Smart contract auditing firms sit between a protocol’s code and the capital that will eventually depend on it. Once a contract is deployed, a logic flaw can be exploited in minutes, and in most cases there is no rollback. That makes the choice of auditor one of the most consequential vendor decisions a Web3 team will make, whether it is shipping a lending market on Ethereum, a Solana program, a Move module on Sui or Aptos, or a zero-knowledge circuit.
The market has also split into distinct models. Some smart contract audit firms run small, senior teams on fixed engagements. Others specialize in formal verification, proving properties about code mathematically rather than sampling it by hand. A third group runs competitive audits, where hundreds of independent researchers review the same codebase and are paid for what they find. If you are still at the build stage, our guide to the top smart contract development companies covers the teams that write the code these firms review.
Every firm below publishes audit reports or maintains a public report library, and the facts we cite come from the companies’ own sites and public report repositories. Where a figure is a self-reported claim, we say so.
We ranked these smart contract audit companies on depth of specialization, the transparency of their public reports, and how clearly their own sites document the chains, languages and protocols they cover.
1. Trail of Bits — Builder Of Slither And Echidna With 400+ Public Blockchain Engagements
Trail of Bits is an independent security research and engineering firm founded in 2012, and its blockchain practice is one of the most technically deep in the field. The firm maintains Slither, the widely used Solidity static analyzer, along with the Echidna and Medusa fuzzers. Its engineers use those same tools on client work, and the firm says its blockchain team has been writing invariants for more than five years.
Engagements range from early design assessments to full code reviews and invariant testing programs. Coverage on its blockchain services page spans Solidity and EVM systems, Go-based nodes, Move on Aptos and Sui, Solana, Arbitrum (including Stylus), Optimism, Cosmos, Substrate, Starknet’s Cairo and TON. The scope goes well beyond contracts into bridges, governance and off-chain infrastructure.
Proof is unusually easy to check. Trail of Bits publishes its reports in a public GitHub publications repository, and its site lists 468 public blockchain engagements. Named work includes Uniswap (including Uniswap v4 Core), Aave, Arbitrum, Balancer and Liquity, and the firm was selected by the Optimism Foundation for grant-funded assessments. Outside crypto, it placed second in DARPA’s AI Cyber Challenge finals in 2025.
Best for: L2s, bridges, clients and complex DeFi systems where the risk lives in the interaction between contracts and infrastructure, and teams that want to keep the fuzzing harnesses after the engagement ends.
2. OpenZeppelin — Maintainer Of OpenZeppelin Contracts With 900+ Audits Since 2017
OpenZeppelin is best known for OpenZeppelin Contracts, the open-source Solidity library that a large share of the EVM ecosystem builds on. According to its site, 9 of the top 10 stablecoins by market cap in 2025 were built with it. Founded in 2015, the company is remote-first, with more than 100 team members in over 40 countries.
Its audit practice covers Solidity, Cairo, Rust and Go across Ethereum, Arbitrum, Base, OP Mainnet, Starknet, ZKsync, Linea, Stellar, Sui and other networks. It also runs zero-knowledge proof audits and a Continuous Security Program for teams that ship often. The firm says each line in scope is reviewed by at least two researchers, followed by a fix review.
OpenZeppelin says it has completed more than 900 audits since 2017, and it publishes per-client figures on its audits page. Compound leads with 74 audits, followed by ZKsync, The Graph and UMA, and the list also includes Aave, Uniswap Labs, Optimism, Morpho, Lido, Fireblocks and the Ethereum Foundation. The company reports a 95% rehire rate, and its reports are published in the research section of its site.
Best for: EVM and Starknet teams that want a long-running relationship with one auditor across many releases, especially if the codebase already leans on OpenZeppelin Contracts.
