Smart contract audit
Manual line by line review with proof of concept exploits, a public report and a free fix review round.
Auditing contracts since 2018
Find it before someone else finds it
Manual smart contract review by engineers who have written protocols, not just read them. Every finding comes with a proof of concept exploit and a fix we will review for free.
290audits completed
7 yrsreviewing contracts
41critical findings in 2025
Publicreports by default
Engagements
Audits, engineering and watching it after launch
Audit pricing is quoted from the code, not from a rate card, after a free scoping call.
Rapid pre launch review
Five business day focused review of a limited diff or a single contract before a deadline.
Protocol engineering
We write and test the contracts, with full Foundry test suites and invariant fuzzing delivered.
On chain monitoring
Alerting on anomalous transfers, admin key use, oracle deviation and pause conditions, routed to your on call.
Incident response retainer
Guaranteed engineer on a call within one hour, any hour, with a pre agreed triage playbook.
Formal verification
Machine checked proofs of critical invariants for contracts where a manual review is not sufficient assurance.
About Ledgerline
Engineers who ship protocols, reviewing protocols
Ledgerline was founded in 2018 by three engineers who had shipped and maintained lending and AMM contracts and had watched competent teams lose funds to bugs a careful reader would have caught. We publish our reports by default, including the ones where we found serious issues, because a report nobody can read is marketing.
•Every finding ships with a working proof of concept, not a theoretical concern
•Reports published publicly by default, with client consent on timing
•One free fix review round included, we check that the patch actually closes it
Reviews
From protocol teams
“They found a rounding issue in our share accounting that three prior reviews missed, and handed us a test that drained the vault. We shipped the fix before launch.”
Ana T., Lead engineer, lending protocol
“The report was readable by our non technical board, which sounds trivial and absolutely is not.”
Marcus L., COO, enterprise chain project
“We had an oracle deviation at three in the morning. Their monitoring caught it and an engineer was on the call in under twenty minutes.”
Jae P., Protocol operations
FAQ
Scope, cost and what an audit does not do
How is audit cost determined?
By the code, specifically the lines of Solidity in scope, the complexity of the economic design and how much external protocol interaction there is. We do a free scoping call, look at the repository, and give a fixed price and a start date. Most protocol audits land between 28,000 and 120,000 dollars.
Does an audit mean the contracts are safe?
No, and any firm that tells you otherwise is selling something. An audit is a time boxed expert review that dramatically reduces risk, it is not a proof of correctness. That is why we push monitoring, a bug bounty and formal verification for the highest value invariants as layers on top, and why our reports state exactly what was and was not in scope.
How long does an audit take?
Typical protocol audits run two to four weeks of review followed by a week for the report and your fixes. Rapid pre launch reviews are five business days for a limited scope. We are usually booking three to six weeks out, so start the scoping conversation earlier than feels necessary.
Will the report be public?
By default yes, and we think you want that, because a public report from a firm that publishes its failures is worth more to your users than a private PDF. You control the publication date, typically after fixes are deployed. If a finding cannot be safely disclosed we coordinate timing with you rather than publishing on a schedule.
Contact
Get on the audit calendar
Send a repository link and your target launch date. The scoping call is free and takes about thirty minutes.
Phone(512) 555-0139
Address600 Congress Ave, Suite 1400, Austin, Texas
HoursMon to Fri 9am to 6pm CT, incident response 24/7
AreaGlobal, remote engagements