Smart contract audit and security in Corsica
A smart contract audit is a methodical review of a blockchain contract's code to find vulnerabilities, logic errors and risks before they become expensive. From Bastia, we analyse your Solidity contracts, hand you a clear report that ranks each issue by severity, then check your fixes.
What is a smart contract audit?
A smart contract often manages rights, approvals or assets, and its code cannot simply be patched once deployed. A mistake is therefore both visible to everyone and hard to put right. The audit is there to find it first.
In practice, an audit combines automated analysis tools, which flag known dangerous code patterns, with a manual line-by-line review that checks the contract does exactly what it should, and nothing more. The result is an audit report: a document describing each issue found, its severity and the recommended fix.
Smart contract security is not limited to technical flaws. Admin rights, external dependencies and consistency with your business rules receive the same attention.
When should you commission a smart contract audit?
- 01
Before going live
This is when an audit is most useful: fixes are still simple and nothing is exposed.
- 02
Before an upgrade
A new version, however minor, can introduce a flaw into previously sound code.
- 03
Before relying on a third-party contract
You are integrating a partner's contract and want to know what it really allows.
- 04
When accepting delivered work
You commissioned a contract from a supplier and want an independent view before signing it off.
- 05
After unexpected behaviour
An unexpected transaction has occurred and you want to understand its cause so that it does not happen again.
Smart contract security: who needs it?
- 01
Startups
Before a launch or a presentation to partners, an audit report shows that security has been taken seriously.
- 02
Businesses and supply chains
For traceability or certification contracts, the audit checks that only authorised participants can write and that records cannot be falsified.
- 03
Public bodies
To validate work commissioned from a supplier before it goes into service, and to make sure it meets the specification.
- 04
Development teams
To get a second pair of eyes on code they know too well to spot its blind spots.
How a smart contract audit unfolds
The audit covers a frozen version of the code and can be carried out entirely remotely: we work from Haute-Corse with teams in Corsica and elsewhere.
- 01
Scope
Together we fix the exact version of the code to audit, the contracts included and excluded, and the documentation available.
- 02
Understand
We read the specifications and talk to the team to understand precisely what the contract is meant to do.
- 03
Analyse
Automated analysis, manual review and additional tests on the main families of known vulnerabilities, such as access control flaws or logic errors, drawing on public references like the OWASP Smart Contract Top 10.
- 04
Report
Writing the report and presenting the results, with explanations that non-specialists can follow.
- 05
Verify
Once you have made your fixes, we review the changes and update the report with the status of each point.
The audit report and what happens next
The report opens with a summary for management: scope, method, number of issues by severity and an overall conclusion. It then details each finding: description, the risk explained simply, its location in the code and the recommended fix.
After the fixes, the final report states for each point whether it is fixed, mitigated or accepted by your team in full knowledge of the risk. You are free to share it with your partners.
Afterwards, we can help with deployment, check that the code published on the blockchain matches the audited version, and audit future changes.
The limits of an audit and what to check
- 01
No absolute guarantee
An audit greatly reduces risk but cannot prove that no vulnerability exists. Be wary of anyone who promises otherwise.
- 02
A frozen version
The audit applies to the code reviewed. Any later change needs reviewing too.
- 03
The code actually deployed
Check that the published contract matches the audited version; publishing verified source code lets anyone confirm it.
- 04
Admin privileges
A technically sound contract can still be risky if a single key can change everything. The audit should address this.
- 05
Existing tests
Well-tested, well-documented code can be audited more efficiently and in greater depth.
What drives the cost of a smart contract audit
The quote is prepared after an initial look at the code to be audited. It depends mainly on the following.
- 01
Size of the code
The number of contracts and lines, excluding well-established standard libraries.
- 02
Complexity
Business logic, interactions between contracts, calculations, upgrade mechanisms.
- 03
External dependencies
Oracles, third-party contracts and bridges between networks require specific analysis.
- 04
Documentation and tests
The more complete they are, the more effective the audit.
- 05
Post-fix reviews
One or more reviews, depending on the volume of changes.
Technologies and methods
- Solidity
- EVM
- Static analysis
- Manual code review
- Automated testing
- OWASP Smart Contract Top 10
Frequently asked questions
Can you audit a contract built by another supplier?
Yes, and an independent view is precisely one of the benefits of an audit. We need the source code, the available documentation and, if possible, the existing tests.
What if the audit finds a flaw in a contract that is already deployed?
It all depends on what the code allows: a pause function built into the contract, migration to a new version, tighter admin rights or closer monitoring. We set out the possible options and their consequences.
Which contracts do you audit?
Contracts written in Solidity for the EVM, in other words for Ethereum and the many compatible networks.
Is the audit report public?
That is your decision. The report belongs to you: you can keep it confidential or publish it to build trust with your users and partners.
Does an audit replace automated testing?
No. Tests continuously check that the code does what it should; an audit brings a critical eye at a given moment. The two complement each other, and we can help you strengthen your tests if needed.