Smart-Contract Audits
Audit firms evaluated across their post-audit exploit record, accountability and reconstructability, method depth, and price transparency.
15providers tracked
6ranked (methodology v2026.11.1)
12 November 2026Ranking snapshot
3 November 2026oldest read · due 18 DecIndependent. Evidence-based.We rank with a published method and sourced evidence. No one can pay to rank.How it works
Set your country and amount to see your costs ·
Your setup
What your country changes
Pick a country to see which smart-contract audit firms serve it. Nothing is hidden — any that does not is listed with that reason.- 🇺🇸 United States
- 🇨🇦 Canada
- 🇲🇽 Mexico
- 🇬🇧 United Kingdom
- 🇩🇪 Germany
- 🇫🇷 France
- 🇮🇹 Italy
- 🇪🇸 Spain
- 🇳🇱 Netherlands
- 🇨🇭 Switzerland
- 🇸🇪 Sweden
- 🇳🇴 Norway
This affects provider availability.
Requirements (0)
Preferences (0)
Preferences re-weight Fit for you, which needs your country.
More filters
Funding & access
6 providers match your requirements
Out of 6 ranked providers. 0 excluded.
What this ranks
Ranked here: smart-contract audit firms engaged to review a protocol's code, compared on what later happened to code each firm signed off, method depth and price transparency.Not ranked here: analysis tools and audit-replacement software, databases that perform no reviews, auditor training, risk reviews that do not review code, and audit platforms that are closing.6 of the 15 assessed are ranked; 9 were turned away by name. Who, and whyRequirements narrow the list; they never change a published ChainChoice Score. How the ranking works
Certora
How Certora was chosen
Leads this ranking on Method depth for your stackFormal verification
81 / 100 out of 100published score, #1 of all 6 worldwide
Evidence
High
4/4 criteria scored, with 4 dated sources quoted.Method depthAccountability
Why it leads
- Certora is 9 points ahead of Sherlock, mainly because it scores higher on its method depth and its price transparency.
- Best in this ranking on method depth and price transparency
- Ahead of Sherlock on method depth (+7.5 points) and price transparency (+3.0 points)
Tradeoff
Post audit record: 2 points below the best in this ranking
Share
#ProviderPriceCompare
2
SH
Staffed audits and contests
72 / 100 out of 100
3
The most quantified find-rate disclosure
67 / 100 out of 100
4
The brand exceeds the published evidence
60 / 100 out of 100
5
Highest volume
53 / 100 out of 100
6
Elite researcher network
50 / 100 out of 100
Not confirmed (3) — not ranked until its source is read again; listed, not ruled out.
- Immunefi · Re-read pending, no primary record: Immunefi publishes findings, not what happened to code after review.
- Zellic · Re-read pending, no primary record: Zellic publishes no post-audit record or terms.
- Trail of Bits · Re-read pending, no primary record: Trail of Bits publishes no terms naming who it serves.
Compare providers (0)
See key differences in features, fees, security and more.
Price transparency
Price transparency
16% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Price transparency (0–10) | ChainChoice Score |
|---|---|---|
| Certora | 7 | 81 |
| Sherlock | 4 | 72 |
| Cyfrin / CodeHawks | 2 | 67 |
| OpenZeppelin | 2 | 60 |
| CertiK | 2 | 53 |
| Spearbit / Cantina | 2 | 50 |
Post audit record
Post-audit exploit record
32% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Post audit record (0–10) | ChainChoice Score |
|---|---|---|
| Sherlock | 5 | 72 |
| Cyfrin / CodeHawks | 4 | 67 |
| OpenZeppelin | 4 | 60 |
| Spearbit / Cantina | 4 | 50 |
| Certora | 3 | 81 |
| CertiK | 2 | 53 |
Method depth
Method depth for your stack
24% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Method depth (0–10) | ChainChoice Score |
|---|---|---|
| Certora | 10 | 81 |
| Cyfrin / CodeHawks | 7 | 67 |
| OpenZeppelin | 6 | 60 |
| Sherlock | 5 | 72 |
| CertiK | 5 | 53 |
| Spearbit / Cantina | 5 | 50 |
Accountability
Accountability & reconstructability
28% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Accountability (0–10) | ChainChoice Score |
|---|---|---|
| Certora | 8 | 81 |
| Sherlock | 8 | 72 |
| Cyfrin / CodeHawks | 7 | 67 |
| OpenZeppelin | 3 | 60 |
| CertiK | 3 | 53 |
| Spearbit / Cantina | 1 | 50 |
All 4 published criteria
Every ranked row’s score on each criterion, in the published order. Choose a column to order by it.
