Be confident in your smart contracts

Will an audit find all vulnerabilities?

During our audits, we employ several measures to maximize the likelihood of finding critical issues in the codebase and provide as much security as possible. Despite these efforts, there is always a possibility that we miss issues. Security audits should only be considered one component of your overall security strategy. A security review is no substitute for other best practices and should be accompanied by a security-focused design process, extensive unit, integration and end-to-end testing, internal code reviews, bug bounties, secure development processes, as well as strictly followed operational security processes.

Whilst we would like to promise you a 100% hit rate, we believe no security company can make this claim.

How much does an audit cost?

It depends – we estimate the cost of each audit individually and provide a quote based on a number of factors, including the amount of code, complexity, remaining risk, and the cost of the specialized team required for the specific project. Contact us here to request a quote, we will get back to you within one business day.

How is Solidified different from other firms?

Solidified uses a unique process. We assign at least three auditors to each project. Our standard process includes initial static code analysis and manual code review. Each auditor will add their own methodology to this, which may include writing tests for edge cases we feel are not covered by the included tests, economic modeling, if appropriate, and fuzz testing for parts of the system that are susceptible to different behavior under a large number of parameter combinations.

We specifically assign auditors with skill sets in mind, depending on a project's nature. For instance, a DeFi protocol with an economic model will have an auditor with a strong background in economics, and a ZK-rollup processor will have a cryptographer on the team.

Auditors work independently during the first phase of the audit, initially not sharing their results, in order to not bias each other. After this initial phase, the auditors will join their findings in a consensus meeting and produce a report which lists any issues encountered together with recommendations. The final version of our report is transparently published to our GitHub repository (https://github.com/solidified-platform/audits). 

How long does an audit take?

The timeline for each audit depends on the complexity of the project and will be provided with our initial quote on a case-by-case basis. Audits may take anything from 1 week for simple projects to 12 weeks for very complex projects.

In addition to the duration of the audit itself, you should account for time to apply our recommendations. The verification of fixes for the issues is included in our audits. Our auditors remain available for three weeks after the initial report has been delivered for this process.

When should I request a quote?

We recommend reaching out as early as possible to avoid delays in case of longer lead times. We do not require a codebase that is ready for the audit when we create a quote.

As long as we receive a work-progress version together with a description of the functionality to be added, we can create an estimate of the effort and budget required. We also offer clients who do not have a finalized codebase blanket reservations that will be refined closer to the audit start date.