An audit is a careful review by people looking for ways to break something, at a moment in time, and it is worth something. It is not a certificate, and the gap between those two things is where losses happen.
What an auditor does
- Reads the code looking for logic errors and known attack patterns.
- Runs tests against it.
- Publishes findings and a recommendation.
What an audit cannot do
An audit is a snapshot. Code changes after it. New integrations appear. A different version ships. Nothing about the audit carries forward automatically to the code you are actually using — which is why checking what you are connected to matters more than the fact that an audit happened once.
- It does not prove the contract does what its marketing says, only that it does what the code says.
- It does not cover economic design, or what happens in a crash nobody modelled.
- Audits of different quality are widely available, and the name alone is not a claim you can verify.
How to read a report
- Which version of the contract was reviewed? Match it to what is deployed now.
- Were the findings fixed, and are the fixes verified?
- Is the auditor known, and is the report signed?
- Are there open findings left unaddressed?
The wider picture
Code is one link in a chain that also includes keys, the network, the interface you use and the people operating it. The safety checklist covers the rest, and it is where the losses actually happen — not in a bug an auditor would have caught.