Definition
An independent security review of a program at a specific commit, usually by a specialised firm, that reports vulnerabilities and recommendations before launch. It reduces risk but does not guarantee security.
Why it matters
An audit is the main independent check before users deposit funds, and partners, exchanges and investors often ask for the report. Its value depends on the scope, the auditors’ Solana experience, and whether findings are fixed and re-checked.
What to check
- Ask for the exact scope and commit, the number of engineer-days, and whether a fix review is included.
- Ask for previous public reports on Solana programs similar to yours.
Related terms
- Bug bountyA public program that pays security researchers for responsibly reporting vulnerabilities in deployed code.
- Verifiable buildA reproducible build that lets anyone confirm the program deployed on-chain was compiled from a specific public commit of its source code.
- Upgrade authorityThe key allowed to replace a deployed program’s code.
- MultisigA wallet that requires approval from several signers before executing a transaction.
Guides
- How to choose a Solana smart contract auditor: a practical checklistWhat actually matters when picking a Solana auditor: Anchor and native Rust experience, methodology, scope, timelines, red flags in quotes and what a good report looks like.
- Smart contract audit vs bug bounty: which do you need, and when?Audits and bug bounties catch different bugs at different times. How each works on Solana, what they cost, and how to combine them before and after mainnet launch.
- Solana pre-launch security checklist: 15 checks before mainnetA practical checklist for launching a Solana program on mainnet: upgrade authority, multisig, verifiable builds, token authorities, monitoring, incident response and the audit.
Get an indicative price range and timeline for auditing your Solana programs, then compare verified auditors.
Estimate your audit cost →