An AI audit is not a cheap manual audit.
It is a different instrument, good at a different half of the problem. Guardix is repeatable, comes back in hours, and takes a position on every finding it raises. A person still leads where the attack is bespoke to the way you built this. Here is exactly where that line falls.
$200 flat per audit · results in 1–3 hours · re-runs priced the same
A machine can settle a bug that has a shape.
Reentrancy has a shape, and it is the same shape in your code as in the last hundred exploits. The attack that only works because of how you designed this has no shape until somebody invents it.
Settled on the code
This half is swept on every run.
- Reentrancy
- An external call made before internal state is updated — across functions and across contracts.
- Oracle and price manipulation
- Staleness windows, single-source spot reads, and flash-loan-inflated prices feeding liquidation math.
- Access control
- Unprotected entrypoints, missing timelocks, and role boundaries an attacker can step across.
- Accounting drift
- Internal accounting diverging from the balances the contract actually holds.
Settled by a person
Spend an auditor's hours on this half.
- Novel, bespoke attack paths
- A sequence that only works against your protocol. There is no prior exploit to match it against.
- Cross-protocol composition
- Assumptions that hold in isolation and break when your contract is one leg of somebody else's stack.
- Economic and game-theoretic design
- The code is correct and the mechanism is still exploitable. That argument happens with your team, not against your repo.
- Intent and spec gaps
- The contract does exactly what the spec says, and the spec is wrong. Someone has to ask you what you meant.
Guardix will not find the attack that exists only because of the way you built this. Nothing that pattern-matches will. That is the thinking you are hiring a person for.
One of these audits shows you what it decided not to report.
Below is the complete verdict ledger of one real Guardix run — 138 findings on a lending protocol, counted out of the report you can open. 19 of them are findings Guardix raised and then argued itself out of.
| Severity | Confirmed | Dismissed | Design tradeoff | Split |
|---|---|---|---|---|
| critical 1 | 1 | 0 | 0 | |
| high 48 | 34 | 2 | 12 | |
| medium 65 | 28 | 10 | 27 | |
| low 23 | 5 | 7 | 11 | |
| info 1 | 0 | 0 | 1 | |
| All findings 138 | 68 | 19 | 51 |
- Dismissed GDX-69 · high
-
Yield repay tops up shortfall from nftOwner without balance-delta guard before pool yieldRepayERC20 pull
YieldStakingBase
- Design tradeoff GDX-91 · high
-
External interest rate model is a single point of failure per asset group
InterestLogic
Both are high severity. Neither is in the confirmed column. A manual report is the findings that survived — the leads a person chased and dropped stay in their notes, and that is entirely reasonable. It just means only one of these two hands you the whole ledger, and a claim you can check beats a claim you cannot.
Open the full report — all 138 findings →The tradeoffs, row by row.
Two rows go to the manual column, and they are the two that decide whether an engagement was worth booking. A table that hands every row to one side is an advert, not a comparison.
| Dimension | Guardix AI audit, priced per run | Manual audit Human firm, priced per engagement |
|---|---|---|
| Turnaround | Guardix 1–3 hours, on demand | Manual audit 2–4 weeks, booked in advance |
| Price per run | Guardix $200 flat, any repo size | Manual audit $50,000+ per engagement |
| Running it again | Guardix Any commit, the same flat $200, diffed against your last scan | Manual audit A new engagement |
| Mechanical bug classes | Guardix Reliable, and swept again on every run | Manual audit Reliable |
| A stated verdict on every finding | Guardix Confirmed, dismissed, or design tradeoff — all 138 of them in the run above | Manual audit The findings that survived, written up |
| Novel, protocol-specific attack paths | Guardix Weak. There is no prior shape to match against | Manual audit This is the thing you are hiring them for |
| Economic and governance design | Guardix Raised, and usually filed as a design tradeoff rather than a bug | Manual audit Argued through with your team |
| What you walk away with | Guardix A versioned report anyone can open — a verdict on every finding, and a file and line range on 127 of the 138 | Manual audit A PDF, pinned to one commit |
How to spend both budgets
-
Run Guardix before you book the engagement.
Everything with a stable shape is cleared and already carries a verdict, so the expensive weeks don't open with reentrancy.
-
Re-run it on the commits that matter.
The same flat $200 each time, back in 1–3 hours, diffed against your last scan — so the write-up doesn't go stale the moment you ship the fix.
-
Buy the auditor's hours for the two rows this table hands them.
Novel attack paths, and economic and governance design. That half is judgment, and no model should be trusted with it alone.
Clear the half with a shape. Pay a person for the other half.
A full audit in 1–3 hours for $200 flat, with a verdict on every finding — so the human engagement starts on the questions only a human can answer.