Smart Contract Audit Cost in 2025: Pricing Models Explained

A clear, vendor‑neutral breakdown of how smart contract audits are priced in 2025, with fresh benchmarks, timelines, and budgeting templates for startups and enterprises. Use this to choose the right model (fixed‑fee, engineer‑week, contest, retainer, or formal verification) and avoid hidden costs.

TL;DR (for decision‑makers)

Real, public price points exist: Runtime Verification lists $20,000 per week with a minimum of roughly 3 weeks per 1,000 LOC; OpenZeppelin and Certora disclose multi‑hundred‑thousand‑dollar retainers in DAO governance forums; audit contests can range from five figures to seven figures. (runtimeverification.com)
Expect re‑audit cycles, remediation, and rush fees to add 20–40% to the base quote; plan for bug bounties sized to funds‑at‑risk (5–10% guideline). (blockchainappfactory.com)

Why 2025 budgets look the way they do

Security risk is not theoretical this year. Chainalysis’ 2024 report tallied roughly $2.2B stolen; mid‑2025 already surpassed 2024’s total due largely to major CeFi incidents and DPRK‑linked operations, pushing teams to increase pre‑launch scrutiny and continuous security spend. (reuters.com)

Bug bounties continued paying out nine‑figure totals since launch, signaling that meaningful vulnerabilities still slip past standard reviews—and that bounty sizing needs to be realistic. (theblock.co)

The five dominant pricing models you’ll see in 2025

Fixed‑fee per scope

What it is: A set price for a defined scope (repo link + commit hash + in‑scope files).
When it works: Stable code, clear docs, limited external dependencies.
Advantages: Predictable invoice; easy to compare proposals.
Watch‑outs: Any scope drift or new commits typically trigger change orders; re‑audits often billed separately. (diligence.consensys.io)

Per engineer‑week (time and materials)

What it is: Rates per week per auditor, often with a published weekly price.
2025 datapoint: Runtime Verification lists $20,000/week and suggests ≈3 weeks per 1,000 LOC to maintain quality. That implies ≈$60k per 1,000 LOC baseline. (runtimeverification.com)
Vendor benchmarks from public DAO proposals:
- OpenZeppelin “security partnership” with Venus (2023 proposal) priced 24 weeks over 6 months for $554,400 (≈$23,100/week).
- Certora’s 2025 Aave v4 proposal: $2.39M for a dedicated 4.5 FTE formal‑verification team; Certora discloses an annual price of $780k per FTE. (community.venus.io)

Audit contests (results‑driven pooled rewards)

What it is: Time‑boxed competitions (e.g., Code4rena, Sherlock) where a prize pool funds validated findings.
Economics: Code4rena operates with zero platform fee and a 96% conditional pool (refunded if no High/Medium) + 4% QA pool; a separate judging fee applies. Sponsors can start quickly (often within 48 hours), and invite‑only formats exist for tighter budgets. (zellic.io)
2025 datapoint: The Ethereum Foundation announced a $2,000,000 Sherlock‑hosted protocol upgrade contest (Fusaka) running four weeks—illustrating how major stakeholders now use contests to supplement traditional audits at scale. (blog.ethereum.org)

Retainer/continuous security

What it is: Ongoing audit bandwidth, governance proposal reviews, incident response, and fix reviews on call.
2025 datapoints from public governance:
- Certora retainer proposals to Aave: $1.5M for a year of continuous verification services; separate proposals disclose $780k/FTE/yr pricing and governance‑review retainers. (governance.aave.com)
- Community scrutiny of OpenZeppelin’s security partnership for Compound shows concrete audit cost line‑items per “chain,” “market,” and “asset,” helpful for forecasting per‑change costs. (comp.xyz)

Formal verification (FV) add‑ons

What it is: Mathematical property proofs and rule writing (e.g., Certora Prover), offered as SaaS + expert services.
Real numbers: Certora disclosed $70k/week for rule writing (subject to availability) and ~$2,000/month per Prover seat (historic proposals). Several Aave votes show multi‑million‑dollar FV budgets. (governance.aave.com)

Concrete price points you can use to budget

Per‑week, per‑team audits: $20,000/week is a public benchmark (Runtime Verification), with a quality floor of ~3 weeks/1,000 LOC. A 2,500 LOC DeFi core could reasonably scope to ~7–9 weeks ($140k–$180k) before re‑audits. (runtimeverification.com)
DAO‑disclosed retainers: OpenZeppelin’s 24‑week package ≈$554k (historical but still useful for rate anchoring); Certora’s 2025 Aave v4 scope at $2.39M shows what “dedicated team + FV + governance reviews” can cost for Tier‑1 protocols. (community.venus.io)
Traditional fixed‑fee ranges: Numerous providers cite simple tokens at mid‑four to low‑five figures, rising to six figures for complex DeFi, bridges, or multi‑chain systems. Treat “$5k–$15k” quotes for basic tokens as minimum viable coverage, not comprehensive multi‑round reviews. (blockchainappfactory.com)
Audit contests: Prize pools vary widely. You’ll find five‑figure invitational pools up to ecosystem‑funded mega‑contests (e.g., $2M Fusaka). Model the pool vs. your TVL and pre‑audit status. (code4rena.com)

