A smart contract audit is an independent security review of a project’s on-chain code, producing a report of vulnerabilities ranked by severity and whether the team fixed them. Exchanges ask for audit links in their listing applications (Coinbase and Kraken both mention third-party audits), and they review contract risks such as privileged roles and minting. Audit scope, not the auditor’s brand alone, determines how much assurance you get.
Key takeaways
- Coinbase’s listing guide asks for any third-party audits; Kraken asks for security audit links.
- Exchanges and aggregators look closely at privileged functions: minting, pausing, blacklists, upgradeability, and who holds the keys.
- An audit covers a specific commit. Any later change to the code needs review again.
- Publish the full report, including findings and fix status, and link it from your docs.
What an audit covers
- Access control: who can mint, pause, upgrade, blacklist, or change fees, and how those keys are held.
- Logic errors that let funds be drained, locked, or mis-accounted.
- Economic and oracle risks in DeFi protocols.
- Upgradeability: proxy patterns, initialization, and storage collisions.
- Integration risk with the DEXs, bridges, and exchanges the token will touch.
The report should list each finding with severity, the team’s response, and whether a re-check confirmed the fix.
What drives the cost and timeline
- Lines of code and number of contracts in scope
- Novel logic versus standard, well-tested patterns
- Number of review rounds and the fix-verification pass
- The auditor’s availability
No reputable auditor can quote properly without seeing the code and scope.
How to choose an auditor
- Read their public reports on protocols similar to yours.
- Ask who will actually review the code and how many reviewers.
- Confirm the commit hash in scope and that the deployed bytecode will match.
- Make sure the report is publishable in full.
- Be wary of “audit badges” sold cheaply without a substantive report.
After the audit
Verify the deployed contract matches the audited commit, publish the report, move privileged roles to a multisig or timelock, and document everything for exchange and aggregator reviewers.
Frequently asked questions
Do exchanges require a smart contract audit?
Most do not publish a hard rule, but audits appear in the information several exchanges ask for, and technical security review is part of their process. Coinbase lists audits among the materials in its application and runs its own technical security review. Treat an audit as expected for any serious listing.
How long does an audit take?
It depends on the size and complexity of the code and the auditor’s queue. A simple token contract is much faster to review than a DeFi protocol with many contracts. Book early; popular auditors often schedule weeks ahead.
What is the difference between an audit and a bug bounty?
An audit is a time-boxed review by a contracted team. A bug bounty is an ongoing public reward for anyone who finds vulnerabilities. Mature projects use both.
Does a simple ERC-20 or SPL token need an audit?
Standard, unmodified token implementations carry less risk, but custom features (taxes, blacklists, minting, upgradeable proxies, vesting contracts) are exactly what reviewers check. An audit or at least a review of the deployed configuration is still worth having before a listing.
Sources
Last reviewed 11 November 2026. Exchange and platform policies change; always confirm on the official page before acting.
Need a market maker or listing help?
Tell us about the project: chain, venues, timing, and which services you need. If there is a fit, we introduce you to a partner who covers it. Free for projects.
Request an introductionDisclosure: CEX Ready may be paid by partners for introductions. We never guarantee listings, prices, or volume.