Smart Contract Audit Price vs Solidity Audit Price vs Smart Contract Audit Pricing: Full Cost Range Guide

Security buyers keep asking: What is a realistic 2026 price for a “smart contract audit” versus a “Solidity audit,” and how do the pricing models actually work? This guide compiles public, verifiable datapoints from top security vendors and DAOs so you can budget precisely, negotiate confidently, and sequence audits for maximum risk reduction per dollar.

Description: A procurement-grade, number‑driven guide to smart contract audit pricing in 2026, comparing Solidity vs multi‑stack audits, fixed‑fee vs per‑week vs contest vs retainer models, with real public price points, timelines, and sample budgets you can copy.

TL;DR: Today’s real price anchors

Public, top-tier weekly rates: $20,000 per auditor-week with a quality floor of ~3 weeks per 1,000 LOC (Runtime Verification). That implies ≈$60k per 1k LOC baseline for thorough reviews. (runtimeverification.com)
DAO-disclosed retainers: OpenZeppelin’s Venus retainer priced 24 auditor-weeks at $554,400 over six months (≈$23.1k/week). (community.venus.io)
Formal verification at scale: Certora’s 12‑month Aave v4 security program priced at $2.39M for a dedicated 4.5‑FTE team (≈$780k/FTE/yr). (governance.aave.com)
Researcher networks: Spearbit’s Arbitrum proposal benchmarks a blended team at ≈$48k per week (lead + seniors + associates + junior). (forum.arbitrum.foundation)
Competitive audits (contests): Code4rena prize pools range from ~$20k–$200k+, e.g., Size ($200k, 22 days) and GTE Perps ($103,250, 28 days). (code4rena.com)
Audit-linked exploit cover: Sherlock indicates premiums around 2.0% (public contest) to 2.5% (private) of covered amount (up to $10M). (opencover.com)
Why this matters: 2024 crypto hacks were estimated at ~$2.2B–$2.36B by Chainalysis/CertiK—security budgets are justified at board level. (chainalysis.com)

“Smart contract audit” vs “Solidity audit”: what you’re buying

Solidity audit price: Typically refers to EVM-only (Solidity) code. Larger, competitive market = more stable rates and easier scheduling for ERC‑20/721/4626 and common DeFi primitives.
Smart contract audit price: Broader scope including Solidity, Cairo (Starknet), Rust (Solana), Move (Aptos/Sui), Cosmos SDK, Substrate, and cross‑chain components. Premiums may apply for stacks with scarcer auditors (e.g., Rust/Solana or ZK circuits), or for systems with external dependencies (bridges, oracles, custom cryptography). (7blocklabs.com)

Key implication: Similar LOC can price differently across stacks. EVM has the densest supply of auditors; Rust/Move/ZK often command more senior time and a higher weekly blend.

The four dominant pricing models (and when to use each)

1) Fixed‑fee per scope

Best when: Code is frozen, scope is clear, and you want a predictable invoice.
Typical envelope (public vendor ranges and market guides): ~$8k–$30k for simple tokens; $40k–$100k for mid‑complexity DeFi; $100k–$200k+ for multi‑contract protocols/bridges. Fix reviews and re‑audits may be priced separately. (blockchainappfactory.com)
Watch‑outs: “Starting from $5k” offers rarely include re‑audits or deeper manual analysis—budget 10–30% extra for remediation cycles. (blockchainappfactory.com)

2) Per auditor‑week (time & materials)

Best when: You need named seniors, iterative collaboration, and flexibility as code evolves.
Real datapoints:
- Runtime Verification: $20k/week, with a quality floor of ≈3 weeks per 1,000 LOC. (runtimeverification.com)
- Top-tier retainers: OpenZeppelin’s Venus retainer prices to ≈$23.1k per auditor-week. (community.venus.io)
- Researcher networks: Spearbit’s blended weekly ≈$48k for a 4–5 person team. (forum.arbitrum.foundation)

3) Contest‑based (pay for verified findings)

Best when: You want breadth and adversarial creativity, often after a structured audit.
Public budgets: $20k–$200k+ are common; examples include Size at $200k (22 days) and GTE Perps at $103,250 (28 days). (code4rena.com)
Mechanics detail: Code4rena’s contests publish detailed distributions, often with “conditional” pools emphasizing High/Medium findings; Zellic states a 96% conditional pool refunded if no actionable H/M issues. (github.com)