3. Zellic — Founded By Perfect Blue CTF Players, Strong On ZK Circuits And Move
Zellic was co-founded by Luna Tong and Jasraj Bedi, who also founded perfect blue, which the company describes as the world’s top-ranked CTF (competitive hacking) team in 2020, 2021 and 2023. That background shows in the firm’s focus areas: exploitation-heavy work on L1s, L2s and rollups, applied cryptography, trusted execution environments and zero-knowledge circuits.
Its specialties list EVM, ZK circuits, Move on Aptos and Sui, Cosmos and Solana, plus web application security and formal verification, static analysis and fuzzing. That breadth suits teams whose risk spans contracts, provers and the services around them. Zellic publishes reports through a public GitHub repository and a dedicated reports site.
Zellic’s site reports 338 reviews in 2025, with critical or high-impact findings in 153 of them (45%). Client logos include LayerZero, the Solana Foundation, Hyperliquid, Polymarket, Zcash, Morpho and Ethena. Testimonials come from Mysten Labs, Axiom, Scroll, Wintermute and Injective. The team page lists about 45 people.
Best for: ZK rollups, zkVM projects, cross-chain messaging and Move-based protocols where the attack surface includes cryptography as well as contract logic.
OtterSec is the auditor many Solana teams reach for first. Its work covers layer 1 foundations, wallets, DeFi protocols, bridges and supporting infrastructure, with Solana as the clear center of gravity. It also audits on Sui, Aptos, Stellar and EVM chains, and its team has published tooling for reverse engineering Solana sBPF programs.
The client list reads like a map of the Solana and Move ecosystems. OtterSec names the Solana Foundation, Sui, Aptos Labs, Jito, Kamino, Pyth, Squads and Backpack, along with Tether, Circle, LayerZero, Wormhole and MetaMask. Testimonials on its homepage come from the Solana Foundation, the Sui Foundation, Algorand, Squads, Backpack and MetaMask.
The firm says it has audited more than 120 projects and helped patch over $1 billion in vulnerabilities. Its audits page lists recent public reports by date, with 2026 entries spanning Solana, EVM, Stellar and Sui. OtterSec also supports the security community through CTF work, including a fund for capture-the-flag competitions.
Best for: Solana programs written in Rust or Anchor, and Sui or Aptos protocols written in Move, where you want reviewers who already know the runtime’s quirks.
ChainSecurity is a Swiss firm, operated by Decentralized Security AG in Zurich, that has audited smart contracts since 2017. Its reviews cover critical code, business logic and architecture, which matters for large DeFi systems where the most damaging bugs often come from economic design rather than a single line of Solidity.
Its client roster leans heavily toward blue-chip DeFi. Logos on its site include Sky, Spark, Compound, Curve, Gearbox, Velodrome, Liquity, Euler, Frax, Polygon, Polymarket and the Vyper compiler team. Testimonials come from MakerDAO (on its Liquidations 2.0 upgrade), Aave Labs and Enzyme.
ChainSecurity keeps a public report library on its site. Recent entries include Aave V4 (February 2026), Circle Gateway smart contracts, Pendle Boros markets, a Sky governance OApp and a WBTC Solana bridge. The firm also has an institutional section for banks and asset managers moving onchain, a growing source of audit demand.
Best for: established lending, stablecoin and DEX protocols, plus regulated institutions that want a European auditor with a long DeFi track record.
6. Certora — Formal Verification Specialist Built Around The Certora Prover
Certora approaches smart contract auditing from the formal verification side. Its core product, the Certora Prover, checks contract bytecode against rules that describe how the code should behave, and it can run on every commit. Instead of hoping a reviewer spots an edge case, teams write properties (for example, “total supply always equals the sum of balances”) and the prover either confirms them or produces a counterexample.
Certora also sells security audits staffed by auditors and formal verification engineers, expert rule writing for teams without in-house specification skills, and community contests for crowdsourced specifications, run with platforms such as Code4rena. According to its documentation, the tooling extends beyond the EVM to Solana programs, Soroban contracts on Stellar and Move on Sui.
