You’re about to put real money on-chain, and you know you need a security review. So you go looking — and the market is bewildering. A firm quotes you $30,000 and a six-week wait. A Fiverr gig offers “full audit, 24h delivery” for $60. How are you supposed to tell what’s real?
I do these reviews for a living, so let me hand you the checklist I’d use if I were the one buying. Five questions. Ask every auditor.
1. “Can I see a sample report — and does it include things that were fine?”
A report that’s all red flags is a red flag. A real review says “the access control is correct, here’s why; the staking math is sound, here’s the invariant I checked.” A clean bill on what checks out is a finding — it’s the auditor telling you where they looked and found nothing, which is exactly what you need to know before you ship.
If every sample report is a wall of “criticals,” you’re looking at a scanner’s raw output, not an audit.
2. “What’s your false-positive rate — and can you prove it?”
This is the whole game. Anyone can run a static analyzer and paste 40 findings. The skill is in not drowning the two real bugs in thirty-eight non-issues that waste your engineers’ week.
Ask for a concrete, checkable claim. Mine, for example: my detectors run clean — zero findings — across the entire OpenZeppelin library (all 247 source files). That’s verifiable in one command; you can clone OZ and run it yourself. If a tool can’t stay silent on the most-reviewed Solidity code on earth, it has no business flagging yours.
Vague answers here (“very low”, “we’re very accurate”) mean they’ve never measured it.
3. “Every finding — is there a proof of concept?”
A “High: reentrancy possible” with no PoC is a hypothesis, not a finding. The auditor should be able to show you the exact call sequence that triggers the bug, ideally as a runnable test.
The corollary matters just as much: a good auditor will retract things that don’t hold up. I recently spent an hour building the case for a fund-locking overflow — then checked one constant, realized it would take 10¹⁵ years to trigger, and deleted it. That deletion is the product. You’re paying for the judgment to know the difference between “looks scary” and “is exploitable.”
4. “What happens after I fix the bugs?”
Two things separate a one-off from a real engagement:
- A free re-review after remediation. Fixing a bug can open a new one. If “we found it, good luck” is the whole deal, that’s half a service.
- Continuous coverage. Your code doesn’t freeze at launch — every push can introduce a vulnerability. The best security posture isn’t a one-time PDF; it’s a re-scan on every commit plus a monthly report. Ask whether they offer ongoing monitoring, not just a snapshot.
5. “Will you tell me plainly when my code is good?”
This sounds soft. It’s the most important one. An auditor with incentives to find problems will find “problems.” You want the person who, when your contract is genuinely well-built, says so — and tells you the one area that would actually benefit from a deeper look.
Honesty is the only thing you can’t verify from the outside until it’s too late. So probe for it in the conversation. Do they hedge everything to cover themselves, or do they commit to clear judgments and explain their reasoning?
The uncomfortable middle
Here’s what the checklist reveals: the $60 gig usually fails #2 and #3 (it’s scanner output, no PoCs, no measured FP rate). The $30k firm passes everything — but for a small protocol pre-mainnet, the price and timeline can be out of reach.
There’s a real middle: independent reviewers who are fast, affordable, and rigorous — who measure their false-positive rate, ship PoCs, give you a clean bill when it’s warranted, and offer ongoing monitoring. That’s the segment I work in, and it’s the right fit for most teams launching their first serious contract.
Whoever you hire, run the five questions. The good ones will welcome them.
I do fast, honest Solidity security reviews — custom detectors plus manual verification, zero false-positive noise, PoCs for anything real, and a straight answer when your code is solid. Details in my profile.
답글 남기기