Detailed Instructions

Begin by verifying the firm's legal registration and physical presence. Search for the firm's name on platforms like LinkedIn, GitHub, and security forums. Check for a history of public disclosures and contributions to open-source security tools. Review their client list for reputable projects, but be wary of firms that only audit low-risk or vanity projects.

• Sub-step 1: Search the firm's name alongside terms like "audit controversy" or "security failure" to uncover unreported issues.
• Sub-step 2: Check the firm's principal auditors on platforms like DeFiSafety for their individual reputation scores and public review history.
• Sub-step 3: Verify membership in industry bodies like the Blockchain Security Alliance or participation in events like ETHGlobal.

Tip: A firm with auditors who are active contributors to security tooling (e.g., Slither, Echidna) often has deeper technical expertise.

Detailed Instructions

Request and scrutinize the firm's formal methodology document. A robust process includes manual review, static analysis, dynamic analysis, and formal verification for critical components. The methodology should detail how they handle different contract types, such as upgradeable proxies or complex DeFi primitives.

• Sub-step 1: Ask for their standard testing checklist and compare it against industry frameworks like the Smart Contract Security Verification Standard (SCSVS).
• Sub-step 2: Inquire about their use of specific tools: Do they use Slither for static analysis, Foundry fuzzing for dynamic tests, or Certora for formal verification?
• Sub-step 3: Assess their approach to business logic flaws and economic attacks, which are often missed by automated tools.

solidityCopy
// Example: A firm should test for reentrancy beyond the standard check.
function vulnerableWithdraw() public {
    uint amount = balances[msg.sender];
    (bool success, ) = msg.sender.call{value: amount}(""); // Dynamic analysis should flag this.
    require(success);
    balances[msg.sender] = 0;
}

Tip: A methodology that includes threat modeling specific to your protocol's architecture indicates higher diligence.

Detailed Instructions

Examine at least two full, unredacted audit reports for projects similar in complexity to yours. The report should have a clear severity classification (e.g., Critical, High, Medium, Low) following a standard like OWASP Risk Rating. Each finding must include a technical description, code location, impact assessment, and a recommended fix.

• Sub-step 1: Check if the report includes test coverage metrics or proof-of-concept exploit code for critical vulnerabilities.
• Sub-step 2: Verify that the fix review section shows the auditor validated the client's remediation, not just accepted a promise.
• Sub-step 3: Look for false positive rate disclosure; a low rate indicates precise tool configuration and expert analysis.

Tip: A high-quality report will dedicate significant sections to systemic risks and architectural recommendations, not just a list of bugs.

Detailed Instructions

Request bios and relevant experience for the specific auditors who would be assigned to your project. Look for publicly verifiable expertise, such as CVE IDs, published research, or wins in prominent bug bounty programs. Specialization matters: an auditor experienced with Oracle manipulations may lack depth in NFT minting logic.

• Sub-step 1: Ask for examples of the most complex vulnerabilities (e.g., a price oracle manipulation, a governance attack) the proposed lead auditor has discovered.
• Sub-step 2: Check if the team has experience with the specific blockchain and framework (e.g., Solana's Anchor, Starknet's Cairo) your project uses.
• Sub-step 3: Inquire about their process for knowledge transfer when novel, complex financial mechanisms are involved.

Tip: Prefer firms where senior auditors actively perform hands-on review work, rather than just managing junior staff.

Detailed Instructions

Carefully review the scope of work, deliverables timeline, and limitation of liability clauses. The contract should clearly define what is included (e.g., main contracts, dependencies) and excluded (e.g., front-end, off-chain components). A fixed-price engagement with clear milestones is generally preferable to open-ended hourly billing.

• Sub-step 1: Ensure the agreement includes provisions for re-audit of fixed issues without significant additional cost.
• Sub-step 2: Verify the confidentiality terms protect your code but allow the firm to list your project as a client upon report publication.
• Sub-step 3: Assess the liability cap; while often limited, it should be commensurate with the audit fee and project size.

Tip: Negotiate for the right to make the final report public. Transparency is a key signal of audit quality to your community.