Short answer: A smart contract audit costs roughly $5,000 to $250,000+ in 2026. A simple ERC-20 token audit typically runs $5,000 to $20,000, and most DeFi protocol audits land between $25,000 and $100,000. Most protocols also need at least one fix review, which adds $5,000 to $20,000 per pass. These planning ranges come from Sherlock's February 2026 market reference; the only reliable number for your project is a written quote for a specific commit and scope.
| What you are auditing | Typical 2026 range |
|---|---|
| Simple ERC-20 token | $5,000 – $20,000 |
| Most DeFi protocols | $25,000 – $100,000 |
| Mid-complexity DeFi | $40,000 – $100,000 |
| Enterprise or multi-chain systems | $150,000 – $250,000+ |
| Each fix review (re-audit) pass | $5,000 – $20,000 |
Sherlock suggests a pre-launch budget of $60,000 to $120,000 for a mid-complexity DeFi protocol, covering the initial audit and at least one remediation review. Protocols with meaningful TVL often spend $150,000 to $500,000 a year on security across audits, contests, bug bounties, and monitoring.
Quotes vary widely even for similar code. Sherlock reports functionally similar scopes being quoted anywhere from $15,000 to $150,000 depending on chain, firm, and urgency.
Duration also scales with code size. Sherlock's timeline guidance puts roughly 500 nSLOC at about 3 days, 3,000 nSLOC at about 18 days, and 6,000 nSLOC at about 38 days for a contest-style review. Add time for scheduling, since well-known firms are often booked weeks ahead, and for the fix review afterwards.
CertiK, OpenZeppelin, and Trail of Bits do not publish rate cards; each prices by written quote. See audit cost by firm for what each firm's public pages confirm and what to ask for in a quote.
Firepan is not a replacement for an expert audit of a high-value protocol. It is a way to find issues earlier and keep checking code between audits, at a published price:
Running Firepan before an audit means the reviewers spend their billed time on the hard problems.
Q: How much does a smart contract audit cost?
A: Roughly $5,000 to $250,000+ in 2026. Simple token audits typically cost $5,000 to $20,000, and most DeFi protocol audits cost $25,000 to $100,000, per Sherlock's 2026 market reference. Budget extra for at least one fix review.
Q: Why do audit quotes vary so much?
A: Price depends on code size, language, novelty, urgency, the firm, and how ready the code is. Sherlock reports similar scopes being quoted from $15,000 to $150,000.
Q: Is there a cheap or free smart contract audit?
A: Free automated tools exist, including Firepan's free Scan, Slither, and Aderyn. They are useful triage before a paid review, but they are not a substitute for an expert audit when significant funds are at risk.
Q: How long does a smart contract audit take?
A: It scales with code size: roughly 3 days for about 500 nSLOC, 18 days for 3,000 nSLOC, and 38 days for 6,000 nSLOC in Sherlock's timeline guidance, plus scheduling lead time and a fix review.
Q: How much does Firepan cost?
A: The Scan is free for public repositories. Subscriptions are $299, $1,199, or $2,999 per month, with 20% off billed annually. Boutique human-led audits are quoted separately.
Firepan
Run a free scan — results in minutes, no credit card required.
Run Free Scan →A 10-step checklist to prepare for a smart contract audit: freeze the code, define scope, document the design and invariants, raise test coverage, run automated tools, and plan the fix review. Prepared code costs less to audit.
A vendor-neutral field guide to AI smart contract audit tools in 2026 — Firepan, Sherlock AI, Olympix, Almanax, Octane, V12, Nethermind AuditAgent, and QuillShield — with what each does, how they differ, and how to evaluate them on your own code.
A practical, step-by-step guide to running an AI smart contract audit: prepare the repository, run a free scan, read and triage findings, go deeper with an AI audit, and know when you still need human review.
Published 2026 ranges put a web application pentest at roughly $5,000 to $50,000. Here is what drives the price, how AI-assisted testing changes it, the red flags in cheap quotes, and what to send for an accurate quote.
SOC 2 does not explicitly require a penetration test, but most companies get one: it supports criteria such as CC4.1 and CC7.1 and is often what enterprise customers ask for. What to test, when, and what the report should include.