Choose a smart contract auditor on scope and evidence, not brand alone: confirm they will review every contract you deploy (token, vesting, staking, bridges, proxies), that reviewers have audited similar code on your chain, that the report ranks findings by severity and records which were fixed, that a fix review is included, and that the timeline finishes before you apply to exchanges. Exchanges such as Coinbase and Kraken ask for audit links in their listing applications, and reviewers look closely at privileged roles such as minting, pausing, and upgradeability.
Key takeaways
- Define scope by commit hash: every contract that will be live.
- Ask for similar past audits on your chain and contract type.
- Insist on severity ratings and fix status in the public report.
- Make sure a fix review is included in the price.
- Book early so the report is published before you apply to exchanges.
Auditor selection checklist
| Check | Why it matters |
|---|---|
| Scope lists every live contract and the commit hash | Exchanges review deployed code, not your repo’s latest branch |
| Reviewers have audited your chain and contract type | EVM, Solana, Move, and TON have different risks |
| Report ranks findings by severity and shows fix status | Reviewers want to see what was found and what changed |
| Fix review included | Unverified fixes leave findings open |
| Public report with a stable link | You’ll paste it into exchange forms and docs |
| Timeline ends before your exchange applications | A pending audit slows reviews |
| Clear on what is out of scope | Off-chain code, oracles, and admin key handling are often excluded |
Red flags
- A guaranteed “pass” or a promise of no findings.
- A report delivered in days for a complex protocol.
- No named reviewers and no public past reports.
- An audit bundled with “listing guarantees” or marketing packages.
After the audit
Publish the report, link it from your docs and exchange applications, and keep the deployed contracts verified on the block explorer. Record admin keys and multisig signers; see custody and wallet security. Then check the rest of your readiness with the listing readiness score.
Frequently asked questions
Which contracts need to be audited before a listing?
Everything that will be live and that holds or controls tokens: the token itself, vesting and treasury contracts, staking, bridges, and any proxy or admin contracts. Exchanges review privileged functions such as minting, pausing, blacklisting, and upgradeability.
Is one audit enough?
One thorough audit of the final code is the minimum. Larger or riskier protocols often use two firms, plus a bug bounty after launch. Any code change after the audit needs another review.
How do we compare audit quotes?
Compare scope (contracts and lines of code covered), the number and seniority of reviewers, the time allotted, whether a fix review is included, and whether the report will be public. A cheaper quote with half the scope is not cheaper.
Need an audit before your listing?
Tell us your chain, contracts, and listing date. If a vetted audit partner fits, we introduce you. Free for projects.
Get an auditor introductionFree for projects. CEX Ready may be paid a referral fee by partners. We never guarantee listings, prices, or volume.