Time is money: recent public audit timelines

ConsenSys Diligence: USDi review April 1–8, 2025 with 10 person‑days—useful for scoping small, well‑constrained code. (diligence.consensys.io)
OpenZeppelin examples: 1inch fee module (Apr 21–25, 2025) completed in a week; CapyFi (Jun 25–Jul 7, 2025) in about two weeks. These illustrate that short, focused reviews are doable when repos are prepared and scope is tight. (blog.openzeppelin.com)

Hidden and variable costs that catch teams off guard

Re‑audits and fix verification: Plan +10–30% on top of the base quote; many firms charge per re‑audit round, and multiple iterations are common. Some vendors cite re‑audit line items ($5k–$25k) depending on scope. (blockchainappfactory.com)
Rush premiums: A 20–50% surcharge for 7–10‑day turnarounds is normal when you’re up against a launch date or listing. (sanfranciscodaily360.com)
Internal engineering time: Auditors don’t fix issues—your team does. Remediation sprints and added testing time can exceed the audit invoice itself on complex protocols. (blockchainappfactory.com)
Continuous security and ops: Expect ongoing spend for monitoring/Defender, pausing automation, and incident response. OpenZeppelin’s Defender has paid tiers that many teams rely on post‑launch. (openzeppelin.com)
Bug bounty reserves: Immunefi recommends max critical rewards at 5–10% of funds‑at‑risk and suggests reserving 2–3× your max critical payout to handle multiple findings—budget this alongside audits. (immunefisupport.zendesk.com)

What drives price besides “lines of code”

Attack surface and economic design: Cross‑contract flows, external oracles, upgradeable proxies, and cross‑domain messaging (L2 bridges) multiply reviewers and test matrices.
Platform/language scarcity: Rust/Solana and Move ecosystems can carry a premium due to fewer auditors; teams report 10–20% uplifts vs. plain‑vanilla Solidity. (libpa.org)
Zero‑knowledge components: ZK circuits need circuit‑specific analysis (under‑constrained circuit bugs, witness non‑determinism). Specialized vendors now publish ZK tooling and services, and these reviews often price above standard Solidity audits. (veridise.com)

2025 tooling that materially reduces audit time (and cost)

Foundry v1.0 made invariant and fuzz testing faster and more actionable; engineering teams can arrive at audits with property suites that shrink triage time and improve coverage. (paradigm.xyz)
Echidna 2.2 introduced multi‑core fuzzing and on‑chain state fuzzing; it’s an auditor‑grade fuzzer you can run pre‑audit to burn down defect risk. (github.com)
Scribble enables on‑code property annotations that plugs directly into fuzzers and runtime assertions—auditors love arriving to well‑specified invariants. (diligence.consensys.io)
OpenZeppelin Defender’s audit/fix‑review workflow can keep the entire “issues → PRs → verification → finalization” trail clean, raising quality and lowering re‑audit friction. (docs.openzeppelin.com)

Emerging practice: bake invariants into CI

Use Foundry invariant tests and Scribble properties to gate PRs; bring coverage and property dashboards to scoping calls—your quotes and timelines will improve. (getfoundry.sh)

Practical budgeting templates (with real numbers)

Early‑stage token + vesting (Solidity, ~500 LOC)

Security objective: credible pre‑launch review + one fix cycle.
Model A (fixed‑fee boutique): $8k–$20k base + $3k–$10k re‑audit (total $11k–$30k). Add a small bounty ($10k critical cap) if funds‑at‑risk are modest. (blockchainappfactory.com)
Model B (per‑week shop with quality floor): If the vendor enforces 3 weeks minimum, budget ≈$60k; you’ll get deeper coverage and stronger reports—which can matter for listings. (runtimeverification.com)
Timeline: 1–3 weeks audit + 1 week fixes + 1 week re‑audit; add 20–40% if expedited. (sanfranciscodaily360.com)

Mid‑size DeFi primitive (Solidity, ~2,500 LOC, external oracle + upgradeable)

Model A (per‑week): 7–9 weeks total effort across 2 auditors → $140k–$180k. Reserve $20k–$40k for re‑audits/iterations; set a bug bounty with max critical tied to TVL (5–10%). (runtimeverification.com)
Model B (hybrid): Traditional audit ($80k–$140k) + invitational contest ($30k–$100k pool depending on maturity). Pros: diverse coverage; faster booking. (code4rena.com)
Timeline: 3–6 weeks audit + 1–3 weeks fixes + parallel contest (1–2 weeks) + final verification.

