A serious smart contract audit costs somewhere between $15k and $100k+, depending on scope and complexity. For a team before its first raise, that can be more than a month of runway. So a lot of founders look at the quote, close the tab and ship anyway.
I run a small audit firm, so weigh my bias. But "audit or nothing" is the wrong way to frame it. The useful question is: what is the most risk I can remove per dollar, at the stage I'm actually at?
Here's how I'd answer it.
The options, side by side
| Option | Rough cost | What it covers | What it misses |
|---|---|---|---|
| Ship unaudited | $0 today | Nothing | Everything |
| Static analysis (Slither, Aderyn) | $0 | Known bug patterns | Your logic |
| AI-assisted review | $0 to $200 a month | Broad pattern coverage | Accountability, economic logic |
| Public audit contest | $20k+ prize pool | Many eyes, variable depth | Early teams' budgets |
| Bug bounty | Pay per finding | Bugs found after deploy | Everything before deploy |
| Time-boxed senior review | A few hundred to a few thousand dollars | Your highest-risk contracts | Full coverage |
| Full audit | $15k to $100k+ | Full scope, re-checks | Nothing in scope, if done well |
What each one is actually good for
Shipping unaudited is fine on testnet with no user funds and no token. The trap isn't getting hacked on day one. It's that value arrives slowly, and by the time the protocol is worth attacking, the team is used to shipping without review.
Static analysis should run in your CI no matter what. It catches the embarrassing bugs: reentrancy shapes, unchecked calls, common access control mistakes. It does not catch the expensive ones. No analyzer knows your withdrawal formula rounds the wrong way or that liquidations break when the oracle goes stale.
AI review finds real bugs now. I build AI auditing tooling myself, so I've seen both sides: without a human who audits for a living checking the output, it gives you false confidence in both directions. It flags things that aren't exploitable and stays quiet on economic logic it doesn't understand. A strong complement, a weak replacement.
Audit contests can go deep, but competitive prize pools start around $20k and quality depends on how attractive your pool is to good researchers that week. They suit funded teams near mainnet with code stable enough to freeze.
Bug bounties aren't a review at all. They're an incentive for after you deploy, so the bug gets found once user funds are already behind it. Run one alongside everything else once you're live, never instead of reviewing before launch.
A time-boxed senior review is the category built for exactly this gap: a senior auditor spends one to three days on the contracts where the money moves. It's not line by line over everything, and it's not an audit. Anyone who sells you a two-day review as "audited" is setting your users up.
What I'd pick at each stage
- Testnet, nothing at risk: static analysis in CI plus AI review. Spend $0.
- Real users or funds arriving, budget under about $5k: a time-boxed senior review of the contracts that hold the money, plus the free tools. This is the most risk removed per dollar you can get.
- Funded and heading to serious TVL: a full audit, maybe preceded by a contest.
- Live at any stage: add a bug bounty on top.
Three questions before you pay anyone
Whatever you choose, ask these first:
- Who exactly reads the code, and what's their track record?
- What do I get in writing?
- What am I allowed to claim publicly afterwards?
If the answers are vague, or a cheap review comes with an "audited by" badge, walk away.
What did you do for security before you could afford a full audit? Curious what worked for other teams, and what you'd skip next time.
Adapted from a guide our team published on zealynx.io.
I wrote this with help from AI for drafting and editing. The opinions and the audit experience are mine.
