Smart contract audit
A smart contract audit is a security review of a DeFi protocol's or token's code by specialists looking for vulnerabilities and logic errors. It lowers the risk of a hack but does not remove it.
How it works
Auditors read the code line by line, run automated analysers and tests, and look for known bug types: reentrancy, wrong access controls, oracle manipulation. At the end they publish a report listing issues by severity and whether the team fixed them.
An audit covers one specific version of the code. If the contract is upgraded or a new feature added later, only the old version was reviewed. An audit also does not check whether the team is honest: the owner may still be able to mint tokens or pull funds, which a report may flag as a "centralization risk".
Good signs: several audits from different firms, a bug bounty programme, open source code and a long history without incidents. An "Audited" badge on a website with no link to the report means nothing.
A protocol shows its report: 2 critical, 5 medium and 12 minor issues, all critical ones marked "fixed". But the report notes that the owner can raise fees to 100% and pause withdrawals. The code was technically reviewed, yet the risk of the team taking the money remains.
A common mistake is seeing the word "audit" and assuming a project is safe. Open the report itself: who wrote it, which code version was checked, whether critical issues were fixed and what powers the owner has. Even audited protocols have been hacked, so do not keep more in one place than you can afford to lose.
Questions and answers
What is a smart contract audit in simple terms?
It is a code review by security specialists. They look for bugs that could let someone steal funds or break the protocol.
Does an audit guarantee a project will not be hacked?
No. It lowers the risk, but it does not catch everything, and code can change after the review.
How do I check a project's audit?
Find the report on the audit firm's own site, not just the project's. Match the contract address and see whether serious issues were fixed.
Related terms
Read next
A decentralized exchange has no support desk and no undo button. Here is what to check before a swap so your tokens do not end…
Read →Stablecoin depegA stablecoin depeg is a loss of its target price, usually $1, when it trades clearly and persistently below or above…
Updated: 2026-10-19