--- title: "Smart contract audits: what they include, when they are non-negotiable and how to read the report" url: "https://www.unknowngravity.com/en/articulos/smart-contract-audits" site: Unknown Gravity published: "2026-08-13T06:40:02+00:00" modified: "2026-08-13T06:40:02+00:00" language: en-US description: A smart contract audit is an independent review of code that is about to manage other peoples money, before it becomes immutable. section: "Home > Cryptocurrencies and tokens > Smart contract audits: what they include, when they are non-negotiable and how to read the report" --- # Smart contract audits: what they include, when they are non-negotiable and how to read the report BLOG · LEARN WEB3 13 AUG 2026 2 MIN READ [Unknown Gravity](/en/autores-post-del-blog/unknown-gravity) ![Smart contract audits: what they include, when they are non-negotiable and how to read the report](/wp-content/themes/unknowngravity/assets/cms/68516d7764c32d7e353a2e26_smartcontract_header.webp) **A smart contract audit is an independent review of code that is about to manage other peoples money, before it becomes immutable.** It is not a badge: it is the process that turns we think it works into a finite list of known risks, each with a severity and a status. On-chain there is no silent patching; what ships broken, stays broken. ## What a serious audit includes **Manual line-by-line review** by auditors who understand the protocol, not just the language — this is where the business-logic flaws no tool can see show up. **Static analysis** for the known vulnerability classes (reentrancy, overflow, access control). **Fuzzing and invariant testing**: bombarding the contract with extreme inputs and checking that the properties that must never break — the sum of balances, who can pause, who can mint — actually never break. And a **second pass after fixes**, because the fix for one finding sometimes introduces the next. The most frequent bugs we see are collected in [common Solidity mistakes](/en/articulos/smart-contracts-soliditys-errores-comunes-y-como-evitarlos). ## When it is non-negotiable Whenever the contract holds or moves **third-party funds**; in any **regulated issuance** (a security token with a flaw in its transfer restrictions is a legal problem, not just a technical one); before **integrating with DeFi protocols**, where risk is inherited; and after **every change** to an already-audited contract — an audit expires with the first commit. ## What it does not guarantee No audit certifies the absence of bugs: it bounds risk within a scope. Unless expressly contracted, oracles and external dependencies, admin key management and operations stay outside — and operations, incidentally, is where most real incidents happen. Distrust reports with zero findings: a non-trivial contract always has observations. ## How to read the report What matters is not the number of findings but their **severity and final status**: criticals and highs fixed and verified in the second pass; mediums accepted only with written justification. A useful report states the exact scope (the audited commit), the methodology and the tests executed — if you cannot reproduce what was tested, you do not know what was tested. ## Our practice We audit our own and third-party contracts as part of the [blockchain development](/en/servicios/desarrollo-blockchain) cycle, and as a standalone [smart contract audit](/en/servicios/blockchain-security-audits) service — with particular focus on regulated issuances, where the standard and its transfer restrictions are part of the regulatory file. If you have a contract about to ship, [talk to us before the deploy](/en/meeting). KEEP READING ## Related articles [13 AUG 2026 Ondo Finance (ONDO): what it is, how it works and why it leads RWA](/en/articulos/ondo-finance-ondo-explained) [13 AUG 2026 Blockchain and web3 consulting: what a consultancy does and when you need one](/en/articulos/blockchain-web3-consulting) [13 AUG 2026 Crypto-asset custody: who can custody, how it works and how to choose a custodian](/en/articulos/crypto-asset-custody)