Smart contracts (up to 1,500 lines)

Smart contract audit

Your contract holds funds, and on a blockchain a transaction cannot be undone: if it has a flaw, the money leaves and does not come back. We audit it before you publish and once it is live, so you go to production knowing what can break.

Security audit of Solidity contracts on EVM networks (Ethereum, Polygon, BNB Chain and compatible). We cover the full cycle: pre-deployment review and validation of the live contract with fork testing against a copy of the chain’s real state. We look for exploitable vectors, not just tool alerts.

Duration: 2 weeks
Start: Coordinated with your launch or update

from US$4,900

Buy it on its own or add it to an audit. Retests: added to an audit, the same as that audit; on its own, 3 months at no charge. The price is a starting point: it covers up to 1,500 lines of Solidity, not counting comments or blanks. More lines or several contracts, a fixed price agreed before signing.

Audit my contract

Publishing or updating the contract soon? Write to us and we review it before it goes out.

It is for you if

You are about to launch a contract on Ethereum, Polygon, BNB Chain or another EVM network.
You already have a live contract and want an independent review before an upgrade.
An investor, an exchange or a partner asks you for an audit before moving on.

What we check

Who can mint, pause, withdraw funds or upgrade the contract.Access control: missing modifiers, exposed initialization functions, delegatecall to untrusted addresses and admin roles.

The money logic: deposits, withdrawals and fees.Reentrancy (single-function, cross-function, cross-contract and read-only), balance accounting, rounding errors and integer truncation.

What your contract depends on: price oracles and other protocols.Oracle manipulation: single-block spot price without TWAP, multi-source aggregation, bridges and replaceable contracts.

That the numbers add up: balances matching supply and collateral staying sufficient.System invariants: supply-to-balance consistency, collateralization ratios, ERC-4626 inflation, fee-on-transfer tokens and governance limits.

The flaws already known in the ecosystem, so you do not fall into the same ones.Verification against the SWC Registry and the OWASP smart contract security guidance.

How we work

Week 0
Scope
You send us the code and the networks it runs on. We confirm the 1,500-line limit, not counting comments or blanks.
Inventory of contracts, networks and external dependencies, nSLOC count and the signed authorization for the audit.
Week 1
Analysis
We read the code by hand and cross-check it with tools. If we find something serious, we tell you the same day.
Static analysis (Slither, Aderyn, Solhint), symbolic execution (Mythril), fuzzing and invariants (Foundry, Echidna, Medusa) and formal verification when the scope calls for it (Halmos, Certora Prover).
Week 2
Testing and report
We prove every serious flaw with a real test and a second Lop reviews everything before we hand you the report.
For live contracts, fork testing: we replicate the chain state in a local environment and simulate the attacks there, never on the real network. Reproducible Foundry proof of concept for critical and high findings, review by a second Lop, technical and executive reports, wrap-up meeting.

What you get

The findings ordered by severity, with proof that each one can be exploited.
Severity by impact and likelihood of exploitation (critical, high, medium, low, informational), with the affected code, the vector and a Foundry proof of concept for critical and high findings.
How to fix each finding, in order of priority.
Mitigation recommendation per finding, prioritized by impact and effort.
A full technical report and an executive summary for whoever signs.
Technical report with the detail, proof of concept and fix; executive report with the economic and legal impact.
Every fix tested again.
Retest on the corrected version; terms depend on how it is bought.

Scope limits

Includes

Up to 1,500 lines of Solidity on EVM networks.Up to 1,500 nSLOC (excluding comments and blanks), Solidity on Ethereum, Polygon, BNB Chain and EVM-compatible networks.
Review before publishing and of already deployed contracts.Live contracts are validated with fork testing on a local copy of the state, never on the real network.

Does not include

We do not write the fixes in your code: Lop Fix can do that.No remediation; available with Lop Fix.
We do not review what is off-chain: servers, private keys or the frontend.No off-chain infrastructure audit; the dapp and its backend are covered by a web audit.
We do not review contracts in Vyper, Yul or Cairo.Solidity only; other languages are quoted separately.

More than 1,500 lines or several contracts? We give you a fixed price before signing.

Questions before you buy

Why audit if I already use automated tools?

Tools flag patterns, but they do not understand your business logic or chain small flaws together. A Lop confirms every finding by hand and discards false positives.

Can fork testing affect the real network?

No. The fork is a local copy of the state at one block. Everything runs on a local node and we do not sign any transaction against the real network.

Does the report include a proof of concept?

Yes. For critical and high findings we deliver a reproducible Foundry proof that shows the flaw can be exploited, not just that it exists.

What if my contract has more than 1,500 lines?

We quote the excess before signing, with the same methodology and the same tools.

Does your contract hold your users’ money?

In 2 weeks we audit it, before publishing or already deployed, with a proof of concept for every serious flaw.