4) Retainers and continuous assurance

Best when: You ship frequently, manage high TVL, or run multiple codebases across chains.
Public benchmarks:
- OpenZeppelin × Venus: $554,400 for 24 weeks over six months. (community.venus.io)
- Certora × Aave v4: $2.39M/year for a 4.5‑FTE dedicated team focused on formal verification and governance reviews. (governance.aave.com)

What actually moves your quote (and how to control it)

Code freeze discipline: Vendors commonly require a frozen commit; mid‑audit changes force re‑scoping and delays. (diligence.consensys.io)
LOC vs nSLOC: For contests/coverage, nSLOC guides time budgets (e.g., Sherlock’s ~12 days around 2,000 nSLOC), so clean, deduped code helps. (docs.sherlock.xyz)
Language/ecosystem: EVM is price‑efficient; Rust/Move/ZK often carry premiums due to scarcity. (7blocklabs.com)
Timeline pressure: Expect 20–40% expedite fees among boutiques. (coredevsltd.com)
Re‑audit cycles: Plan 10–30% uplift for fix reviews and iterations unless explicitly included. (costbrief.org)
Coverage and bounties: Audit‑linked cover (e.g., Sherlock 2.0–2.5% of covered amount) and public bounties (max critical typically 5–10% of funds at risk) affect total cost of assurance. (opencover.com)

Concrete price ranges you can take to a CFO

Basic ERC‑20/721 or vault module (frozen): $8k–$30k for a fixed‑fee engagement; or 3 weeks via a weekly‑rate shop ≈$60k, with stronger reports and more senior time. (blockchainappfactory.com)
Mid‑size DeFi primitive (~2,500 LOC, oracles, upgradeable): 7–9 auditor‑weeks total effort → $140k–$180k at $20k/week; reserve $20k–$40k for re‑audits and hardening. (runtimeverification.com)
Contest add‑on for breadth: $30k–$150k pool depending on maturity and TVL; flagship contests can reach $200k+. (code4rena.com)
Continuous program (DAO/L2): Retainer + formal verification often sits in the mid‑six to low‑seven figures annually for named teams and governance reviews. (governance.aave.com)

Solidity vs Rust/Move audits: where pricing diverges

EVM/Solidity: Deep auditor supply and well‑trodden libraries (OpenZeppelin) keep price dispersion tighter; week‑rate and contest models are highly liquid.
Solana/Rust or Move: Fewer specialists; more teams price by named senior weeks or researcher blends. You’ll often see Rust engagements skew toward per‑week and private/invitational reviews, with contest options increasingly available but still less common than on EVM. Public vendor ranges for Solana often start in the mid‑four to low‑five figures for simple programs and rise quickly with multi‑program complexity. (blockapex.io)

Tip: If you must launch on a scarcer stack, book earlier and pre‑commit to a phased plan (design review → audit round 1 → mitigation audit → invitational contest). That sequencing reduces calendar risk and smooths costs.

Timelines and scheduling realities

Structured audit time: Expect 1–4 weeks of focused review plus time for fixes and re‑audit, with schedule booked weeks in advance for reputable firms. (medium.com)
“Quality floors”: Some vendors publish duration floors (e.g., ≈3 weeks per 1,000 LOC) to protect coverage quality and report depth. (runtimeverification.com)
Contests: 7–28 days are common windows; budgets scale with depth and scope. See the 22‑day, $200k Size contest and 28‑day, $103,250 GTE Perps contest for planning benchmarks. (code4rena.com)

Design your program: four practical, copy‑paste scenarios

Scenario A — Pre‑launch token + staking (Solidity, ~600 LOC; central treasury; KYC listings planned)

Objectives: Credible report, fast turnaround, one re‑audit, plus modest public signal.
Pricing plan:
- Fixed‑fee boutique: $12k–$20k base + $3k–$7k re‑audit.
- Or per‑week: 3 weeks minimum at $20k/week = $60k for deeper coverage and tighter report SLAs. (blockchainappfactory.com)
- Optional: Micro contest ($20k–$35k) to stress the changes after fix review. (code4rena.com)
Add‑ons: Public bug bounty with max critical capped at $50k–$100k or 5–10% of funds at risk (size to your treasury). (immunefisupport.zendesk.com)
Timeline: 2–3 weeks audit → 1 week fixes → 1 week re‑audit; add 1–2 weeks for an invitational contest.

