Provider at a glance
- Category
- Smart-Contract Audits
- Entity
- Not verified
- Official website
- github.com
Independent rankingchecked How it works
Details
Scored 71 out of 100 under methodology 2026.10.18, from the evidence read on file.
Trail of Bits
Security engineering and audits
Smart-Contract Audits
#4 Overall
Ranked #4 of 9 smart-contract audits in the published ranking
71
ChainChoice Score
The ChainChoice Score, shown against 100: published scores run from 41 to 99.- Low evidence confidence
Is Trail of Bits right for you?
Right for you if these matter most
- Accountability & reconstructability10/10, the category best
- Method depth for your stack9/10; the category best is 10
Look elsewhere if these come first
- Post-audit exploit record3/10 here; Immunefi scores 8
- Price transparency3/10 here; Immunefi scores 8
Not yet tested for your country. Markets it lists: Global.
to test where you can use it.
The rank above is the published one, the same for every reader. Find my best smart-contract audit firm shows where it lands for you.
What will Trail of Bits cost you?
Not priced on this basis
- Transactions per year
- 1k
How safe is Trail of Bits?
- Evidence: unknown4 of 4 criteria scored; no receipt file yet. The score is provisional until a quoted source is on file.
- LicenceMiCA (EU): no register record on file here.
Alternatives to Trail of Bits
Compare all 4- 3SherlockLevel on score · stronger on post audit record (5 against 3)71
- 5Immunefi1 point below · stronger on post audit record (8 against 3)70
- 6Cyfrin / CodeHawks5 points below · stronger on post audit record (4 against 3)66
For your setup
Find out if Trail of Bits fits you
The rank above is the published one — the same for every visitor. Answer the category's questions and this section shows where Trail of Bits lands for you, which criteria your answers weight up, and which stated needs the record does or does not meet. The published rank stays beside it.
- A few questions
- No account required
- Ranking-blind: no commercial input
- Personalised in under 60 seconds
Find my best smart-contract audit firmNothing is inferred from clicks, popularity or commercial value.
Why this rank
Why Trail of Bits ranks #4
Each strength is read from evidence on a 0–10 ladder and weighted as the published methodology states. The 32 objective points these produce (20.5 here) sit inside the score; availability, friction, trust record and measured data add the rest. Best in this ranking on 1 of 4.
4 published criteria · Σ weight 100
CriterionWeightStrength · 0–10ScoreContrib.MedianBestRankEvidence
323+3.074.09#7/9Loading evidence…
2810+8.967.010#1/9Loading evidence…
249+6.916.010#2/9Loading evidence…
163+1.542.08#4/9Loading evidence…
Hairline = best in this ranking · tick = its median · a missing bar is "not scored", never zero
MarginLevelbehind Sherlock, #3
RobustnessOne point from changingacross a one-point change to each of its 4 criterion scores, the re-run scores 69–73 and ranks #3–#5
Evidence4 of 4 scoredno receipt file for this category
What would move the rank
Each line is the ranking run again with one of Trail of Bits’s criterion scores changed and every other value held: the smallest whole-point change on that criterion that moves its rank, and where the re-run puts it. Up to 4 climbs and 3 falls are listed, smallest change first. Nothing here is a forecast.
Post-audit exploit record 3 → 4 on its ladder · passes Sherlock+173#4 → #3
Method depth for your stack 9 → 10 on its ladder · passes Sherlock+172#4 → #3
Price transparency 3 → 4 on its ladder · passes Sherlock+172#4 → #3
Post-audit exploit record 3 → 2 on its ladder · Immunefi passes it−169#4 → #5
Accountability & reconstructability 10 → 9 on its ladder · Immunefi passes it−169#4 → #5
Method depth for your stack 9 → 8 on its ladder · Immunefi passes it−169#4 → #5
Smallest climb: post-audit exploit record 3 → 4 passes Sherlock, #3.
Strengths
2 from the score dataWhere it leads
Best for readers who weight
- Accountability & reconstructability — 10/10, the category best
- Method depth for your stack — 9/10, category best 10/10
Tradeoffs
2 from the score dataWhere it trails
Not for readers who put first
- Post-audit exploit record — 3/10 against a category best of 9/10
- Price transparency — 3/10 against a category best of 8/10
Record watch-outs
- Balancer V2 (more than $100M): the issue WAS raised in 2021 and marked “undetermined severity”
- Bunni v2 (~$8.4m, 2025): a Trail of Bits-reviewed protocol, now paused — the exploited line is shown in Cyfrin’s later v2.1 scope, not demonstrably in Trail of Bits’ target
- The same rounding class reached production twice in 2025 on reviewed code
- No public rate card; circulating price bands trace only to SEO listicles
Competitive position
Where Trail of Bits leads and where it trails
Rank on every objective dimension among the rows scored on it. A criterion in the top third of its pool is listed as a lead, the bottom third as a trail; the middle is neither. Popularity, size and commercial terms are not dimensions.
