Smart Contract Auditing: What "Audited" Doesn't Mean — and How to Read the Report

Bottom line: an audit is a record that experts read specific code, not proof that the code is safe

A smart contract audit is a scoped, point-in-time review: outside specialists read one exact commit of the code, over a fixed window, within an agreed boundary, and write down what they found. It is not a pass/fail certification, and it is not an endorsement of the project.

The auditors say so themselves. The disclaimer in Quantstamp's public audit of the Nomad bridge (published 6 June 2022) reads:

This report is based on the scope of materials and documentation provided for a limited review at the time provided. Results may not be complete nor inclusive of all vulnerabilities... The review does not extend to the compiler layer, or any other areas beyond the programming language... A report does not indicate the endorsement of any particular project or team, nor guarantee its security.

The mechanics of contracts themselves are covered in what a smart contract is, and the risk landscape in smart contract risk. This piece is about the artifact: how to actually read a report.

Which code, and when?

A real report pins its target precisely. Quantstamp's Nomad report:

The commit hash is there for a reason: the audit covers that commit and nothing else. Change a line the next day, and nobody has reviewed that line.

This is measurable, not theoretical. Zellic's analysis of Nomad found that only 18.6% of the on-chain Replica.sol matched the audited version, with the drift concentrated in process, acceptableRoot and prove — the critical functions. Zellic notes that "the buggy code responsible for the hack was introduced after the audit had begun" and that "the smart contract code that was ultimately deployed differed from the audited code." The industry calls this audit drift. (Bridges carry their own structural problems — see bridge risk.)

The field everyone misreads

Beginners fixate on severity — critical, high, medium, low. The field that matters more is status. Quantstamp defines four:

Nomad's report logged 40 findings, of which only 16 were Resolved (1 of 1 high, 6 of 6 medium, 7 of 18 low, 1 of 9 informational, 1 of 6 undetermined). A reader who only checks "was it audited?" misses that 24 findings were left standing — and one of them was the one that mattered.

Five protocols that were audited and drained anyway

Nomad: found it, rated it Low, got told no

Quantstamp's QSP-19, "Proving With An Empty Leaf" — severity Low Risk, status Acknowledged, file Replica.sol — describes the exact bug that later emptied the bridge: pass an empty bytes32 as the leaf plus an artificial Merkle proof with a specified index, and the inclusion check passes. The recommendation was one line: validate that _leaf is not empty.

What makes the report remarkable is that it preserves the client's refusal and the auditor's rebuttal. Nomad replied that finding the preimage of the empty leaf was "effectively impossible." Quantstamp wrote back:

We believe the Nomad team has misunderstood the issue. It is not related to finding the pre-image of the empty bytes. Instead, it is about being able to prove that empty bytes are included in the tree... Therefore, anyone can call the prove function with an empty leaf and update the status to be proven.

The auditor found it. The team declined. On 2022-08-01 the bridge lost $190,000,000 (DefiLlama hacks tracker, as of 2026-07-16; classification Protocol Logic, technique "Trusted Root Exploit").

Balancer: severity, scope and timing all failed at once

After Balancer was exploited, Trail of Bits published an analysis of its own prior audits. The root cause, it says, was "a rounding direction issue that had been present in the code for many years" — and then, candidly:

We now know that the Composable Stable Pools that were hacked on Monday were exploited using the same vulnerability that we reported in our audit.

Per the firm's own account: three reviews of Balancer v2 in 2021; the April 2021 commit "did not have this vulnerability present"; the October 2021 Linear Pools audit filed it as TOB-BALANCER-004 but marked it undetermined severity, because they "couldn't definitively determine whether the identified rounding behavior was exploitable"; and in the September 2022 Composable Stable Pools audit, "The Stable Math library was explicitly out of scope."

So "audited by Trail of Bits" could be perfectly true while the exploited library had never been in scope. Trail of Bits also explains why small findings are so hard to grade: a 1-wei precision loss "may not seem significant when a fuzzer first identifies it, but in a particular case, such as a low-liquidity pool configured with specific parameters, the precision loss may be substantial enough to become profitable." Severity is a judgement call, not a fact.

