Trail of Bits lists 620 audits and hosts its public reports on GitHub, and Sigma Prime states 400+ projects audited since 2016. None of the eight firms here publishes an audit price; all quote per project. Sherlock and Cantina are platforms that also run contests or bounties, and we say so in each entry.
Quick answer
For a high-value protocol, book Trail of Bits or OpenZeppelin and read their public reports first. Use Sigma Prime for infrastructure and client work, Ackee for Solana plus EVM, and add a Sherlock contest after a private audit for extra coverage.
- 01Trail of Bits: Most public reports
- 02OpenZeppelin: Standard library author
- 03Sigma Prime: Infrastructure depth
- 04Ackee Blockchain: Solana and EVM
- 05CertiK: Highest client count
The 8 best smart contract audit firms
Trail of Bits, working since 2012, lists 620 audits and keeps public reports in its GitHub publications repo. Its audits use its own open-source tools Slither, Echidna and Medusa.
- Platforms
- Web
- Launched
- 2012
- Open source
- Yes, 200+ open-source repos including Slither and Echidna
- Company
- Security research and audit firm; public reports on GitHub
- Pricing
- Not published; engagements start through the contact form
Pros
- 620 audits listed on its homepage
- Public reports hosted on GitHub (trailofbits/publications)
- Builds open-source tools used in audits: Slither, Echidna, Medusa
Cons
- No published pricing; engagements are scoped per project
- Blockchain is one of several practices, next to AI and app security
Skip it if you want a fixed published price.
OpenZeppelin maintains the MIT-licensed OpenZeppelin Contracts library, which it says 9 of the top 10 stablecoins build on, and sells audits on top of it.
- Chains
- Ethereum and EVM networks
- Platforms
- Web, Library
- Open source
- Yes, OpenZeppelin Contracts under MIT on GitHub
- Company
- OpenZeppelin; S&P Global has agreed to acquire it
- Launched
- 2016 (Contracts repository created August 2016)
Pros
- Contracts library is free under MIT
- Contracts Wizard generates token and governance contracts
- Homepage states 9 of the top 10 stablecoins use its contracts
Cons
- Audits are a paid, quote-based service
- Ownership is changing: S&P Global has agreed to acquire the company
Skip it if ownership change worries you: S&P Global has agreed to acquire it.
Sigma Prime, established in 2016, states 400+ projects audited and 6,500+ findings. It also audits signers, validators and CI/CD, and builds the Lighthouse consensus client.
- Platforms
- Web
- Launched
- 2016
- Open source
- Yes, Lighthouse under Apache 2.0
- Company
- Blockchain security and infrastructure firm; founder Mehdi Zerouali
- Pricing
- Not published; audits are scoped through a request form
Pros
- 400+ projects audited and 6,500+ findings, per its homepage
- Audits offchain infrastructure too: signers, validators, CI/CD
- Built Lighthouse, an Apache 2.0 Ethereum consensus client
Cons
- No published pricing
- Contract audit languages listed stop at Solidity, Vyper, Rust and Move
Skip it if your code is in a language beyond Solidity, Vyper, Rust or Move.
Ackee Blockchain in Prague audits Solana and EVM code with manual review and fuzzing, and reports 2,500+ issues across 220 audits. It maintains the open-source Wake framework.
- Platforms
- Web
- Company
- Ackee Blockchain a.s., Prague, Czech Republic
- Open source
- Yes, Wake under ISC license
- Pricing
- Not published; audits quoted through the contact form
- Chains
- Solana, Ethereum and EVM chains
Pros
- Covers both Solana (Rust) and EVM contracts
- 2,500+ issues found across 220 audits, per its site
- Maintains open-source Wake (Solidity) and Trident (Solana) tools
Cons
- Smaller audit count than the largest firms
- No published pricing
Skip it if you want a firm with a four-figure audit count.
CertiK, founded in 2017 and based in New York, states 5,500 clients served and offers formal verification next to manual audits.
- Platforms
- Web
- Launched
- 2017
- Company
- New York-based; founded by professors from Columbia and Yale
- Pricing
- Not published; free quote on request
- Free plan
- Skynet Score, leaderboards and Token Scan are free
Pros
- 5,500 clients served, per its homepage
- Offers formal verification as well as manual audits
- Skynet ratings are public for projects it covers
Cons
- No published audit pricing; quotes on request
- A Skynet listing is not the same as a full audit, so read the report itself
Skip it if you would treat its Skynet score as a substitute for reading the report.
Halborn states 4K+ assessments and 800+ clients, and adds web and cloud penetration testing and red teaming to contract audits. Reports are published on its site.
- Platforms
- Web
- Company
- Fully remote; founded by Rob Behnke and Steve Walbroehl; CEO Jacques Boschung; 800+ clients
- Pricing
- Not published; requests go through the contact form
- US availability
- Available: terms name no country restrictions
Pros
- Offers pentesting and red teaming, not only contract audits
- Publishes audit reports and vulnerability disclosures on its site
- 800+ clients and 4K+ assessments, per its homepage
Cons
- No published pricing
- Homepage does not state a founding year
Skip it if you only need a contract review; its range goes much wider.
Sherlock, founded in 2021, is a platform: it runs open audit contests, private collaborative audits and bug bounties, and states 1,500+ reviews with 11,000+ researchers.
