Smart Contract Development
Ship secure, gas-efficient Solidity and EVM smart contracts built test-first and audit-ready—because deployed code is immutable and holds real funds, so the cheapest audit is the one you never need after an exploit.
NDA on request · Test-first engineering · Audit coordinated, not skipped
$5K–$300K+
Simple token to complex protocol
1.5:1–3:1
Testing-to-code ratio for money logic
Solidity · Rust
EVM and Solana coverage
Audit-ready
Coordinated review before deploy
Where founders get stuck
A bug in my contract could drain real funds.
We engineer against the common exploit classes—reentrancy, access-control failures, oracle manipulation, and unchecked external calls—and combine automated tools like Slither and Mythril with manual review and an independent audit before deploy.
I can't tell if a quote is honest or under-tested.
We break out code hours versus testing hours and target a 1.5:1 to 3:1 testing-to-code ratio for anything touching money, so you can see exactly where the security work is.
The audit always seems to be an afterthought.
We treat the audit as a separate, named line item from day one and write contracts to be audit-ready—never bundling it away to make a quote look cheaper.
I inherited contracts with unresolved audit findings.
We run remediation engagements: take the existing report, fix critical, high, and medium findings at root cause rather than patching symptoms, add tests, and prepare the code for re-audit.
I don't know which standard or chain to build on.
We help you choose Solidity on an EVM chain for maximum tooling and liquidity, or Rust on Solana for throughput, and pick the right token standard for your product instead of defaulting to a template.
What we build
ERC-20, ERC-721, ERC-1155, and custom standards built on audited OpenZeppelin foundations with the supply, minting, and permission logic your product actually needs.
Staking, vesting, governance, AMMs, lending, and reward math designed with careful invariant analysis to avoid the economic exploits that drain protocols.
Unit, fuzz, and invariant tests written alongside the code at a 1.5:1 to 3:1 testing-to-code ratio so money logic is exercised hard before it ever ships.
We prepare audit-ready code, manage the engagement with reputable firms, and handle the re-audit of fixes—because changes can introduce new bugs.
Root-cause fixes for findings in someone else's audit report, with new tests and a clean handoff for re-review instead of unreviewed patches.
Mathematical proof that critical invariants can't be broken for high-value bridges and institutional protocols where the trust bar is highest.
How we deliver
01
We map what the contracts must do, the value they'll hold, and the attack surface—then lock scope, a fixed quote, and an explicit audit line item.
02
We choose the language, token standards, and patterns (upgradeable vs immutable, access control, oracle design) before writing production code.
03
Contracts and their tests are written together with unit, fuzz, and invariant coverage so critical logic is validated as it's built, not after.
04
Static analysis with Slither and Mythril plus manual review catches reentrancy, access-control, and oracle issues before the external audit.
05
A reputable third-party firm reviews the code line-by-line and delivers a severity-graded report; we remediate findings at root cause.
06
Auditors review the fixes, we confirm fix status, and only then do we deploy and hand off with monitoring and admin-key guidance.
Pricing & timelines
Indicative ranges blended from current market data. Your fixed-scope quote is set after a short discovery call.
$5K–$15K
1–3 weeks
ERC-20, basic NFT, or straightforward token logic on an EVM chain, built test-first on audited libraries and ready for a light audit.
Best for: Token launches and simple on-chain assets.
$20K–$75K
4–10 weeks
Custom marketplaces, governance, staking, and vesting with thorough fuzz and invariant testing and a coordinated audit.
Best for: Products with real custom on-chain logic.
$75K–$300K+
3–6 months
Lending, AMMs, RWA rails, and bridges with deep invariant analysis, multiple audit cycles, and optional formal verification.
Best for: High-value DeFi and cross-chain systems.
The security audit is always a separate line item: simple token/NFT contracts audit at $5K–$15K, mid-complexity protocols $15K–$50K, and full DeFi protocols $50K–$150K+, with a re-audit of fixes adding 20–40% of the original fee. Formal verification adds roughly $20K–$50K. A practical baseline is 5–10% of development cost for security assessment; on production builds, coding plus auditing together often account for 50–65% of the budget. Final pricing is fixed after discovery.
The audit is a named line item in your proposal and the code is written to be audit-ready—we never exclude it to look cheaper.
We target a 1.5:1 to 3:1 testing-to-code ratio for money logic and show you code hours versus testing hours so the rigor is visible.
Remediation engagements fix critical findings at root cause, add tests, and prepare the code for clean re-audit.
We'll tell you when formal verification or a second audit is worth it—and when one reputable audit is enough.
FAQ
Simple token contracts run $5,000–$15,000, moderate-complexity contracts like custom marketplaces, governance, and staking $20,000–$75,000, and complex protocols like lending, AMMs, RWA rails, and bridges $75,000–$300,000+. The security audit is a separate line item and should never be excluded from a quote.
Solidity is the standard for Ethereum and all EVM chains including Polygon, BNB Chain, Arbitrum, and Base. Solana uses Rust, and some ecosystems use Vyper, Move, or Cairo. Most projects choosing maximum tooling and liquidity build in Solidity on an EVM chain.
Reentrancy, where an external call re-enters your contract before state updates, is among the most common, along with access-control failures from missing permission checks, oracle and price manipulation, integer issues, and unchecked external calls. Reputable development combines automated tools like Slither and Mythril with manual review to catch them.
It's the hours spent testing versus writing code. For anything touching money you want at least 1.5:1 to 3:1. A low ratio means under-tested code and higher exploit risk, so ask any development partner to break out code hours versus testing hours.
Yes. An audit is a systematic security review where experts examine contract code line-by-line for vulnerabilities, logic errors, and economic exploits before deployment. Because deployed contracts are immutable and hold real funds, an audit is essential—the most expensive audit is the one you need after an exploit.
Yes. After your team fixes findings, auditors must review the fixes, since changes can introduce new bugs. Most firms charge 20–40% of the original fee for re-review. Deploying a version the auditor hasn't reviewed defeats the purpose of the audit.
A practical starting point is 5–10% of your development cost for security assessment. For production projects, smart-contract coding plus auditing together often account for 50–65% of the total build budget. Cutting the audit isn't a saving—it's transferring risk to your users.
Yes. Remediation engagements take an existing audit report, fix the critical, high, and medium findings at root cause rather than as patches, add tests, and prepare the code for re-audit. This is common when a previous team or vendor left issues unresolved.
Formal verification mathematically proves that your contract's critical invariants can't be broken. It adds roughly $20,000–$50,000 and extra weeks. It's optional for simple tokens but effectively required for high-value bridges and institutional protocols where the bar for trust is highest.
Simple token and NFT contracts cost $5,000–$15,000, mid-complexity protocols like staking, vesting, and governance $15,000–$50,000, and full DeFi protocols like AMMs, lending, and cross-chain $50,000–$150,000+. Bridges and L1/ZK systems can reach $150,000–$500,000+, and a re-audit of fixes adds 20–40% of the original fee.
A proper audit delivers a findings report graded by severity (critical, high, medium, low, informational), a description and proof-of-concept for each issue, remediation recommendations, and a final report confirming fix status after re-review. Threat modeling and economic analysis may be separate line items.
Web3 security also covers front-end and wallet security, private key and MPC custody design, oracle integrity, access-control and admin-key management, monitoring and alerting for live contracts, and incident response. It's a continuous lifecycle, not a one-time checklist before launch.
Last updated: June 2026
Get a transparent, fixed-scope quote with a realistic timeline, security plan, and first-year cost breakdown—no obligation, senior engineer on the first call.