Audit firms evaluated across their post-audit exploit record, accountability and reconstructability, method depth, and price transparency.
Ranked here: smart-contract audit firms engaged to review a protocol's code, compared on what later happened to code each firm signed off, method depth and price transparency. Not ranked here: analysis tools and audit-replacement software, databases that perform no reviews, auditor training, risk reviews that do not review code, and audit platforms that are closing.
#1 of 6 · published ranking
Certora
81ChainChoice Score
4199
Why it leads
Certora scores higher than everything else in this ranking on its method depth and its price transparency.
Show the arithmetic
Best in this ranking on method depth and price transparency
Cost
Not priced· No comparable price is published
ReviewedNext review by Published Methodology v2026.11.1
How this page is reviewed
Reviewed means every product ranked on this page was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
No provider can pay for a position in this table. The code that computes this order cannot read which links carry a referral code, and every build proves it. Every score below rebuilds from the published criteria.Ranking v2026.11.1 · 4 criteria · 6 products · same inputs, same order
How we review · 6 ranked of 15 assessed · 4 criteria · 0 sponsor weight
How we review
6ranked
15assessed
4criteria
0sponsor weight
Recommendation first, comparison only if needed.
Reviewed and rechecked on the current cycle.
Commercial relationships disclosed before clickout.
Personal comparison
Smart-Contract Audits ranked comparison
No comparable price is published; ranking still uses verified product evidence.
RankProviderBest fitScore
1
CertoraFormal verification with a self-reporte...Top ranked
Method depth — 10/10Trade-off: A proof only covers the properties SOMEONE WROTE — spec adequacy is your risk
81score
Check availability for your country
Certora · certora.com. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
2
SHSherlockStaffed audits and contests with option...
Accountability — 8/10Trade-off: Shield maximum is $500,000 — NOT the $2M circulating in secondary sources
72score
Check availability for your country
Sherlock · sherlock.xyz. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
3
Cyfrin / CodeHawksThe most quantified find-rate disclosur...
Accountability — 7/10Trade-off: Founded 2023 — no full market cycle of evidence
67score
Check availability for your country
Cyfrin / CodeHawks · cyfrin.io. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
4
OpenZeppelinThe brand exceeds the published evidenc...
Method depth — 6/10Trade-off: Brand strength substantially exceeds published evidence
60score
Check availability for your country
OpenZeppelin · openzeppelin.com. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
5
CertiKHighest volume, weakest badge-to-safety...
Method depth — 5/10Trade-off: A Skynet Score is not an audit result — CertiK calls it “a security intelligence sign...
53score
Check availability for your country
CertiK · certik.com. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
6
Spearbit / CantinaElite researcher network — and the cate...
Method depth — 5/10Trade-off: Cork Protocol (~$12M): withheld commit hashes and an unpublished report — scope canno...
50score
Check availability for your country
Spearbit / Cantina · cantina.xyz. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
Ranked on 4 published criteria weighted 32/28/24/16, which set goal alignment — 30 of the 86 points. The rest: regional access 20 (constant here), evidence depth 18 (constant here), ease of use 10, institutional trust 8. Profile match is shown in breakdowns but carries no weight.
How you can lose money here, and what the ranking scores
Contract failure: the code holding the funds is exploited.
Scored by Post-audit exploit record · 32% (Certora 3/10, Sherlock 5/10, Cyfrin / CodeHawks 4/10)
Information failure: the number is wrong or bought, or your data leaks.
Scored by Accountability & reconstructability · 28% (Certora 8/10, Sherlock 8/10, Cyfrin / CodeHawks 7/10)
Also scored, as cost, quality or a summary of several families: Method depth for your stack (24%), Price transparency (16%).
Audit
Infrastructure
Methodology
2026.11.1
published 10 November 2026
Providers tracked
860+
across 121 categories
Last verified
3 November 2026
newest dated pricing or sentiment read
Named on the roster
2 people
managing directors · 6 automated processes
Decision guide
What matters most before choosing in this category
The right audit firm depends on your stack, your deadline, and how much assurance you actually need — but the decisive input is the firm's record on code it has already reviewed. Brand, client logo walls and self-reported 'TVL secured' are not scored here, because a self-reported metric without a denominator is marketing. What is scored is what happened after the review, and whether the engagement can be reconstructed from a published report and a commit-pinned scope.
Which language and execution environment is your codebase in, and does the firm have a bench for it?
Do you need a published report, or is a private review acceptable to your stakeholders?
How much of your deadline can absorb a formal-verification engagement rather than a review?
Default starting point
The #1 overall and the scoring weights
CertoraData checked Nov 2026
Formal verification with a self-reported denominator — and self-incriminating post-mortems
Formal verification with a self-reported denominator — and self-incriminating post-mortems. Strongest on method depth for your stack (10/10): Certora builds and has open-sourced the Certora Prover, its own formal verification engine for Ethereum (EVM), Solana (sBPF) and Stellar (WASM), and publishes audit write-ups on Soroban, Solana and Canton code. Weakest on post-audit exploit record (3/10): Certora's own post says its verified properties for Balancer v2 Stable Pools did not detect the rounding error behind the November 2025 exploit of more than $100M, and its Silo incident report says the exploited vulnerability was not identified during its review. Published price: Only the entry tier carries a published price (certora.com/pricing, fetched 3 November 2026): Basic is "Free" with "Up to 2,000 min/month runtime" and "Write your own rules".
Best forMethod depth — 10/10
Main tradeoffA proof only covers the properties SOMEONE WROTE — spec adequacy is your risk
Verify before signupOnly the entry tier carries a published price (certora.com/pricing, fetched 3 November 2026): Basic is "Free" with "Up to 2,000 min/month runtime" and "Write your own rules". Premium ("Unlimited Prover access", "Setup & onboarding support", "Up to 10 team members", "Specification review") and Enterprise ("Audit + formal verification retainer", "Our experts write rules for your code", "Incident response") are both "Contact Us", so the cost of an actual audit or formal-verification engagement is not published.
Weighted criteria
Post-audit exploit record32%
Accountability & reconstructability28%
Method depth for your stack24%
Price transparency16%
Methodology
How this category is reviewed
Reviewed on the post-audit exploit record, accountability and reconstructability, method depth for your stack, and price transparency. Brand and “TVL secured” are never scored.
The order on this page is the published ranking for this category. Every criterion, weight and source behind it is on the methodology page.
Frequently asked
Questions people ask before choosing smart-contract audits
Does a passed audit mean the code is safe?
No. An audit is a time-boxed review of a specific commit, not a guarantee, and every major firm in this pool has had reviewed code exploited afterwards. What separates them is whether they disclose it — a firm that publishes its own misses is easier to trust than one that publishes none.
Why is price the lightest criterion?
Because almost every firm here is quote-only, so there is no comparable price to rank. What is scorable is disclosure: whether a buyer can form any cost expectation before entering a sales process.
What matters most when picking an audit firm?
The post-audit exploit record and whether the engagement is reconstructable — together 60% of the weight. Method depth for your specific stack follows, and price transparency is scored on disclosure rather than level.
Reviewed3 November 2026Method4 criteriaCategorysmart_contract_audits
Not financial advice · For informational purposes only · Always do your own research
