High Severity — issues that disrupt operations and contain logical flaws that may create opportunities for exploitation;
Medium Severity — vulnerabilities that may affect performance and security but are not critical;
Low Severity — issues indicating inefficient code segments that do not pose a direct threat to project security;
Informational — general recommendations for improving the codebase.

Smart contract audits are conducted by specialized auditing firms such as:

CertiK;
OpenZeppelin;
Hacken;
Quantstamp;
BlockSec;
SlowMist;
ChainSecurity and others.

These companies provide comprehensive smart contract auditing services for a fee. The cost of such services can reach $10,000 or more, depending on the project's requirements and complexity.

Does a smart contract audit guarantee security?

The paradox is that a smart contract audit alone does not provide any security guarantees. A smart contract audit merely helps identify issues that project developers may have overlooked for various reasons.

As early as 2023, researchers at AnChain.AI found that more than 90% of hacked blockchain projects, including the well-known Wormhole protocol, had undergone smart contract audits.

Much also depends on who performs the smart contract audit. If a project attempts to save money and hires inexperienced auditors merely for appearances, it may face serious security issues in the future.

Due to insufficient auditor expertise, certain security gaps may remain unnoticed, and a single overlooked vulnerability can be enough to cause a project's failure.

There are also several other reasons why projects may fail even after undergoing smart contract audits:

Outdated code

Some projects continue to use older versions of smart contracts that may contain vulnerabilities even after the protocol has been updated. For example, the well-known Yearn Finance protocol was compromised for this reason.

Supply chain attacks

Smart contracts are only one of several potential attack surfaces in a cryptocurrency project. The challenge is that a smart contract audit may not fully cover other vulnerable components, such as code libraries or development environments, which can also be compromised.

Lack of continuous updates

New attack vectors regularly emerge in the cryptocurrency industry and may not be covered by previous smart contract audits. Security specialists often focus on known attack methods and may overlook less common vulnerabilities. Therefore, project teams should conduct regular follow-up audits of smart contracts.

Incorrect security approach

Some projects view a smart contract audit as a self-sufficient security measure. In reality, cybersecurity is a complex, continuous, and evolving process that extends far beyond a one-time smart contract audit.

Human factor

Although advances in artificial intelligence have made smart contract auditing increasingly automated, specialists still perform many audit tasks manually. Auditors may overlook coding errors or misinterpret code logic, leading to security incidents.

It is also important not to overlook zero-day vulnerabilities*, which may be discovered and exploited by attackers before or during a smart contract audit.

* Zero-Day Vulnerability is a previously unknown flaw or weakness in software that has not yet been identified by developers or security professionals. The term "zero-day" means that developers have zero days to prepare a fix because attackers can begin exploiting the vulnerability immediately after discovering it. Key characteristics:

No patch or fix is available.
Difficult to detect using standard auditing methods;
Can be exploited before becoming publicly known;
Represents a significant security risk for the project.