How to Read a DeFi Audit Before Depositing: A 10-Minute No-Code Checklist

I once treated the “Audited by…” badge like an airbag: proof someone had engineered for my safety, so I could stop thinking. Then I read a report properly. The logo was real. It covered three contracts. The pool I deposited into was the fourth.

An audit is not a warranty. It is a photograph of named code on a named commit, taken by humans on a deadline, attached to a list of things they were explicitly not asked to examine. This is the no-code routine I run before any deposit bigger than what I would shrug off losing: just which pages of a PDF matter and what to cross-check them against.

First, what an audit actually is

The ethereum.org smart-contract security docs put it plainly: audits do not prove bugs are absent and say nothing about economic viability. A firm is paid a fixed fee for fixed person-weeks, examines an agreed file list, and reports what it finds — it is not on the hook when you deposit afterward. Three limits matter:

• Snapshot. Code at one commit hash. Any upgrade deployed afterward is new, unreviewed code.
• Boundary. Only in-scope files were examined; third-party libraries, frontends, relayers, oracles, cross-chain messaging and governance keys are commonly excluded.
• Humans. Auditors miss bugs, code drifts after they leave, and one team sees a fraction of what dozens of competitive researchers would find.

The evidence behind this mindset got precise in 2026. A study from researchers affiliated with security firm ack3 and the Czech Technical University in Prague graded 135 verified DeFi incidents from January 1 through June 29, 2026 — $939.86M in attributed losses. Sixty-eight victims had identifiable public pre-incident audits; in 46 of them the exploited path sat outside every scope the researchers could identify: $680.97M of the $721.24M lost by audited protocols, or 94.4%. That does not mean audits fail 94% of the time. KelpDAO (~$292M) and Drift Protocol (~$285M) dominate the sum; excluding those two outliers, the outside-scope share is 72.1%. The authors had no unexploited control group and judged scope from public evidence, so this describes how reported losses distributed, not whether audits cause safety. The honest takeaway: “was it audited?” and “was the thing holding my money audited?” are different questions.

Minutes 0–2: Find the real report on the auditor’s own site

Protocol websites have a way of hosting PDFs that vanish after an incident, or showing a logo that links nowhere. I never trust the copy linked from a protocol’s docs — I open the auditor’s own site and find it in their publications list. Trail of Bits maintains a public publications registry cataloging years of reports, and most reputable firms do something similar. If it is not on the auditor’s own domain, I assume it does not exist until the team shares the exact URL. I also check client and date — rebranded projects reuse audit pages.

Minutes 2–4: Match chain, address and commit hash

Every legitimate report names its scope: files, commit hashes and usually deployed addresses per chain. I copy the address my deposit actually touches from the protocol’s official docs and check three things:

• Same chain? An Ethereum mainnet review says nothing about a BNB Chain or Sui deployment of the same codebase.
• Same address? Compare the live contract on the explorer with the addresses in the report appendix.
• Same commit? For proxies, check which implementation is live now and whether post-audit upgrades got a follow-up review.

An old audit on a proxy whose implementation was swapped last month is history, not protection.

Minutes 4–6: Read the exclusions — the most important page

Every scope section lists what was out of scope, and that list is usually more informative than the findings. Familiar exclusions: third-party libraries and dependencies, upgrade and admin keys, oracle infrastructure, cross-chain messaging, the frontend, off-chain keepers and relayers, and anything marked “previously audited” (this team did not re-check it). When the riskiest dependency is excluded I do not automatically walk away — I treat it as unaudited and find who else reviewed it, under what scope, and when.

Minutes 6–8: Decode severities and finding statuses

Severity labels are roughly standardized; each means something specific at deposit time:

Counts lie: a report advertised as “zero criticals found” can contain six Highs merely acknowledged. The resolution status on each finding is what I read:

• Fixed — patched, usually mapped to a commit and sometimes re-tested. The only status that comforts me.
• Partially fixed — a narrow patch landed. Ask whether the residual path can touch funds.
• Acknowledged — the team accepts the risk. Someone decided this trade-off is acceptable with your money; read their reasoning.
• Won’t fix — an explicit rejection. A red flag on anything above Informational.

Audit vs contest vs bug bounty — three different assurances

Protocols love stacking these logos, but they are not interchangeable:

The trap: bounty programs publish exclusions too. When Ostium reported a ~$23.75M USDC loss in July 2026, the attack ran through price-reporting machinery its own program told researchers not to test. A big maximum payout does not cover what the rules forbid.