Availability#1 / 914.0 of 20 · constant here
Published criteria#3 / 915.4 of 30 · best 17.0
Friction#9 / 91.3 of 10 · best 5.3
Trust record#2 / 95.6 of 8 · best 6.4
Measured data#1 / 98.3 of 18 · constant here
Where Trail of Bits leads
- Accountability & reconstructability#1 / 9
- Method depth for your stack#2 / 9
Where it trails
- Post-audit exploit record#7 / 9
Closest alternatives
The 3 nearest rows by score
Nearest by published score in either direction. Each card states the criteria on which the two rows differ and the cost difference under the same scenario inputs; the compare arithmetic below shows why the higher one ranks higher.
Sherlock#3 of 9 · score 71 · same score
Trail of Bits leads on
- Accountability & reconstructability10 vs 8
- Method depth for your stack9 vs 5
Sherlock leads on
- Post-audit exploit record5 vs 3
- Price transparency4 vs 3
Largest single reason Sherlock is ahead: friction (+5.2 display points).Scenario cost: Sherlock has no verified pricing for this scenario.
Immunefi#5 of 9 · score 70 · 1.0 point behind
Trail of Bits leads on
- Accountability & reconstructability10 vs 4
- Method depth for your stack9 vs 3
Immunefi leads on
- Post-audit exploit record8 vs 3
- Price transparency8 vs 3
Largest single reason Trail of Bits is ahead: trust record (+6.2 display points).Scenario cost: Immunefi has no verified pricing for this scenario.
Cyfrin / CodeHawks#6 of 9 · score 66 · 5.0 points behind
Trail of Bits leads on
- Accountability & reconstructability10 vs 7
- Method depth for your stack9 vs 7
- Price transparency3 vs 2
Cyfrin / CodeHawks leads on
- Post-audit exploit record4 vs 3
Largest single reason Trail of Bits is ahead: published criteria (+7.3 display points).Scenario cost: Cyfrin / CodeHawks has no verified pricing for this scenario.
Against the leader
82 vs 71 · gap 11.0Why Certora ranks above Trail of Bits
The compare workspace's arithmetic applied to these two rows. Each dimension's share of the gap is its weight × the difference, on the displayed scale — it reproduces the displayed gap of 11.0 to within rounding.
DimensionThisCertoraGap share
Availability · 23% weight · constant here14.014.0same
Published criteria · 35% weight15.416.9−3.9, worse
Friction · 12% weight1.33.3−5.2, worse
Trust record · 9% weight5.66.4−2.1, worse
Measured data · 21% weight · constant here8.38.3same
Published criterionThisCertoraPoints
Post-audit exploit record · w3234−1.02, worse
Accountability & reconstructability · w28108+1.79, better
Method depth for your stack · w24910−0.77, worse
Price transparency · w1637−2.05, worse
Net7182−11.0
Your scenario
Trail of Bits is not priced for this scenario
The cheapest published tier that covers your usage. List price before any discount; add-ons priced separately are excluded. Change an input and every figure recomputes from the published rate; the published rank does not move.
your cost/yr · default scenario — set your own
Transactions per year · your input1k
Rate read from the provider’s published pricing ↗ on 14 September 2026.
your cost/yrCost is stated as your cost/yr in USD; it is never a yield, never annualised, and it does not enter the score.
Not priced on this basis
Under the default inputs · USDCategory medianNot priced0 of 9 rows priced
Cheapest pricedNone pricedDifference not stated · availability not applied — set your country to filter
9 of 9 rows in this ranking have no verified rate for this scenario and are absent from the median, not counted as free.
Evidence
No evidence reading date recorded
One row per published criterion: the page each strength was read from, its source type by domain, the reading date and whether the file and the published table agree. Open a row for the quote and the receipt.
4 of 4 cells scored
Score evidenceUnknownno observation on file
No structured observation on file for this category; the strengths are the catalog’s published values.Public receiptsReading…category publishes no receipt file
The receipt file has not been read yet.Evidence confidenceNot yet ratedcoverage and corroboration, never freshness
No structured observation on file for this category; the receipt count is not counted.RobustnessOne point from changingrank #3 to #5 across one-point re-runs
Whether the position holds when one criterion score is changed by one point and the ranking is run again. It is always a re-run of the ranking, never an estimate.No structured observation is on file for this provider in this category; the strengths are the catalog’s published values.
9 listed rows in this category still await an evidence read and sit outside the scored pool.