Scenario B — Lending primitive (Solidity, ~2,500 LOC; oracles + upgradeable; aim TVL $25–50M)

Objectives: Depth + breadth; partner listings demand tier‑1 signals.
Pricing plan:
- Per‑week audit: 7–9 weeks total across 2 auditors → $140k–$180k baseline; reserve $20k–$40k for re‑audits. (runtimeverification.com)
- Contest: $75k–$150k (public) or private invitational to crowd‑stress invariants after fixes. (code4rena.com)
- Coverage: $5M–$10M for first 90–180 days at ≈2.0%–2.5% annualized premium for audit‑linked cover. (opencover.com)
Timeline: 4–6 weeks audit + 1–2 weeks fixes + 1–3 weeks re‑audit; run contest parallel or immediately post‑fix.

Scenario C — Solana DEX module (Rust, ~1,800 nSLOC; multiple programs; custom math)

Objectives: Named seniors with Solana experience; deterministic schedule.
Pricing plan:
- Named per‑week team: Plan 4–6 auditor‑weeks (2–3 calendar weeks) to hit depth targets; expect a premium for Rust specialists vs Solidity.
- Follow with a short invitational contest if available; budget $25k–$75k depending on scope and maturity.
- Public ranges for Solana boutiques cite ~$5k–$20k for simple programs; multi‑program DEX modules trend materially higher due to complexity. (blockapex.io)
Timeline: 2–3 weeks audit → fix review 3–7 days → optional contest 7–14 days.

Scenario D — Cross‑chain bridge or L2 component (Solidity + off‑chain agents + governance; optional ZK)

Objectives: Institutional listings, strong governance hygiene, formal guarantees for critical invariants.
Pricing plan (12 months):
- Retainer with named researchers for continuous reviews (reference: OpenZeppelin ≈$23k/auditor‑week in public DAO deal), and a dedicated formal‑verification partner sized similarly to Certora’s $2.39M/yr Aave v4 package (4.5 FTE). (community.venus.io)
- Budget 1–2 large contests ($150k–$500k each) on milestone releases to attract diverse adversaries. (code4rena.com)
- Run a public bug bounty sized at 5–10% max critical vs funds‑at‑risk; maintain at least 2–3× the max critical payout in reserves. (immunefisupport.zendesk.com)
Timeline: Quarterly sprints with design reviews, audit rounds, and mitigation cycles; governance and incident‑response on retainer.

Hidden line items founders miss (but your CFO won’t)

Re‑audits and mitigation reviews: Unless bundled, add 10–30% to base cost. (costbrief.org)
Expedite/rush fees: 20–40% uplifts if you need a sub‑two‑week start. (coredevsltd.com)
Internal engineering time: Triage, fixes, property tests, and invariant writing can rival external spend—plan capacity.
Contest judging/triage: Even with “zero platform fee,” judging and validator costs are billed; Zellic explains their conditional pool + judge fee separation. (zellic.io)
Governance, listings, and re‑reporting: Exchanges/integrators may ask for follow‑up reports after major changes; keep credits or weeks in your retainer. (community.venus.io)

Best‑in‑class procurement tactics in 2026

Ask for named team composition and weekly cadence. Compare $/week by seniority, not just total fee. Benchmark against $20k/week per auditor and ~$48k/week blended researcher teams. (runtimeverification.com)
Enforce a code freeze and scope lock two weeks before start; agree on re‑audit windows and pricing before kickoff. (openzeppelin.com)
Sequence depth then breadth: Structured per‑week audit → fix → invitational/public contest with a conditional pool → re‑audit on deltas. Use contest budgets like $100k–$200k for flagship releases. (code4rena.com)
Tie bounties to TVL: Adopt 5–10% of funds‑at‑risk as a max critical bounty with reserves 2–3× that amount. (immunefisupport.zendesk.com)
Consider audit‑linked cover: Sherlock offers protocol cover pricing bands (≈2.0–2.5%) up to $10M—use this to OPEX‑bound tail risk during ramp. (opencover.com)
For formal guarantees, buy results not hours: Scope properties/invariants and acceptance criteria with your FV partner; use public FTE‑rate disclosures (e.g., Certora) to sanity‑check quotes. (governance.aave.com)

How to compare proposals apples‑to‑apples

Create a one‑page internal “shadow price” sheet for each vendor:

$/auditor‑week by seniority and minimum weeks required. (runtimeverification.com)
Included rounds: initial review, fix review, number of re‑audits, and SLA for turnaround.
Deliverables: report depth, PoCs, property tests, threat model, and executive summary.
Contest plan: target pool, conditionality, judging, and mitigation review. (zellic.io)
Post‑launch: coverage premiums, detection & response, emergency hotlines. (opencover.com)