Enterprise bridge / L2 component (Solidity + cross‑domain infra; optional ZK)

Model A (continuous security): 6–12 months retainer with a top firm plus formal verification partner. Use Aave’s public budgets as yardsticks: $1.5M/yr continuous FV + separate scope‑specific packages. (governance.aave.com)
Model B (phased program):
- Phase 1 design review + threat model (2–3 weeks).
- Phase 2 audit round 1 (8–12 weeks).
- Phase 3 invitational contest (1–4 weeks; $100k–$500k pool depending on TVL).
- Phase 4 FV on critical invariants (rules + prover seats). Use historical $70k/week rule‑writing and ~$2k/seat/month for planning. (governance.aave.com)
Add a public bounty sized to TVL (5–10% of funds‑at‑risk max critical; set aside 2–3× critical cap in reserves). (immunefisupport.zendesk.com)

Timelines you can realistically plan for

Small, contained scopes: 1–2 weeks (examples above from OpenZeppelin and ConsenSys Diligence). (blog.openzeppelin.com)
Medium DeFi: 3–8 weeks including fix cycles.
Enterprise/bridges: 8–16 weeks for a full round, often with overlapping phases and continuous verification.
Contests: code‑ready projects can start within 48 hours and run for 1–4 weeks. (code4rena.dev)

Rush work is possible but costs more; 20–50% premiums are common for compressed schedules. (sanfranciscodaily360.com)

Contest vs. traditional audits: when each shines

Use a contest when:
- You need many independent eyes quickly, want transparent competitive pressure, and have bandwidth to triage multiple reports.
- You can refund the conditional prize pool if no High/Mediums are found (C4 model), protecting downside. (zellic.io)
Use a boutique/traditional audit when:
- You need deep architectural review, bespoke threat modeling, and hand‑in‑glove dev‑auditor collaboration; this is also where enterprise procurement and legal SLAs fit.
Use both for critical launches: A big 2025 trend is “audit + contest + bounty” with notable ecosystem sponsors putting seven figures behind contests for protocol upgrades. (blog.ethereum.org)

How to lower your total cost without lowering security

Lock scope to a commit hash and share a complete pre‑audit packet (system overview, risks list, setup steps, coverage report). ConsenSys Diligence’s checklist is still the gold standard. (diligence.consensys.io)
Arrive with properties: Foundry invariants + Scribble annotations make audits faster and crisper; auditors verify, not invent your invariants. (paradigm.xyz)
Fuzz before you buy: Run Echidna locally (multicore, on‑chain state support) and resolve crashes prior to scoping calls. (github.com)
Plan re‑audits up‑front: Pre‑negotiate two fix‑review rounds and timelines; it’s cheaper than ad‑hoc urgent requests. Expect +10–30% budget for these cycles. (blockchainappfactory.com)
Right‑size bounties: Use Immunefi’s 5–10% of funds‑at‑risk guideline and reserve 2–3× the max critical payout. Don’t run a bounty and an audit concurrently to avoid duplicate payouts. (immunefisupport.zendesk.com)

Red flags in proposals (and what to ask)

“Automated scan only.” Static scans miss business‑logic, economic, and cross‑chain issues; request manual review details and auditor bios.
“Unlimited re‑audits included.” Verify the fix‑review process, issue tracking, and turnaround SLAs (e.g., tools like Defender provide an auditable fix‑review trail). (docs.openzeppelin.com)
“We can start tomorrow” on a massive scope. Ask for capacity planning, named engineers, and how knowledge is retained across iterations.
No public reports or weak references. Ask for 2–3 recent public reports with dates and timelines (e.g., ConsenSys Diligence/USDi or OpenZeppelin/1inch, CapyFi). (diligence.consensys.io)

Example RFP (copy/paste and customize)

Objective and threat model (what you’re most worried about; funds‑at‑risk).
Repos + exact commit hashes; in‑scope files; dependency list (oracle, AMM, L2 bridges).
Build/run instructions; test coverage report; Foundry invariants; Scribble specs. (diligence.consensys.io)
Preferred model (fixed vs. weekly), re‑audit expectations, and target dates; whether you’ll run a contest or bounty after.
Reporting format, severity rubric, SLAs, and requested named engineers.

Budget snapshots you can defend to your board

Pre‑launch MVP (token + vesting): $15k–$35k all‑in (audit + re‑audit + small bounty). If rushing, add 20–40%. (blockchainappfactory.com)
DeFi v1 (AMM, lending module): $160k–$260k (traditional audit time & materials + fix cycles + invitational contest + tuned bounty). (runtimeverification.com)
Enterprise upgrade/bridge: $1.0M–$3.0M over 6–12 months (retainers + FV + contests + bounty reserves), consistent with recent DAO‑disclosed programs. (governance.aave.com)

Final word: audits are necessary—but not sufficient

Mix methods: design review, manual code audit, invariant/fuzz testing, contests, and right‑sized bounties—then keep security continuous via retainers for governance changes and incident response. The cost is meaningful, but so are the stakes: 2024 losses were measured in billions, and 2025’s first half has already outpaced it. Treat audit budgeting like insurance, and demand transparency on pricing, staffing, and re‑audit commitments. (reuters.com)

If you want a scoped, line‑item estimate for your codebase (LOC, external calls, upgrade paths, invariants coverage), 7Block Labs can deliver a model‑agnostic proposal with optional contest and bounty orchestration, plus a remediation playbook grounded in the practices above.