How-to guide · address-first verification
How to Check if a Smart Contract Is Audited
Check whether a specific smart contract address has a real audit, what code the report covered, and whether that evidence still applies to the live deployment.
Reviewed 23 July 2026 · Primary sources linked below
Direct answer
To check whether a contract is audited, begin with its exact chain and address, resolve any proxy implementation, then look for an original audit report that identifies the same source version and scope. A protocol name or audit badge cannot establish that connection.
Evidence workflow
What to check, in order
Copy the exact chain and address
Use the address from the application's official interface and confirm the network. Contract names are not unique, and the same protocol can have many deployments.
Evidence to keep: Chain ID, full checksummed address, and the first-party page that supplied it.
Inspect the explorer record
Check whether source is verified, when the contract was created, and whether the address is a proxy. Explorer labels are useful discovery aids, but they are not audit conclusions.
Evidence to keep: Explorer URL, verified-source state, creation transaction, and proxy label.
Resolve the current implementation
If the target delegates execution, identify the current implementation or beacon. The implementation is usually the code that needs to match the audited source.
Evidence to keep: Proxy type, current implementation address, and reference block.
Find the report at an original source
Prefer the auditor's report page, the protocol's official repository, or a signed publication. Confirm the audit date and named project.
Evidence to keep: Original report link, auditor identity, publication date, and report file hash when available.
Match the report to code, not branding
Look for a commit hash, repository, files, contracts, and exclusions in the report. Compare those identifiers with the live implementation and its verified source.
Evidence to keep: Reviewed commit, in-scope paths, implementation source, and match status.
Check fixes and later upgrades
Review whether findings were fixed and rechecked. Then inspect implementation changes and material releases after the report.
Evidence to keep: Fix review, unresolved findings, upgrade history, and latest reviewed version.
Use the product
Start with the public registry
Enter the chain and address. The live checker returns the current registry state and an inspectable API receipt without requiring a wallet.
Check a contract addressSource ledger
Primary references and working records
Ethereum.org: Verifying smart contracts
Describes how source and deployed bytecode are compared.
ERC-1967: Proxy storage slots
Provides the standard slots used to identify implementations, beacons, and admins.
Proof of Audits live contract checker
Queries one chain and address against the current public proof registry.
Aave V4 public evidence record
A worked public record with real addresses and deliberately unresolved audit mapping gaps.
Specific answers
Frequently asked questions
Can I check an audit using only a contract address?
The address is the correct starting point, but you still need the current implementation, the original report, and a source or build link that connects the report's scope to that deployment.
Is an explorer audit badge enough?
No. Treat labels and badges as leads. Confirm the original report, reviewed source, scope, and current deployment independently.
What does it mean when no audit is found?
It means the evidence was not found in the sources checked. It is not proof that no review occurred and not proof that the contract is vulnerable.
Why must I check the implementation address?
Upgradeable proxies often delegate execution to separate implementation code. Checking only the proxy can miss the code that actually runs.
Continue the cluster