Smart Contract Security Audits

Certora provides comprehensive smart contract security audits that combine manual code review with formal verification, offering the highest security coverage available in the Web3 industry. Unlike traditional audits that rely solely on manual review, Certora's audits incorporate mathematical verification to ensure that code properties hold true under all possible conditions.

Audit Process

Certora's audit process consists of four main phases:

Scope and Timeline Determination

Clients share their code to determine complexity, required effort, and timeline. The audit team reviews the codebase architecture and identifies key security properties to verify.

Specification Writing

A dedicated team of formal verification experts crafts custom CVL rules that define how the code should behave. These specifications encode security properties, invariants, and expected behaviors that must hold true.

Code Review and Verification

Security researchers perform deep manual auditing while simultaneously running formal specifications against the contract bytecode using Certora Prover. This dual approach catches both obvious vulnerabilities and subtle logic errors that emerge from complex state interactions.

Report and Deliverables

Clients receive a detailed report documenting all identified vulnerabilities with severity ratings, remediation recommendations, and the formal specifications written during the audit. Critically, clients keep these specifications to run on future code changes, enabling continuous security verification.

What Makes Certora Audits Different

Certora pioneered the use of formal verification in DeFi security, offering coverage that goes far beyond traditional auditing. While manual audits might test hundreds or thousands of scenarios, formal verification mathematically proves correctness across all possible scenarios. This means Certora can provide guarantees that certain classes of vulnerabilities simply cannot exist in the verified code.

The audit team includes leading experts in formal methods, many with PhDs from top universities, who have taught and researched verification techniques before entering the blockchain space. Approximately 20% of Certora's employees hold PhDs in formal verification methods. This deep academic background enables Certora to tackle the most complex verification challenges in DeFi.

Another key differentiator is the ability to re-run specifications when code changes. After an audit, clients can integrate the custom rules into their CI/CD pipeline or engage Certora on a retainer to continuously verify code as it evolves. This continuous security model is far superior to point-in-time audits that become outdated as soon as code changes.

Track Record

Certora has completed approximately 150 audits for leading protocols including Aave (multiple audits), Uniswap V4, Lido Dual Governance, EigenLayer Protocol, Kamino Lending, Safe Mobile, Maker, Compound, Balancer, and dozens of others across both Ethereum and Solana ecosystems. The company has prevented over 720 vulnerabilities from reaching production, with a 99% fix rate on identified issues. Certora secures over $196.5 billion in total value locked across these protocols. Featured audit reports are publicly available on Certora's website, demonstrating the depth and rigor of their work.

Community Audit Contests

Certora also runs formal verification audit contests in partnership with leading platforms like Code4rena, engaging the broader security research community to crowdsource formal specifications and vulnerability discovery. These contests provide protocols with an additional security layer beyond traditional audits while offering security researchers the opportunity to earn rewards by finding bugs and writing high-quality formal specifications.

Contests engage dozens of security researchers with diverse backgrounds and approaches, providing broader coverage than a single audit team could achieve. Protocols receive a collection of high-quality CVL specifications from multiple researchers, offering different perspectives on critical properties to verify. Certora has distributed over $800,000 in contest rewards across competitions for major protocols including Aave, Uniswap V4, Euler V2, GMX, and Lido Finance.