Before the audit
Agree the scope with the audit firm, freeze the code at a tagged commit and prepare the documentation the auditors need.
Smart contract audit support and remediation
An audit report is a list of problems, not a fix. We take it from there. We coordinate with the audit firm, triage every finding, fix the ones that need fixing with regression tests, and see the changes through the auditors' fix review, with the deployment prepared. It works whether or not we wrote the code.
01 / WHO THIS IS FOR
Who this is for
- Teams with an audit scheduled who want someone to handle the technical side of it
- Teams with an audit report in hand and no capacity to fix the findings properly
- Projects whose original developers are no longer available
02 / WHAT WE DO
What we do
During the audit
Answer the auditors' questions quickly, so their time goes into finding issues rather than understanding the code.
Triage
Classify each finding as fix, mitigate or acknowledge, with the reasoning written down.
Remediation
Fix each finding with a minimal change and a regression test that fails before the fix and passes after it.
Fix review
Prepare the response to each finding and support the auditors while they review the fixes.
Deployment preparation
A deployment checklist and scripts. The mainnet deployment is done with your keys, with our support.
Why we keep fixes small
Every fix is new code that the auditors did not review in the first pass. A large refactor in the middle of an audit can introduce the next bug, so we keep each change as small as the finding allows, and we tell you clearly when a finding needs a deeper redesign.
03 / WHAT YOU GET
What you get
| DELIVERABLE | FORM |
|---|---|
| Each finding fixed in its own commit, with a regression test | Repository |
| A response document covering every finding, whether fixed, mitigated or acknowledged, and why | Document |
| Updated documentation and NatSpec | Repository |
| A deployment checklist and scripts | Repository |
05 / FAQ
Questions about audit support
Do you perform the audit?
No. The audit is done by an independent firm. We handle the work around it.
Can you help us choose an audit firm?
We can share what to look for and help you compare scopes and quotes. The choice is yours.
What if a finding needs a redesign?
We tell you before touching the code, with the options and their cost, so you can decide whether to fix it now, mitigate it or move the launch date.
Do you work on code you did not write?
Yes. We start by reading the code, the report and the documentation, and the fixed price reflects how well documented the codebase is.
Does this mean the code is safe to deploy?
Nobody can promise that. Remediation closes the findings from the audit, but it does not prove that no other bugs exist. A second audit, a bug bounty or a staged launch can reduce the remaining risk.