| Provider | ChainChoice Score | |||||
|---|---|---|---|---|---|---|
| 1 | Certora | 3 | 8 | 10 | 7 | 81 |
| 2 | Sherlock | 5 | 8 | 5 | 4 | 72 |
| 3 | Cyfrin / CodeHawks | 4 | 7 | 7 | 2 | 67 |
| 4 | OpenZeppelin | 4 | 3 | 6 | 2 | 60 |
| 5 | CertiK | 2 | 3 | 5 | 2 | 53 |
| 6 | Spearbit / Cantina | 4 | 1 | 5 | 2 | 50 |
How this ranking works
How firm the #1 is, the per-criterion arithmetic behind each score, who pays ChainChoice, and which smart-contract audits were assessed and left out.
FirmThis verdict holds under every one-point re-read
See the arithmetic
Every published criterion was moved up and down by one point and the ranking re-run. The same product came first each time. The published rankings file
Why this score4 published criteria · leads 3 of 4
Published criterionWtScore, and the best hereGap/10 out of 10Pts
Post-audit exploit record7.7−233.1
Accountability & reconstructability6.7·87.2
Method depth for your stack5.8·107.7
Price transparency3.8·73.6
Σ methodology points21.5/32
Each bar is the score on that criterion’s own 0–10 scale, never rescaled to the pool. The dark line is the best any product here reached on that axis. Wt is the most the criterion can add to the 86-point weighted total. Pts is weight × score × 32; the sum is the methodology score, and each weighted point behind the leader costs 2.6 on the displayed score. how these are weighted
Why it ranks first
Why Certora leads this category right now
Formal verification with a self-reported denominator — and self-incriminating post-mortems. Strongest on method depth for your stack (10/10): Certora builds and has open-sourced the Certora Prover, its own formal verification engine for Ethereum (EVM), Solana (sBPF) and Stellar (WASM), and publishes audit write-ups on Soroban, Solana and Canton code. Weakest on post-audit exploit record (3/10): Certora's own post says its verified properties for Balancer v2 Stable Pools did not detect the rounding error behind the November 2025 exploit of more than $100M, and its Silo incident report says the exploited vulnerability was not identified during its review. Published price: Only the entry tier carries a published price (certora.com/pricing, fetched 2026-11-03): Basic is "Free" with "Up to 2,000 min/month runtime" and "Write your own rules".
Best for
Method depth — 10/10
Main tradeoff
A proof only covers the properties SOMEONE WROTE — spec adequacy is your risk
Verify before signup
Only the entry tier carries a published price (certora.com/pricing, fetched 3 November 2026): Basic is "Free" with "Up to 2,000 min/month runtime" and "Write your own rules". Premium ("Unlimited Prover access", "Setup & onboarding support", "Up to 10 team members", "Specification review") and Enterprise ("Audit + formal verification retainer", "Our experts write rules for your code", "Incident response") are both "Contact Us", so the cost of an actual audit or formal-verification engagement is not published.
Recommendation summary
What should decide this category
Which language and execution environment is your codebase in, and does the firm have a bench for it?
Do you need a published report, or is a private review acceptable to your stakeholders?
How much of your deadline can absorb a formal-verification engagement rather than a review?
Quick picks
Strong options in this category
Start with the lead choice first, then use the shortlist only if you still need a challenger or stronger fit for a specific setup.
Best overall
Certora
Formal verification with a self-reported denominator — and self-incriminating post-mortems
Formal verification with a self-reported denominator — and self-incriminating post-mortems. Strongest on method depth for your stack (10/10): Certora builds and has open-sourced the Certora Prover, its own formal verification engine for Ethereum (EVM), Solana (sBPF) and Stellar (WASM), and publishes audit write-ups on Soroban, Solana and Canton code. Weakest on post-audit exploit record (3/10): Certora's own post says its verified properties for Balancer v2 Stable Pools did not detect the rounding error behind the November 2025 exploit of more than $100M, and its Silo incident report says the exploited vulnerability was not identified during its review. Published price: Only the entry tier carries a published price (certora.com/pricing, fetched 2026-11-03): Basic is "Free" with "Up to 2,000 min/month runtime" and "Write your own rules".
