An independent audit is essential for any smart contract that will hold real value. But audits are time-boxed: the auditors have a fixed number of days to understand your code and find what is wrong with it. If they spend that time on missing documentation, untested code and basic mistakes, the subtle issues that actually lose money get less attention.
SemBricks provides smart contract audit support before, during and after the audit. We make your code audit-ready, help your team handle the findings and implement the fixes. This works for contracts we built ourselves and for contracts written by your own team or a previous supplier.
Before the Audit: Pre-Audit Review
A pre-audit review removes the easy findings so the auditors can focus on the hard ones:
- Line-by-line code review against known vulnerability patterns and the project's own specification.
- Test coverage: unit tests for every function, plus fuzz and invariant tests for the logic that moves funds.
- Static analysis to catch common issues automatically, with every warning either fixed or explained.
- Documentation: a clear specification, a threat model, NatSpec comments and a description of roles and permissions. Auditors work faster when they know what the code is supposed to do.
- Scope freeze: a tagged commit that matches exactly what will be deployed, so the audit report applies to the real code.
Vulnerabilities We Check For
- Reentrancy, including cross-function and read-only reentrancy
- Missing or incorrect access control on sensitive functions
- Price and oracle manipulation, including flash-loan driven attacks
- Rounding and precision errors in share, fee and reward calculations
- Signature replay and incorrect signature validation
- Storage collisions and unsafe initialisation in upgradeable contracts and proxies
- Unchecked external calls and unexpected token behaviour, such as fee-on-transfer tokens
- Denial of service through unbounded loops or gas griefing
- Front-running and transaction ordering risks
During the Audit
Auditors ask questions. We answer them quickly and precisely, so no audit days are lost waiting. When findings come in, we help you triage them: which are real risks, which are design choices that need a better explanation, and which can be accepted with a documented reason.
After the Audit: Remediation
We implement the fixes, add regression tests for every finding and prepare the changes for the auditor's fix review. Then we take care of a safe deployment: verified source code, admin rights moved to a multisig, sensitive actions behind a timelock and monitoring on critical events.
Contracts That Are Already Live
Inherited a deployed contract from a previous team, or worried about one that is already holding funds? We review the deployed code, assess what can still be changed through upgrade or admin functions, and if needed plan a safe migration to a new version.
Frequently Asked Questions about Smart Contract Audits
Is this the same as a formal smart contract audit?
No. A formal audit should be done by an independent party that did not write the code. We do an internal security review and prepare your code for that audit, and afterwards we fix what the auditors find. That combination gives you the most value from the audit budget.
Can you review contracts that you did not write?
Yes. We can start from existing code, whether it comes from your own team or a previous supplier. We read it against your specification and known vulnerability patterns and report what we find.
Do you work with a specific audit firm?
You choose the auditor. We work with the audit firm of your choice, answer their questions and implement the findings.
What do we need to prepare?
Access to the repository, a description of what the contracts should do and who may do what, and the chains you will deploy on. If a specification is missing, writing one is usually the first step.
Do you work on Solana programs as well?
Yes. Besides Solidity contracts on EVM chains, we review and fix Rust programs on Solana, where the main risks lie in account validation and signer checks.
Can you sign an NDA?
Yes, we sign an NDA on request before you share any code.
Building new contracts as well? See our smart contract development services.
Prepare Your Audit
Planning an audit, or just received a report full of findings? Tell us where you stand and we will tell you what we would do first.