What is a smart contract audit, and what it cannot catch

A smart contract audit is a paid review of a crypto project's code, done by outside security experts who hunt for bugs before the code goes live. They read it line by line and run software that probes for known weak spots. A solid audit lowers the chance of a hack. It does not remove it.

That gap is the whole story here. The word "audited" gets treated like a safety stamp, and it is not one. Blockchain analytics firm Chainalysis counted $2.2 billion stolen in crypto hacks across 303 incidents in 2024, in research published on 19 December 2024. Many of the projects that lost money had been reviewed by respected firms first.

What an audit actually does

Think of an audit as a building inspection before you buy a house. An inspector checks the wiring, the plumbing and the foundation, then writes up what they found. An auditor does the same with code.

An audit runs in a few stages. First, the firm reads the project's documents and runs its test suite. Then automated tools scan for known bug patterns. OpenZeppelin, one of the older audit firms, says its Code Inspector catches more than 60 percent of low severity issues on this first pass. After that, humans take over. OpenZeppelin says every line of code is read by at least two security researchers, who push the code into odd states with fuzzing and other tests. The firm writes a report, the project fixes what it can, and the auditors check the fixes.

What an audit does not cover

Every audit is a snapshot. It covers the exact code handed over, on the day it was reviewed. Change the code next week and the report no longer describes what is running.

Scope is the second limit. Auditors check the contract. They do not hold the project's private keys, run its servers or manage its staff. A clean report also says little about economic attacks, where the code works as written but someone games the market around it, such as manipulating an oracle price feed to borrow more than a position should allow.

Many contracts can be changed after launch through an upgrade or a governance vote. That is useful, and it is also a door. If the keys that control upgrades are weak, or a governance vote can be bought, an attacker can alter a contract the auditors signed off on. The report described the old version. The live code can be something else.

Budget sets a third limit. A project pays for a set number of reviewer days, so a bigger codebase gets less attention per line. Rushed reviews before a launch deadline are common. A team that finds nothing in the hours it paid for has not proved the code is clean. It has proved only that no one found a bug in the time bought.

Then there is the honest admission from the auditors themselves. Nethermind, a firm that both builds and audits blockchain software, put it plainly in a May 2024 analysis: a review "does not mean that if the codebase was audited, it is bug-free." Audits shrink the risk. They cannot promise a clean bill of health, because no one can read every path through complex code and be sure.

What the Euler hack showed

Euler Finance was not a weekend project. The lending protocol had passed 10 audits from six firms between May 2021 and September 2022, among them Halborn, Certora and Sherlock. Michael Bentley, the chief executive of Euler Labs, called it a security-minded project.

On 13 March 2023, an attacker drained close to $197 million in a single flash loan attack. Audited. Then drained. The flaw sat in a new function, added after some of those reviews, that failed to run a basic health check on a user's position. Sherlock, which had looked at that upgrade, missed the bug and later paid a $4.5 million claim. Most of the money was returned in the weeks after, but the point held. A stack of clean reports did not stop the loss.

Why most stolen crypto never touches the code

A bigger point hides in the Chainalysis data. The single largest cause of theft in 2024 was not a clever contract exploit. It was stolen keys. Private key compromises accounted for 43.8 percent of all crypto taken that year, more than any other method, and North Korean groups alone took about $1.34 billion across 47 incidents.

Stolen keys have nothing to do with the quality of the code. If an attacker gets the keys that control a contract or an exchange wallet, the code can be flawless and the money still leaves. The same risk follows the bridges that move assets between chains, which attackers keep draining through a mix of code bugs and compromised access. An audit of the contract cannot fix a weak password, a phished employee or a sloppy server.

How to read an audit as a user

You do not need to read code to use an audit well. Start with the date. An old report on a project that ships new features every month is close to worthless. Check who did it. A named firm with a public track record carries more weight than a logo you cannot verify.

Read the scope section, not the summary alone. It tells you which contracts were covered and which were left out. Look at how the project handled the findings, because a good report lists real problems and shows they were fixed. A report with zero findings can be a warning sign rather than a gold star. And keep in mind what no report can see: the keys, the team, the servers and the market around the contract. For your own money, plain habits still matter more, such as revoking old token approvals and holding your own keys.

What to watch

Audits are getting more standard, and that helps. More projects now publish reports, run bug bounties and pay for monitoring that watches contracts in real time after launch. Regulators in the European Union and elsewhere have started to ask what security checks token issuers run. None of that turns an audit into a guarantee.

The honest way to read the word "audited" is as one data point, not a verdict. It means a team cared enough to pay for expert eyes on its code. It does not mean the code is safe, that the keys are safe, or that next month's update will be safe. Treat it as a floor, not a seal.