Best for: Method depth — 10/10
Post-audit exploit record · weight 32%3/10Accountability & reconstructability · weight 28%8/10Method depth for your stack · weight 24%10/10Price transparency · weight 16%7/10
Quick pick
SH
Sherlock
Staffed audits and contests with optional Shield coverage — capped at $500,000
Staffed audits and contests with optional Shield coverage — capped at $500,000. Strongest on accountability & reconstructability (8/10). Weakest on price transparency (4/10): Sherlock publishes no rate card, but states that a slot is reserved with a 25% deposit, that about 80% of fees go to researchers, and how review length scales with codebase size (about 3 days at 500 nSLOC to about 38 days at 6,000 nSLOC). Published price: No rate card for audits (Sherlock docs and sherlock.xyz, fetched 2026-11-03): scheduling follows "an initial assessment and a preliminary quote", a slot is reserved "with a 25% deposit", and Sherlock states that "In many engagements, ~80% of fees go directly…
Best for: Accountability — 8/10
Post-audit exploit record · weight 32%5/10Accountability & reconstructability · weight 28%8/10Method depth for your stack · weight 24%5/10Price transparency · weight 16%4/10
Quick pick
Cyfrin / CodeHawks
The most quantified find-rate disclosure — and the youngest track record
The most quantified find-rate disclosure — and the youngest track record. Strongest on accountability & reconstructability (7/10): Cyfrin's public reports name lead and assisting auditors and pin scope to a commit (Bunni v2.1 at 344ec22); Cyfrin's blog carries no disclosure of the later Bunni exploit of code in that scope. Weakest on price transparency (2/10): Cyfrin publishes no rate, minimum or effort unit; every audit routes to 'Book a consultation', where its engineers estimate the timeline after reviewing codebase size and complexity. Published price: No public pricing: Cyfrin's audits page (cyfrin.io/services/audits, fetched 2026-11-03) routes every engagement to "Book a consultation" and describes the first step as "Our engineers will review the codebase complexity and size, estimate the timeline, and…
Best for: Accountability — 7/10
Post-audit exploit record · weight 32%4/10Accountability & reconstructability · weight 28%7/10Method depth for your stack · weight 24%7/10Price transparency · weight 16%2/10
Quick pick
OpenZeppelin
The brand exceeds the published evidence — and the circulating TVL figure is double
The brand exceeds the published evidence — and the circulating TVL figure is double. Strongest on method depth for your stack (6/10): OpenZeppelin reviews Solidity, Cairo, Rust and Go code and applies fuzzing and invariant testing when necessary; its audit page offers no formal verification service. Weakest on price transparency (2/10): OpenZeppelin publishes no price, rate or effort unit; every service routes to 'Request a Security Audit'. It does publish a minimum team (two or more researchers plus a technical and a project manager) and each report's calendar window. Published price: No published pricing (openzeppelin.com/security-audits, fetched 2026-11-03): every service routes to "Request a Security Audit", with no day rates, minimums or effort units.
Best for: Method depth — 6/10
Post-audit exploit record · weight 32%4/10Accountability & reconstructability · weight 28%3/10Method depth for your stack · weight 24%6/10Price transparency · weight 16%2/10
Considered and not ranked
9 products we looked at and left out
A shortlist is only honest if it says who it turned away. Each of these was assessed against the same published criteria as the ranked table and excluded for a stated reason — not overlooked.
We assessed 15 products here and rank 6 — 40% of what we looked at. That share is of the products we assessed, not of the category: how many exist is not something we can count, so we do not claim a number for it.
Immunefi· Re-read, no recordZellic· Re-read, no recordTrail of Bits· Re-read, no recordCode4renaSlither· Ranked elsewhereSolodit· Ranked elsewhereOlympixSecureumGauntlet
What this ranking does not assess
- Liveness failure: the operator stops, censors you or loses data.
- Exit failure: you cannot get out at par, on time, or with what is yours.
