Smart contract audit firms compared

Turnaround here means the review itself. It does not include the wait for a free slot, which no firm in this table publishes.

Price: not published. CertiK's audit page asks buyers to request a quote (CertiK).

Turnaround: not published for smart contract audits.

What you get: CertiK combines manual code review, AI-powered analysis and optional formal verification (CertiK FAQ). The report classifies findings from Critical to Informational, with suggested remediation for each. Issues fixed before launch are marked resolved; issues left open carry the project team's explanation. Reports are public, and audited projects appear on CertiK's Skynet leaderboard (CertiK audit page).

One customer's published account: a developer who bought a CertiK package for an ERC-1400 token contract reported a $16,000 starting quote, negotiated to $10,500, for an audit bundled with other CertiK services. The author described the process as 2 to 4 weeks (Habr, December 13, 2025, in Russian). This is one buyer's report, not a CertiK price list.

Price: not published on Cyfrin's audit page.

Turnaround: Cyfrin's engineers review codebase size and complexity at onboarding and estimate the timeline then (Cyfrin).

What you get: researchers verify the impact of each issue with a proof-of-concept and recommend a fix. Cyfrin delivers a preliminary report, your team mitigates, and researchers then verify each fix and update the final report (Cyfrin). The page lists support for chains including Ethereum, Arbitrum, Base, Optimism, Polygon, ZKsync, Solana, Sui, Aptos, Starknet and TON.

Price: see Guardix pricing.

Turnaround: 2 to 10 hours, depending on code size.

What you get: you connect a GitHub repository and pick a branch and commit. Several AI agents review the code, and each candidate finding is proved or dismissed before the report. The report lists every finding with severity, file and line, and the vulnerable code. Each critical finding is reproduced with a working exploit on a mainnet fork. The report also includes the invariants and assumptions the code relies on. A re-audit on a new commit is compared with the last one (Guardix pricing).

Published benchmark: on EVMBench, a public set of 117 high-severity bugs from 40 audits, Guardix 0.7 detected 104 of 117 (88.9% attributed recall) on September 11, 2026. Precision was not scored, 13 bugs were missed, and Guardix does not replace a manual audit (EVMBench results).

Price: "typically cost from $3,000 to $100,000+", depending on scope, complexity, integrations and timeline. Hacken confirms a quote after reviewing the repository (Hacken).

Turnaround: most audits take 2 to 4 weeks. Simple contracts take 5 to 10 business days and complex protocols 4 to 6 weeks (Hacken).

What you get: "double manual coverage" of the code, a dedicated delivery manager, and findings shared in a reporting portal during the engagement. High and critical issues include exploit scenarios. You can submit unlimited in-scope fixes within two weeks; Hacken re-checks them and publishes a final report after a QA step (Hacken).

Price: not published.

Turnaround: not published.

What you get: at least two security researchers inspect each line of code, working with your team during the audit. After you fix the issues, researchers run a fix review. The final report is delivered on a platform where your team tracks issues and talks to the auditors, and OpenZeppelin keeps a channel open for later questions (OpenZeppelin).

Price: not published. Sherlock quotes per scope and participant mix (Audit Engine FAQ). For collaborative audits, the final price and length are set from the code at the frozen commit (Sherlock scoping).

Turnaround: AI-only Audit Engine engagements show first results in hours. Engagements that add human researchers run for days and sometimes weeks, plus 2 to 3 days of judging for multi-week ones (Audit Engine FAQ). For collaborative audits, code must be frozen three days before the start; after the audit you have three weeks to return fixes, and the fix review takes one to three days (Sherlock fixes and reporting).

What you get: three formats. Collaborative audits are private audits by a team of researchers that Sherlock selects. Audit Engine combines AI auditors, models and researchers into one judged result. Bug bounties cover live code (Sherlock). Sherlock's docs mark its earlier audit contests as deprecated and replaced by Audit Engine (Sherlock docs).

Price: not published. You share the code and SolidProof estimates cost and time (SolidProof).

Turnaround: "two days to two weeks, depending on the size and complexity of the contracts" (SolidProof).

What you get: static analysis with automated tools, then a manual line-by-line review. SolidProof sends an initial report, helps with fixes, and issues a final report once every issue is fixed or acknowledged (SolidProof). SolidProof also sells team KYC checks (SolidProof).

AI audit tools publish prices more often than audit firms do. The three below publish a price you can calculate yourself. Benchmark figures are self-reported and use different setups.

All published EVMBench numbers, with their caveats, are on EVMBench results and leaderboard. For a longer comparison of AI tools, see AI smart contract auditors.

• Ask what is in scope. Prices depend on the contracts and lines in scope. Sherlock, for example, fixes the quote only at the frozen commit, and scope that grows before the freeze can change the price (Sherlock).
• Ask whether fix review is included. Hacken includes fixes submitted within two weeks; Sherlock gives three weeks to return fixes. Check the window in every quote.
• Ask whether the report is public. CertiK publishes reports by default. Ask other firms what they publish.
• Prepare the code first. Hacken says good preparation cuts audit time and cost (Hacken). Our web3 security checklist lists what to fix before you book.

Price ranges from public quotes across the market are on smart contract audit cost. How AI and manual reviews divide the work: AI vs manual smart contract audits. Running an AI check before a paid audit: what a pre-audit is.