Formal verification did not save it either. Certora had formally verified Balancer v2's Stable Pools in a 2022 audit; after the hack it stated that "the verified properties did not constrain the relationship between individual swaps or rounding behavior," and that scenarios where iterative operations such as a token roundtrip swap could systematically gain value from rounding bias "were not ruled out." Formal verification proves the properties you wrote — and only those.

Balancer V2 lost $128,000,000 on 2025-11-03 (DefiLlama, as of 2026-07-16). Trail of Bits describes it as "over $100M drained across nine blockchain networks."

Cetus: a clean, all-fixed report is not a shield

Cetus does something genuinely good: it publishes its audit reports in a public repository (CetusProtocol/Audit) with reports from MoveBit, OtterSec and Zellic, so anyone can verify them independently rather than trusting a badge. MoveBit's review (2023-03-27 to 2023-04-28, Move on Sui, cetus-clmm-sui @ 11d65f5d…) raised 18 issues — 12 minor, 3 medium, 2 major, 1 critical — and marked all 18 Fixed.

Cetus CLMM was still drained for $223,000,000 on 2025-05-22 (DefiLlama, as of 2026-07-16; Protocol Logic, technique "Spoof Token Exploit"; reported amounts range from roughly $220M to $223M). It is the largest DeFi loss of 2025 in that dataset.

OtterSec's review (2023-03-30 to 2023-05-03) included a lower-tier finding, OS-CTS-SUG-04, "Possible Arithmetic Errors", about u256 return values cast to u64: exceed MAX_U64 and arithmetic errors may occur. Patch status: "The Cetus team responded that it is highly unlikely for this scenario to occur and will not implement a patch."

To be precise — and this matters — SUG-04 concerned compute_swap_step, a different function from the path exploited in 2025. This is not "the auditors found the exact bug and were ignored." It is that the bug class (u256→u64 overflow) was raised and waved away as unlikely. OtterSec is explicit about how to read that tier: such findings "do not present an immediate security impact" but "represent antipatterns and could lead to security issues in the future."

Curve: the bug was underneath the contract

The Curve DEX exploit of 2023-07-30 was not a logic bug in the contracts. It was a Vyper compiler bug. The official advisory GHSA-5824-cm3x-3c38 (CVE-2023-39363, Critical, published 2023-08-05), "Incorrectly allocated named re-entrancy locks," affects Vyper 0.2.15, 0.2.16 and 0.3.0 and was patched in 0.3.1: "each function using a named re-entrancy lock gets a unique lock regardless of the key," enabling cross-function reentrancy.

No amount of reading the source would have surfaced this — it is precisely where Quantstamp's disclaimer says the review does not extend. Tellingly, DefiLlama does not file it under Protocol Logic at all: it is classified Infrastructure, with the technique labelled literally "Vyper Compiler Bug." The tracker records $61,700,000 (as of 2026-07-16), but contemporaneous reporting put the gross figure near $70M and the net around $52M after whitehat and MEV returns — treat no single number as settled.

Euler: more audits and a big bounty, still $197M

Euler's own post-mortem says the donateToReserves function "lacked a health check to make sure that an existing user wouldn't be able to put themselves in an unhealthy state just by donating to the reserves." The company writes that it "had the protocol audited at great expense many more times than is the industry standard" and ran "a $1M bug bounty for anyone who found critical bugs in Euler." It lost roughly $197M on 2023-03-13 regardless. The attacker later returned the funds — DefiLlama records returnedFunds of $240,000,000 (as of 2026-07-16) — but that outcome is an extreme outlier and should be read as luck, not reassurance.

The structural limit: 56% of the money is outside an audit's reach

Aggregating the DefiLlama hacks API directly on 2026-07-16 (586 incidents, $16,712,372,055 all-time):

Ronin Bridge is the canonical case: $624,000,000 on 2022-03-23, "Private Key Compromised (Social Engineering)." Flawless contract code plus compromised signers still equals total loss. The two largest Japanese incidents in DefiLlama's dataset sit in the same bucket — Coincheck, $534,000,000 on 2018-01-26, and DMM Bitcoin, $305,000,000 on 2024-05-31, both recorded as "Private Key Compromised (Unknown Method)" (as of 2026-07-16). No contract audit would have prevented either.