Named users on its site include MakerDAO, Lido, Balancer, Aave, Compound, Morpho, Safe, Coinbase, the Ethereum Foundation, Jito, Kamino and Squads. Certora says it protects more than $100 billion in TVL. The company is Israel-based and grew out of formal verification research led by Shmuel (Mooly) Sagiv of Tel Aviv University.
Best for: high-value DeFi protocols that want mathematical guarantees on core invariants, and teams that want verification rules running in CI after the audit is over.
7. Sigma Prime — Sydney Team Behind The Lighthouse Ethereum Client
Sigma Prime was born and is headquartered in Sydney, and it has worked in Ethereum security since 2016. It is also the team behind Lighthouse, an open-source Ethereum consensus client written in Rust. That gives its auditors something few firms have: years of experience running production blockchain infrastructure, not just reviewing it.
Its security reviews cover smart contracts, blockchain protocols, ZK systems, off-chain code and frontends. Beyond fixed audits, it offers rolling commit reviews and an embedded “Integrated Security Engineer” for teams that want a reviewer working alongside their developers. Rust is a clear strength, and its case studies include a review of Reth, the Rust Ethereum execution client.
Sigma Prime publishes its reports in a public GitHub repository (sigp/public-audits) and says it has completed hundreds of public security reviews. Organizations shown on its site include the Ethereum Foundation, Chainlink, EigenLayer, Aave, Arbitrum, Optimism, Lido, Rocket Pool and Polkadot, with published case studies for Mantle, Botanix and Berachain.
Best for: Rust-heavy codebases, staking and restaking protocols, and teams building chain infrastructure that needs reviewers who understand consensus and networking as well as contracts.
8. Veridise — UT Austin Spinout Specializing In Zero-Knowledge Circuit Audits
Veridise was founded in 2021 by academics from the UToPiA research group at the University of Texas at Austin, led by co-founder and president Işil Dillig. The team includes PhDs in program analysis, cryptography and software security, and the company says about half its people work on tooling rather than manual review.
Zero knowledge is where Veridise stands out. It audits ZK circuits and zkVM applications as well as smart contracts, DeFi protocols, L1 and L2 systems and wallets. Its in-house tools include the Vanguard static analyzer, the OrCa fuzzer, ZK Vanguard and Picus, a tool aimed at ZK circuits. The company says its team has found critical vulnerabilities in the core Circom libraries.
Veridise reports more than 150 completed audits and a team of more than 35. Named clients include Aztec, Stellar, zkSync, Linea, Succinct, RISC Zero, Semaphore and Lombard, with testimonials from RISC Zero, Linea, o1Labs and the Ethereum Foundation’s Semaphore team. Many of its reports are linked from a past audits page.
Best for: ZK rollups, zkVM applications and privacy protocols where circuit soundness is the main risk, and teams that value research-grade tooling.
9. Runtime Verification — UIUC Spinout Offering Bytecode-Level Proofs With Kontrol And KEVM
Runtime Verification was founded in 2010 by Grigore Rosu, a computer science professor at the University of Illinois Urbana-Champaign, and is based in Urbana, Illinois. It worked on formal methods for aerospace before moving into blockchain, and it is the team behind the K framework and KEVM, a formal semantics of the Ethereum Virtual Machine.
Its smart contract services are explicit about the difference between auditing and verification. A standard engagement combines design review, a verification-oriented code review and a unified security report. Teams that need more can add formal modeling of business logic or full formal verification, where properties are written as Solidity tests through Kontrol, proved at the bytecode level and run in CI.
Runtime Verification publishes its reports in a public GitHub publications repository. Named clients on its site include Uniswap, Maker, Lido, Gnosis, Morpho, Olympus DAO and Alchemix, plus non-EVM ecosystems such as Algorand, Tezos, Polkadot and MultiversX. Its client logos also include the Solana Foundation and the Monad Foundation.
Best for: protocols that need formal proofs of critical properties, such as token accounting or vault solvency, and teams that want verification artifacts they can maintain in-house.
