What a smart contract audit covers, and what it never covers

A smart contract audit is a review of a specific set of contract files, at a specific commit, against a specific threat model, conducted once. It tells a reader that named code was checked for known categories of bug at that moment. It does not tell a reader that the protocol is safe to use today, because deployment, governance, key custody, and everything outside the named code sit outside that review by design.

What is actually inside the review

TokenToolHub’s guide to the process describes scope in five layers: contract code, architecture (how proxies, modules and factories fit together), permissions (who can upgrade, pause, mint or rescue funds), named integrations (oracles, bridges, external tokens), and, sometimes, deployment operations such as timelocks and multisig setup. Coin98’s guide applies that same layering to lay out, in table form, what typically sits on the other side of the line — the pieces an audit report does not claim to have checked.

TokenToolHub puts the underlying point bluntly: a report that names what it did not examine is more useful than one that implies it examined everything, writing that “scope also needs honest out-of-scope boundaries.”

How the review actually runs

Blockchain Council’s July 2026 process guide breaks a serious engagement into stages: scope definition and documentation review, code freeze, automated analysis using tools such as Slither, Mythril and Echidna, manual line-by-line review, fuzzing and invariant testing, proof-of-concept construction for each finding, and severity classification — typically critical, high, medium, low and informational. Coin98’s guide, citing TokenToolHub’s audit guide, frames the same work as four stages: scoping, review, findings and remediation, where fixes are made and retested. Blockchain Council specifies that the final report should mark each issue as fixed, acknowledged, partially fixed or unresolved. On the limits of the automated layer, Blockchain Council writes: “They usually do not know whether a reward formula can be gamed, whether an oracle can be manipulated in a single block, or whether governance can be captured through a strange voting sequence.” That judgment is left to the manual reviewer.

A worked example: Euler and the gap between code and design

Euler Finance had received ten audits from six firms — Halborn, Solidified, ZK Labs, Certora, Sherlock and Omnisica — before it suffered a flash-loan attack on March 13, 2023, according to AnChain.AI, which put the loss at $196 million. Olympix, describing the same incident, gives the figure as $197 million. Both figures come from the evidence reviewed for this page and neither can be reconciled here; the discrepancy is itself worth noting when a single-incident number gets repeated as fact. Euler’s CEO, Michael Bentley, described the episode as among the “hardest days” of his life, according to AnChain.AI’s account. The technical point both outlets make is the same: the exploit ran through donation, liquidation and collateral-accounting logic that behaved exactly as coded. The vulnerability sat in the economic design, not in a line of broken syntax — the category of failure audits are least built to catch, per Olympix’s analysis.

What the loss data actually says, and why it does not agree

Ask what share of stolen crypto an audit would have caught, and the sources here give four different answers, from four different datasets:

• AnChain.AI, analysing 2022 incidents in a post published June 15, 2023, found $2.81 billion lost to smart-contract compromises, with 91.96% of the hacked contracts having been audited at least once.
• Hacken’s Q2 2026 report, as cited by Coin98, attributes 88.3% of $763.9 million in Q2 2026 losses to operational and key compromises, with smart-contract bugs — the category audits target — accounting for roughly 11%.
• SigIntZero’s Software Security Report, published February 2026, examined the 100 largest breaches from 2014 to 2024, totalling $10.77 billion, and found audited applications accounted for 10.8% of exploit losses, while only 20% of exploited applications had ever been professionally audited.
• CORE3’s analysis of roughly $10 billion extracted from Web3 across 2023–2025, cited by Coin98, concluded that no audit was scoped to check the way roughly 75% of that capital was drained — because it left through a layer, such as a bridge dependency or a signer’s compromised key, that no audit in scope claimed to cover.

These numbers use different years, different loss datasets and different definitions of what counts as “audited.” They are not four measurements of the same thing, and no single figure from this list should be quoted as the industry rate. The consistent thread across all four, and across CORE3’s separate finding, is that audits are being asked to certify a much larger claim than a scoped code review can support — a boundary CORE3 states directly, saying an audit was never designed to cover most of the ways a protocol actually fails.

Three named incidents from April 2026, cited by Coin98, illustrate where the money actually went: Kelp DAO lost $292M through a bridge dependency and verification configuration; Drift Protocol lost $285M through social engineering of multisig signers; CoW Swap lost roughly $1.2M through a DNS and registrar compromise that served a counterfeit interface. None of these sits inside the scope layers described above.

Scope depth also varies more than the word “audited” suggests. CORE3’s review of 293 audited projects, per Coin98, found comprehensive scope in only 21% of them; 43% were partial and 35% minimal. Within that same sample, 67% ran no active bug bounty program, 42% showed stalled activity on GitHub, 53% carried no published risk disclaimer, and every project in the sample had at least one weak off-chain domain, per Coin98’s account of CORE3’s findings. Separately, Cysic founder Leo Fan described the boundary of a report as covering code “at a particular point in time,” according to Hacken’s Q2 2026 coverage as relayed by Coin98 — it does not extend to how the code is operated afterward.

The common vulnerability classes an audit is built to find

Where audits are strong is in known bug classes. SpaceDev, citing the OWASP Smart Contract Top 10 for 2026, ranks access control issues, business logic bugs, price oracle manipulation, flash loan attacks, input validation gaps, unchecked external calls, arithmetic and rounding errors, reentrancy, integer overflow, and proxy or upgradeability flaws as the categories built from 2025 incident data. Manual review — tracing state changes, checking role permissions, testing initialization on upgradeable proxies — is where these are caught, per Blockchain Council’s description of the process.

How to read a report

Coin98’s guide condenses this into a practical check: read the scope section before anything else; find the actual report rather than a badge image; match the commit hash named in the report to the address actually deployed; check the date against the protocol’s changelog, since an audit predating the last upgrades describes the protocol as it was, not as it is; and look at how unresolved findings were marked — acknowledged, fixed, or left open.

What this page does not tell you

Every source behind this page is a security vendor’s blog, a marketing-adjacent guide, or a secondary aggregator. None is an audit firm’s own methodology document, a court record, or a regulatory filing, so this page describes how the security industry talks about audit scope, not a verified external standard. Several figures — the Hacken, CORE3 and SigIntZero numbers cited above — reach this desk only through Coin98’s citation of those reports, not from the reports themselves, which adds a second hop of attribution this page is flagging rather than treating as independently confirmed. The loss-attribution range given here, from roughly 11% to 91.96%, cannot be reconciled from the evidence collected; it spans different years, different loss datasets and different definitions of “audited,” and no single number in that range should be read as the industry figure. AnChain.AI’s 2022 dataset was described in its own post as available “upon request” rather than published in full, so it has not been independently checked. This page also cannot tell a reader whether any specific protocol’s own audit was comprehensive or superficial — that requires reading that protocol’s actual report and its scope section, which sits outside what any source reviewed here supplies for a named project.

Sources

Every fact above is attributed to one of these reports. Where they disagree, the article says so.

• TheCoinrise reference desk
• TheCoinrise reference desk
• TheCoinrise reference desk
• TheCoinrise reference desk
• TheCoinrise reference desk
• TheCoinrise reference desk
• TheCoinrise reference desk