These can still cost you money here; the ranking does not measure them, so a high place says nothing about them. Which criterion scores each family, and why the others do not apply, is in /data/risk-coverage.json.
How this ranking is built
Reviewed on the post-audit exploit record, accountability and reconstructability, method depth for your stack, and price transparency. Brand and “TVL secured” are never scored.
Data checked Nov 2026 · Independent rankings · We show our work
How this page is reviewed
Reviewed means every product ranked on this page was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
Accountable for this review: Mathias Siemonsmeier, Founder.
How we review · Review calendar · Corrections log · How we make money
Direct answer
What is the best smart-contract audit firm in 2026?
Certora ranks #1 overall for smart-contract audits on ChainChoice. Formal verification with a self-reported denominator — and self-incriminating post-mortems. It holds that rank under an affiliate-blind methodology scored across 4 published, weighted criteria — the code that ranks providers physically cannot read affiliate payouts (CI-enforced), so a payout can't move a rank. The verdict re-computes on every fee change, incident, or regulatory action; the full reasoning and the audit receipt are under Methodology.
How you can lose money here, and what the ranking scores
- Contract failure: the code holding the funds is exploited.Scored by Post-audit exploit record · 32% (Certora 3/10, Sherlock 5/10, Cyfrin / CodeHawks 4/10)
- Information failure: the number is wrong or bought, or your data leaks.Scored by Accountability & reconstructability · 28% (Certora 8/10, Sherlock 8/10, Cyfrin / CodeHawks 7/10)
Not assessed by this ranking: Liveness failure, Exit failure. A high place says nothing about these; the Methodology tab says what each means.
Also scored, as cost, quality or a summary of several families: Method depth for your stack (24%), Price transparency (16%).
FAQs
3 questions readers ask before choosing smart-contract audits.
Frequently asked
Questions people ask before choosing smart-contract audits
Does a passed audit mean the code is safe?
No. An audit is a time-boxed review of a specific commit, not a guarantee, and every major firm in this pool has had reviewed code exploited afterwards. What separates them is whether they disclose it — a firm that publishes its own misses is easier to trust than one that publishes none.
Why is price the lightest criterion?
Because almost every firm here is quote-only, so there is no comparable price to rank. What is scorable is disclosure: whether a buyer can form any cost expectation before entering a sales process.
What matters most when picking an audit firm?
The post-audit exploit record and whether the engagement is reconstructable — together 60% of the weight. Method depth for your specific stack follows, and price transparency is scored on disclosure rather than level.
Free advisor·No signup needed
Still unsure? Get your best smart-contract audits pick
Answer a few quick questions and get one clear recommendation based on how you actually plan to use crypto — then review the evidence before deciding.
No signup·Free first pass · Private·No spam · No account
Not financial advice · Independent · Always do your own research
Best picks
Best smart-contract audits in 2026
The right audit firm depends on your stack, your deadline, and how much assurance you actually need — but the decisive input is the firm's record on code it has already reviewed. Brand, client logo walls and self-reported 'TVL secured' are not scored here, because a self-reported metric without a denominator is marketing. What is scored is what happened after the review, and whether the engagement can be reconstructed from a published report and a commit-pinned scope.
Best overall
Certora
Formal verification with a self-reported denominator — and self-incriminating post-mortems
Data checked Nov 2026
Formal verification with a self-reported denominator — and self-incriminating post-mortems. Strongest on method depth for your stack (10/10): Certora builds and has open-sourced the Certora Prover, its own formal verification engine for Ethereum (EVM), Solana (sBPF) and Stellar (WASM), and publishes audit write-ups on Soroban, Solana and Canton code. Weakest on post-audit exploit record (3/10): Certora's own post says its verified properties for Balancer v2 Stable Pools did not detect the rounding error behind the November 2025 exploit of more than $100M, and its Silo incident report says the exploited vulnerability was not identified during its review. Published price: Only the entry tier carries a published price (certora.com/pricing, fetched 2026-11-03): Basic is "Free" with "Up to 2,000 min/month runtime" and "Write your own rules".
Best for: Method depth — 10/10
Browse this network
MS
Written and reviewed by Mathias Siemonsmeier, Founder
Not financial advice · For informational purposes only · Always do your own research