That "in DefiLlama's dataset" qualifier is load-bearing. Mt. Gox — which said it had lost almost 750,000 customer bitcoins plus around 100,000 of its own, roughly 850,000 BTC, worth around $473 million near its 28 February 2014 filing in Tokyo for civil rehabilitation — is larger than DMM Bitcoin in dollar terms and is absent from the dataset entirely. This section's own source has exactly the kind of blind spot this section is about. "Not in the data" is not the same as "did not happen" — scrutinise a dataset's scope the same way you scrutinise an audit's.

The frequency trend is worth noting too: the same aggregation shows 138 incidents and $1,005,382,056 in 2026 through 16 July — more incidents in roughly six and a half months than in any complete prior year (the highest full-year count in the dataset is 97). April 2026 alone accounted for $644,849,950 across 27 incidents, led by Drift Trade at $295,000,000 on 2026-04-01, technique "Compromised Admin + Fake Token Price Manipulation." April's single largest loss was an admin compromise, not a contract bug. Current numbers live at DefiLlama's hacks database.

Who actually does this work (as of 2026-07-16)

Listing auditors from memory is how you end up presenting a wound-down business as current. Verified status:

Per The Block (2026-05-13), Code4rena said "After careful consideration, we've made the decision to wind down Code4rena," with Immunefi partnering to migrate its customers and researchers and to help protocols transfer bounty "scopes, rules and reward structures." Zellic acquired Code4rena in 2024 and said it would operate independently; Code4rena had raised $6 million from Paradigm in 2023.

Every performance figure those firms publish (TVL secured, vulnerabilities found, researcher counts) is self-reported marketing, not independently verified. Read them as claims.

An audit is a point. Bug bounties are the line that connects the points: Immunefi announced on 2024-06-20 that it had "surpassed $100 million in rewards paid to whitehat hackers," listing $10 million for a vulnerability in Wormhole among its notable payouts (alongside $6 million for Aurora and $2.2 million for Polygon). Note what that is and is not: the company's own selection of "notable payouts" — a non-exhaustive list, not a ranking. (Its site currently claims "$190B+ Protected" and "60k+ Security Researchers," as of 2026-07-16 — again, self-reported.) And as Euler demonstrates, a $1M bounty does not make a protocol safe either.

The 60-second check

1. Is there a link to the actual report PDF? A badge or a logo carries zero information.
2. Verify on the auditor's site, never the project's. CertiK says "you can verify all CertiK-audited and KYC-verified projects on Skynet" (skynet.certik.com); Quantstamp points to certificate.quantstamp.com.
3. Compare scope and commit to what is deployed. Does the report's commit or address match the contract you are about to touch? Remember Nomad's 18.6%.
4. Count statuses, not severities. Are there Acknowledged or Unresolved items at critical or high?
5. Is the source code verified? Per ethereum.org, source code verification means "comparing a smart contract's source code and the compiled bytecode used during the contract creation to detect any differences" — it proves the published source compiles to the deployed bytecode, nothing more. ethereum.org distinguishes it from formal verification, which describes "verifying the correctness of a smart contract, meaning the contract behaves as expected." Verified is not a safety guarantee; unverified is a red flag — nobody, auditors included, can read what is running. (How to read a block explorer covers the mechanics.)

Red flags

• Forged audits. CertiK documents this itself: "a case in point is the Lymex scam, which led to around $300,000 in losses. Despite listing CertiK as an auditor, Lymex never received our services after failing our KYC verification." A logo is not evidence.
• Upgradeable contracts plus admin keys. Per DL News, Swaprum — a DEX on Arbitrum — was genuinely CertiK-audited and advertised it; on 2023-05-18 its developers used the contract's upgradability to drain about $3 million and laundered it through Tornado Cash. DL News reports that CertiK's report had highlighted the centralisation risk, but that it did not affect the report's score. The code you read today can be replaced tomorrow.
• An unknown firm, or an audit of a different contract or an old commit. Cross-check the table above and the firms' own public report repositories (trailofbits/publications, sigp/public-audits).

The broader pattern-matching toolkit is in the scam defence guide.

One sentence to remember

"Is it audited?" asks almost nothing. The questions that carry information are: which code, at which commit, reviewed when, how many findings were actually fixed and re-reviewed — and is the thing running right now the same thing that was audited?