- Platforms
- Web
- Launched
- 2021
- Company
- Audit contests, collaborative audits and bug bounties
- Pricing
- Quoted per scope; 25% deposit reserves an audit slot
- US availability
- Available: terms restrict only sanctioned jurisdictions
Pros
- Contests put hundreds of researchers on one codebase
- Covers audits and post-launch bug bounties in one place
- 1,500+ reviews completed, per its about page
Cons
- No published pricing
- Contest results depend on which researchers take part
Skip it if you want one named team accountable for the whole review.
Cantina is a platform whose onchain line pairs Spearbit's researchers with AI review and live bounties. Most of its site now covers general enterprise security.
- Platforms
- Web
- Company
- Agentic security platform; onchain audits by Spearbit researchers
- Pricing
- Not published; depends on codebase size, format and timeline
- US availability
- Available: terms restrict only sanctioned jurisdictions
Pros
- Onchain audits staffed by Spearbit researchers
- Runs bug bounties alongside audits
- 200+ companies secured, per its about page
Cons
- Most of the site now targets general enterprise security, not only web3
- No published pricing
Skip it if you want a web3-only firm.
Not on this list
Code4rena: Its site says it is winding down after five years and closing its doors.
ConsenSys Diligence: Its site returned 403 to our checks, so we could not confirm services first-hand.
Hacken: Its site returned 403 to our checks.
Smart Contract Audit Firms compared
Select a name to jump to its review.
| Name | Best for | US availability | Pricing |
|---|
| Trail of Bits | Complex protocols | Available: US firm with a New York, NY mailing address | Not published; engagements start through the contact form |
|---|
| OpenZeppelin | Solidity token and DeFi | — | Contracts library free; audit prices not published, audits start with a request form |
|---|
| Sigma Prime | Clients, L2s, validators | Not verified | Not published; audits are scoped through a request form |
|---|
| Ackee Blockchain | Rust and Solidity teams | Not verified | Not published; audits quoted through the contact form |
|---|
| CertiK | Fast, broad coverage | Available in the US | Not published; free quote on request |
|---|
| Halborn | Teams with web and cloud | Available: terms name no country restrictions | Not published; requests go through the contact form |
|---|
| Sherlock | Second pass before launch | Available: terms restrict only sanctioned jurisdictions | Quoted per scope; 25% deposit reserves an audit slot |
|---|
| Cantina | Hybrid audit plus bounty | Available: terms restrict only sanctioned jurisdictions | Not published; depends on codebase size, format and timeline |
|---|
“Not verified” means we could not confirm the value on the project’s own pages.
How we rank smart contract audit firms
- 01Public reports: whether the firm hosts past audit reports you can read before hiring.
- 02Audit volume: audit or project counts the firm states itself.
- 03Coverage: languages, chains and layers (contracts, clients, infrastructure) the firm lists.
- 04Model: staffed firm versus contest or bounty platform.
- 05Tooling: open-source tools the firm maintains and uses.
No project paid to be listed or ranked. Full rules: methodology.
What we did not test
- We did not open accounts, deposit money or place trades with these services.
- We did not audit smart contracts, reserves or security claims ourselves; we report what the project and its auditors publish.
- Fees, limits and availability change; the list date shows when we last checked them.
Rubric last updated Sep 26, 2026. Crypto assets are not insured by the FDIC or SIPC, and you can lose all the money you put in. This page is educational content, not financial advice.
How to choose
01Read two of their reports before you sign
Trail of Bits publishes on GitHub and Halborn on its site. Check that past reports cover code like yours.
02Match language to auditor
Sigma Prime lists Solidity, Vyper, Rust and Move. Ackee covers Solana Rust and EVM. A mismatch means you pay for ramp-up.
03Contest after audit, not instead
Sherlock contests put many researchers on one codebase. Most teams run one after a private audit to catch what the first pass missed.
04Budget: ask for a quote early
None of the eight publishes a price. Lead times matter as much as cost, so ask each firm for both.
Who should skip all of these
- Users checking if a token is safe: an audit covers a code snapshot, not the team or later upgrades.
- Teams wanting a public price list: every firm here quotes per project.
Bottom line
Pick an auditor whose public reports cover code like yours, then add a contest or bounty for a second pass.
No firm here publishes audit prices; get quotes and lead times from two or three.
Educational content, not financial advice. Crypto assets are volatile; do your own research.
FAQ
How much does a smart contract audit cost?
±
None of the eight firms here publishes a price. All quote per project based on code size and complexity.
Which audit firms publish their reports?
±
Trail of Bits hosts reports on GitHub (trailofbits/publications) and Halborn publishes reports on its site.
What is an audit contest?
±
A platform such as Sherlock opens your code to many independent researchers for a fixed period and pays for valid findings.
Is Code4rena still running?
±
Its site says it is winding down and closing, with active competitions seen through to completion.
Which auditors cover Solana?
±
Ackee Blockchain audits Solana and EVM code, and Sigma Prime lists Rust among its languages.
What changed in this list
2026-09-26First version: 8 audit firms and contest platforms, facts from each firm's own site.
Who made this page
✓
Fact check
Checked against 12 sourcesLast check: Sep 26, 2026
A value we could not confirm on the project’s own pages is marked “Not verified” instead of estimated.
How we review