Reading the evidence ledger…
CriterionSourceTypeReadFreshnessStatusReceipt
Post-audit exploit recordstrength 3 · weight 32Report an error——
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.Accountability & reconstructabilitystrength 10 · weight 28Report an error——
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.Method depth for your stackstrength 9 · weight 24Report an error——
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.Price transparencystrength 3 · weight 16Report an error——
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.How you can lose money here, and what the ranking scores
- Contract failure (Trail of Bits 3/10): the code holding the funds is exploited.Scored by Post-audit exploit record · 32%
- Information failure (Trail of Bits 10/10): the number is wrong or bought, or your data leaks.Scored by Accountability & reconstructability · 28%
Not assessed by this ranking: Liveness failure, Exit failure. A high place says nothing about these; the Methodology tab says what each means. Also scored, as cost, quality or a summary of several families: Method depth for your stack (24%), Price transparency (16%).
Facts
facts, not scoresWhat the record publishes
- Pricing
- No public rate card — quote-only. REFUTED ON RE-CHECK: the widely repeated “$80k–$350k+ for top-tier firms” band traces only to third-party SEO listicles, not to Trail of Bits, and the source was 403-blocked on re-fetch — treat it as uncitable. The only hard unit the firm itself uses is engineer-weeks.Trail of Bits publications archive (no rate card published) ↗ · 14 September 2026
- Prices published in
- USDTrail of Bits publications archive (no rate card published) ↗ · 14 September 2026
- Licences held
- Not published
- Compliance level
- partial
- Regulatory note
- Not published
- Supported chains
- EVM, Solana, multi-chain
- Markets served
- global
- Primary markets
- Protocol teams and institutional builders
- Restricted markets
- Not published
- Operating limits
- Enterprise quote-only; no self-serve.
- Availability note
- Enterprise engagement by quote only ('Request a quote'); no eligibility or sanctions terms were found on Trail of Bits' privacy policy or services pages, and its terms URL returned 404 (read 14 September 2026).
No confirmed legal entity is on file for this record. Nothing is inferred from the brand name.
If something goes wrong with Trail of Bits: where to complain, and where to report a scam
Loading the routes for your country.
How this page is reviewed
Reviewed means this product in this category was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
Accountable for this review: Mathias Siemonsmeier, Founder.
How we review · Review calendar · Corrections log · How we make money
History
What the record carries
Changes to published ranks are recorded in a ledger; every step and its cause is listed on the rank-history page. The entries below begin with the current verified snapshot, then the methodology versions whose changes applied to this category, newest first.
10 methodology entries
- currentCurrent verified snapshot · methodology 2026.10.18Score 71, #4 of 9. 4 of 4 criteria scored. History starts here; earlier values are not interpolated.
- 10 October 2026
2026.10.8When nothing serves your country, the list shown for reference is the published ranking · platform-wide- fixed The reference list shown when nothing serves your country is the published order with the published scores, and a build check now fails any such list out of that order or with a score the ranking does not publish.
- fixed The explorer prints an overall rank only for a row the published ranking holds; a country entrant such as Coinbase Commerce for US merchants shows no overall rank.
- changed Published orders do not move. Country results change only where nothing serves the country: in India bill pay keeps Bitcoin Well first and now shows Strike second, as published; 35 such runs across all categories and countries now match the published list exactly.
- 10 October 2026
2026.10.6A criterion you require re-scores the rows that meet it · platform-wide- changed The explorer sends each criterion you require, at any band, as fit_required with your other answers; region, licence, chain and fact filters stay filters. On /best, a required criterion joins For you as a marked preference does, which needs your country; Overall stays the published ranking, filtered.
- added Every published criterion has a golden case as the explorer sends it (require:<criterion>), so the order a requirement gives is replayed and gated as the published order is, and a change to it needs an entry here.
- 16 September 2026
2026.09.15Dimension scores carry tenths, and eleven more categories are re-read from primary sources · platform-wide- changed Dimension scores resolve to tenths of a point (O-04b), and weightedTotal is rounded to six decimal places before the order is read. 518 published scores move across 107 categories that were not re-read; none of them moves by more than 4 points, and most move by 1.
- fixed 66 published scores change in the eleven re-read categories, against a verbatim source each. The largest moves are Reflexer RAI (−16), Beefy and Unrekt (−11), Aztec (−10) and Golem (+9) — all of them rows whose sources had moved since their last read.
- changed Published order moves in 38 of 119 categories and three #1s change: smart_contract_audits (Zellic → Certora) and travel_rule_compliance (Sumsub Travel Rule → CodeVASP) on the finer resolution, kyc_compliance (Veriff → Sumsub) on the re-read.
- added availabilitySource (O-04g): for a reader who states a country, a row whose availability in that country rests on a region tag its record gives no source for sorts below every sourced row. It is inert in every order published here, which states no country.
Methodology 2026.10.18, the same published run every visitor sees · receipt smart_contract_audits:trail-of-bits:2026.10.18:a40317dbdfb1
Are you Trail of Bits? Reply to this verdict, or send evidence, ask for a correction or claim the listing. Every message gets a public ticket number; none of it changes a rank unless a public page or a signed statement supports it.