A smart contract audit is an independent review of code that is about to manage other peoples money, before it becomes immutable. It is not a badge: it is the process that turns we think it works into a finite list of known risks, each with a severity and a status. On-chain there is no silent patching; what ships broken, stays broken.
What a serious audit includes
Manual line-by-line review by auditors who understand the protocol, not just the language — this is where the business-logic flaws no tool can see show up. Static analysis for the known vulnerability classes (reentrancy, overflow, access control). Fuzzing and invariant testing: bombarding the contract with extreme inputs and checking that the properties that must never break — the sum of balances, who can pause, who can mint — actually never break. And a second pass after fixes, because the fix for one finding sometimes introduces the next. The most frequent bugs we see are collected in common Solidity mistakes.
When it is non-negotiable
Whenever the contract holds or moves third-party funds; in any regulated issuance (a security token with a flaw in its transfer restrictions is a legal problem, not just a technical one); before integrating with DeFi protocols, where risk is inherited; and after every change to an already-audited contract — an audit expires with the first commit.
What it does not guarantee
No audit certifies the absence of bugs: it bounds risk within a scope. Unless expressly contracted, oracles and external dependencies, admin key management and operations stay outside — and operations, incidentally, is where most real incidents happen. Distrust reports with zero findings: a non-trivial contract always has observations.
How to read the report
What matters is not the number of findings but their severity and final status: criticals and highs fixed and verified in the second pass; mediums accepted only with written justification. A useful report states the exact scope (the audited commit), the methodology and the tests executed — if you cannot reproduce what was tested, you do not know what was tested.
Our practice
We audit our own and third-party contracts as part of the blockchain development cycle, and as a standalone smart contract audit service — with particular focus on regulated issuances, where the standard and its transfer restrictions are part of the regulatory file. If you have a contract about to ship, talk to us before the deploy.