Four incidents that explain the scope gap

Three of four have nothing a line-by-line review could catch, and Cetus shows even “code” losses hide in dependency code — why I spend half these ten minutes off the PDF.

Minutes 8–9: Check the powers around the code

• Proxy and upgradeability. Behind a proxy, someone can replace reviewed code tomorrow. Find the upgrader address and judge it.
• Admin and multisig. A single EOA admin means run. For a multisig, count signers, threshold and who the signers are: under four signers with a low threshold is centralized control with extra steps.
• Timelock. Privileged actions — upgrades, pauses, fee changes, minting — should pass through a visible multi-day timelock so users can exit first. Zero-delay admin rights mean the gate is always open.
• Pause and rescue. A pause button protects you and can trap you: check if it is global, who holds it, and whether withdrawals can be selectively blocked.
• Oracles. Which feeds, how many sources, and is there a deviation circuit breaker? Centrally signed or thin feeds keep blowing up — see my guide to oracle manipulation attacks.
• Bridges and cross-chain design. Check verifier thresholds (KelpDAO’s default 1-of-1 was the whole problem), wrapped-asset versions and canonical messaging. My cross-chain bridge safety guide has the full checklist.

Mature protocols make this leg easy: governance on Aave and Morpho is documented, on-chain and stress-tested — but I still check, because “blue chip” is a habit, not a logo property.

Minutes 9–10: Sanity-check the human layer

Frontends get compromised, Discord moderators get impersonated, and token approvals sit in your wallet forever. I confirm the domain from official channels, revoke stale approvals with Revoke.cash after exiting, and keep meaningful funds on a hardware wallet that signs on-device — a poisoned page cannot quietly rewrite what you approve, as Bybit’s signers discovered in that Safe interface. The full routine is in the DeFi wallet security checklist, and yields with no credible explanation are cataloged in the guide to DeFi yield traps and red flags.

The condensed ten-minute checklist

When any line fails, the response is a smaller position, a shorter holding period, or no deposit: I size to the weakest check, never the prettiest APY.

Sources and further reading

• ethereum.org — Smart contract security — what audits can and cannot establish.
• Trail of Bits — publications registry — verify reports on the auditor’s own records.
• ack3 — DeFi hacks H1 2026: audit coverage and incident data — the evidence-graded incident ledger behind the 94.4% / 72.1% figures.
• Chainalysis — Inside the KelpDAO bridge exploit — how a 1-of-1 DVN and poisoned RPC nodes released ~$292M against a phantom burn.

Frequently asked questions

Is a DeFi protocol safe once it has a security audit?

No. An audit is a scoped snapshot of named contracts at one commit — not a guarantee, and not coverage for later upgrades, excluded dependencies, keys, frontends, oracles, bridges or off-chain infrastructure. Verify the report on the auditor’s site, match the live chain, address and commit, read the exclusions and check finding statuses.

What is the difference between an audit, a security contest and a bug bounty?

A private audit is one firm on a fixed scope for weeks. A contest (Code4rena, Cantina, Sherlock) puts a bounded scope before many researchers at once. A bug bounty (often Immunefi) pays continuously but is only as strong as its reward size, scope, exclusions and response speed — off-chain machinery can be left uncovered.

How do I verify a deployed contract matches the audited code?

Open the scope section, then match chain (an Ethereum review says nothing about Sui or BNB deployments), address and commit against the explorer and official docs. For proxies, find the active implementation and check that post-audit upgrades were re-reviewed.

What does it mean when an audit finding is marked “acknowledged”?

The team saw the issue and accepted the risk instead of fixing it. Fixed and re-verified is the only status that should comfort a depositor. Partially fixed or acknowledged findings on a path that can touch funds justify a smaller position — or no deposit — whatever the headline count says.

Do audits cover oracle, bridge and admin-key risks?

Often not — scopes routinely exclude admin and upgrade keys, oracle infrastructure, cross-chain messaging, dependencies and relayers. KelpDAO’s ~$292M loss ran through a 1-of-1 DVN fed by poisoned RPC nodes and Ostium’s ~$23.75M loss through a compromised oracle signer; both produced valid signatures without any contract bug. Check multisigs, timelocks, oracles and bridge verifiers separately.

Continue with the wallet security checklist, cross-chain bridge safety, oracle manipulation attacks and DeFi yield red flags — or compare mature governance in our Aave and Morpho reviews.