RFP essentials security vendors actually appreciate

Frozen commit hash and changelog; architecture diagrams; invariants you care about; external dependencies (bridges, oracles); upgradeability and pause logic; admin keys / multisig policies; deployment plan; and intended TVL at each phase. (diligence.consensys.io)
Test harness and fuzzing config; gas limits and bytecode size constraints; known debt and TODOs.
Remediation bandwidth dates within a 1–2 week window post‑audit for fastest re‑review. (medium.com)

Costed, end‑to‑end examples (with realistic numbers)

Token + staking on EVM (launch in 6 weeks)

Week 0: Freeze code; ship RFP with ready test suite.
Weeks 1–2: 2‑week audit (per‑week model) at $20k/week × 2 auditors → $80k. (runtimeverification.com)
Week 3: Fixes (internal).
Week 4: Re‑audit (included or +$8k–$15k depending on terms). (costbrief.org)
Week 5–6: Invitational contest, $25k–$35k conditional pool, 7 days. (code4rena.com)
Post‑launch: Bug bounty with max critical $50k or 5–10% of funds at risk, whichever lower. (immunefisupport.zendesk.com)
Total cash: ~$105k–$130k, plus internal eng time.

Lending primitive (2,500 LOC, target $50M TVL)

Weeks 0–1: Threat modeling + scoped invariants.
Weeks 2–6: 5 weeks audit time across named seniors: ~$200k–$240k if using a blended team; or $140k–$180k via $20k/week per auditor. (forum.arbitrum.foundation)
Weeks 7–8: Fixes + re‑audit $20k–$40k. (costbrief.org)
Week 9–11: Public contest $100k–$150k, 14–21 days. (code4rena.com)
Coverage: $10M for 6 months at ~2.0–2.5% annualized → pro‑rated ~$100k–$125k. (opencover.com)
Total year‑one security spend: ~$360k–$495k.

Solana AMM module (1,800 nSLOC)

Weeks 0–1: Design review; freeze.
Weeks 2–4: 3–4 auditor‑weeks (Rust specialists) → expect a premium vs Solidity; many boutiques publish $5k–$20k for simple programs, but AMM math and multi‑program scaffolding drive higher totals. (blockapex.io)
Week 5: Mitigation review.
Optional: 7–14 day invitational contest $25k–$75k if platform supports it.
Total: ~$80k–$150k depending on seniority blend and contest appetite.

Cross‑chain bridge/L2 component (12‑month program)

Retainer: 24–36 auditor‑weeks with a named tier‑1 (budget using ≈$23k/auditor‑week datapoint). (community.venus.io)
FV partner: Dedicated 3–5 FTE for invariants and governance checks—use $2.39M/yr (4.5 FTE) public benchmark to right‑size. (governance.aave.com)
Two flagship contests: $150k–$500k pools each on major releases. (code4rena.com)
Bug bounty: 5–10% max‑critical vs funds‑at‑risk; maintain 2–3× reserves. (immunefisupport.zendesk.com)
Year‑one envelope: Low‑seven figures, justified by catastrophic risk reduction and third‑party listing requirements.

Why the market pays these numbers

Despite better practices, losses remain material. Chainalysis and CertiK estimate 2024 crypto theft on the order of $2.2B–$2.36B, with major incidents clustered around key infrastructure and centralized key compromises. The cost of credible assurance is a rounding error compared to reputational and TVL drawdowns from an exploit. (chainalysis.com)

Quick budgeting checklist (copy/paste)

Choose model(s): fixed fee for simple modules; weekly for complex/evolving code; contest for breadth; retainer + FV for enterprise. (runtimeverification.com)
Lock scope and freeze code by a dated commit. (diligence.consensys.io)
Reserve 10–30% for re‑audits/mitigations; 20–40% for expedite if needed. (costbrief.org)
Size contest pools to risk ($30k–$200k+) and set conditionality to pay primarily for actionable H/M findings. (code4rena.com)
Stand up a bounty (5–10% max‑critical) and/or audit‑linked cover (≈2.0–2.5% premium up to $10M). (immunefisupport.zendesk.com)

Bottom line: price is a function of depth, diversity, and discipline

Depth comes from named, senior auditors with enough weeks to reason about invariants and integrations. Weekly rates and quality floors exist for a reason. (runtimeverification.com)
Diversity comes from contests and bounties that mobilize hundreds of perspectives—time‑boxed and cost‑bounded. (code4rena.com)
Discipline comes from code freeze, documentation, and fix velocity—these keep costs predictable and compress timelines. (diligence.consensys.io)

If you budget from the public anchors above, you won’t be surprised by quotes—and you’ll buy the right mix of assurance for your stage, stack, and risk tolerance.