10. Sherlock — Competitive Audit Platform With 11,000+ Registered Researchers
Sherlock represents the competitive audit model. Instead of assigning a small fixed team, it opens a codebase to a contest in which many independent researchers hunt for vulnerabilities and are rewarded for valid findings. Sherlock says more than 11,000 researchers have registered on the platform, and it publishes researcher leaderboards alongside its live contests.
Contests are one of four products. Collaborative audits are private, staffed reviews by a curated team of researchers. The Audit Engine pairs AI auditors with human reviewers, and bug bounties cover live code after launch, with Sherlock’s in-house team triaging reports. The company positions the combination as continuous coverage from pre-launch through mainnet.
Sherlock says it has run more than 1,500 audits and security reviews and uncovered more than 2,000 critical issues. Its site features testimonials from Aave’s Stani Kulechov, Sky’s Rune Christensen and the Ethereum Foundation, plus case studies on Babylon’s ZK infrastructure, Meteora’s Solana liquidity contracts and Morpho Vaults V2.
Best for: teams that want many sets of eyes on a codebase before launch, and protocols that plan to pair a contest or collaborative audit with an ongoing bug bounty.
How To Choose A Smart Contract Auditor
Does The Firm Have Real Depth In Your Chain And Language?
Solidity on the EVM, Rust on Solana, Move on Sui and Aptos, Cairo on Starknet and ZK circuit languages each have their own failure modes. A reviewer who is excellent at Solidity reentrancy may miss an account validation bug in an Anchor program or an underconstrained signal in a Circom circuit. Ask for three or four public reports on your exact stack and read the findings sections, not just the summaries.
Can You Read Their Past Reports?
Public reports are the best quality signal in smart contract auditing. Good ones explain the threat model, list what was in and out of scope, describe each finding with a clear severity and recommendation, and record how the team fixed it. Be wary of firms whose reports are mostly automated tool output or whose findings are dominated by gas and style notes.
Do You Need A Fixed Team, A Contest Or Formal Verification?
A fixed team gives you continuity, direct access to reviewers and a predictable timeline. A competitive audit puts far more researchers on the code, which can surface unusual bugs, but you will spend time triaging duplicate and invalid submissions. Formal verification proves specific properties about your contracts, but only the properties you specify, so it complements a manual audit rather than replacing it.
Many high-value protocols use more than one model: a manual audit, then a contest or formal verification on the most critical modules, then a bug bounty after launch.
Who Will Actually Review Your Code?
Brand names matter less than the specific engineers assigned. Ask who will be on the engagement, how many reviewers will look at each line, and how many person-weeks are planned for your codebase size. A rushed one-week review of a large protocol is a weak signal, no matter whose logo is on the report.
How Ready Is Your Codebase For An Audit?
Audit time is expensive, so do not spend it on problems you could fix yourself. Freeze the scope, write documentation and a clear specification, reach solid test coverage and run static analyzers such as Slither before the engagement starts. Teams that arrive prepared get deeper findings because reviewers spend their time on logic instead of basic hygiene.
What Happens After The Report Is Delivered?
Confirm that a fix review is included, how long the firm will support follow-up questions, and whether it offers continuous review for future releases. Code changes after an audit are a common source of risk, so plan how upgrades, new features and parameter changes will be reviewed before they ship.
Conclusion
The best smart contract auditing firms are not interchangeable. Trail of Bits, OpenZeppelin and ChainSecurity bring long track records across major DeFi protocols. Zellic, OtterSec and Sigma Prime stand out for ZK, Solana, Move and Rust work. Certora and Runtime Verification lead on formal verification, Veridise on ZK circuits, and Sherlock on competitive audits and bounties. The right choice depends on your chain, your language and how much value your contracts will hold.
Shortlist two or three firms that match your stack, read their public reports, and ask who will be on your engagement before you sign. If you are still choosing a team to build your protocol, see our list of the top blockchain development companies.
