MSTR Cat

Crypto Law/Level V · Builders and launchers/5.3 Promotion and liability/Lesson 5

Smart-contract audits and what they promise

What a code audit actually covers, why ‘audited’ is not a guarantee, who can rely on the report, and how claims about audits create liability for projects.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Publish the verified source code on a block explorer and the reviewed commit hash. That is free and makes any audit claim checkable, but the claim must match the deployed, unupgraded code.
  2. If you use the word ‘audited’, link the full report and list the findings that remain open. Omitting serious unresolved findings can be misleading under FTC Act §5, Rule 10b-5 or MiCA Article 7.
  3. A smaller project can scope a review narrowly, to the deployed contracts only, and add a public bug bounty. The report’s disclaimers limit what it proves, so claim only what it covers.
  4. An audit firm owes ordinary-negligence duties only to its client under Bily (Cal. 1992), so buyers rarely recover from auditors; projects stay liable for their own claims.
  5. A Utah DAO needs a security review of its public code for legal recognition. Budget the review only if you choose that wrapper.

MaterialsA published smart-contract security review with its disclaimer section, for example Trail of Bits’ May 2023 FraxGov reportThe deployed contract’s verified source code and address on a block explorerBily v. Arthur Young & Co., 3 Cal. 4th 370 (1992), on auditors’ liability to third parties

Wonder

  1. If an audited contract is hacked, can buyers sue the auditor?
  2. Does an audit cover the code that is actually running on chain?
  3. Can a project get into legal trouble just for saying it was audited?

Explore

  1. A smart-contract audit is a security review of a specific version of a project’s code by an outside firm, paid for by the project. It produces a report listing findings by severity and, often, the project’s fixes. The word is borrowed from financial auditing, but the product is different: its scope, time and method are set by a private contract between the reviewer and the project. Buyers usually see only the public report. Proof-of-reserves reports, which some exchanges also call audits, are a separate thing (lesson 4.1.6).
  2. The report itself states its limits. Trail of Bits’ May 2023 review of FraxGov, for example, says the work followed a statement of work, that assessments are ‘time-boxed’ and rely on information from the client, and that the findings ‘should not be considered a comprehensive list of security issues’. It also notes that automated tools have limits. Fixes are tracked by commit, the identifier of a specific code version, such as ‘Resolved in commit ed4e708’. An audit therefore describes particular code at a particular time, not whatever is later deployed or upgraded.
  3. Audited code can still fail. On 13 March 2023 the Euler Finance lending protocol lost about $197 million. The cause was a missing health check in a function called donateToReserves, which had been added as part of a fix for an earlier problem and was itself audited. Euler said it had been audited many more times than was usual and had a $1 million bug bounty. By 3 April 2023 the attacker had returned funds worth about $240 million, after weeks of negotiation. Audits reduce risk; they do not remove it.
  4. For a buyer thinking of suing a code reviewer, the law on financial auditors shows the likely hurdles. In Bily v. Arthur Young & Co. (1992) the California Supreme Court held that an auditor’s liability for ordinary negligence runs only to its client. Others may sue for negligent misrepresentation only if they were specifically intended beneficiaries of the report known to the auditor, and for intentional fraud if they were reasonably foreseeable. A token buyer reading a public report would usually need more than proof that the reviewer was careless.
  5. The project’s own words about an audit carry more risk. Saying ‘audited’ or ‘secure’ while leaving out unresolved serious findings, or while running different code, can be a misleading statement. If the token is a security, that can support claims under SEC Rule 10b-5 or section 12(a)(2) (lesson 5.3.2). Otherwise, the FTC Act prohibits ‘unfair or deceptive acts or practices’ (lesson 5.1.7), and in the EU MiCA Article 7 requires marketing to be ‘fair, clear and not misleading’. Utah’s DAO Act, in force since 1 January 2024, even requires a security review of a DAO’s code for legal recognition.
  6. Read an audit like a contract, not a badge. Check who paid, what was in scope, which findings were fixed, which were ‘acknowledged’ and left open, and whether the contracts can be upgraded or paused by an admin key (lesson 5.1.5). A practical check: take the commit identifier from the report, open the deployed contract on a block explorer, and confirm that the verified source matches the reviewed version and that no later upgrade has replaced it. If they do not match, the report says little about the code in use.

Key facts

  • A smart-contract audit reviews a specific version of code under a private contract between the reviewer and the project.
  • Trail of Bits’ May 2023 FraxGov report states that its findings should not be considered a comprehensive list of security issues.
  • Euler Finance lost about $197 million on 13 March 2023 through a flaw in an audited function, and funds were returned by 3 April 2023.
  • In Bily v. Arthur Young & Co. (1992) the California Supreme Court limited auditors’ ordinary-negligence liability to their clients.
  • Under Bily, third parties may sue an auditor for negligent misrepresentation only as specifically intended beneficiaries known to the auditor, or for intentional fraud.
  • Utah’s Decentralized Autonomous Organizations Act, effective 1 January 2024, requires a DAO’s publicly available code to have undergone a security review.

Exercise nine, six, three, one

9CollectList up to 9 claims about security you have seen on token or protocol websites, such as ‘audited’, ‘secure’, named audit firms or bug bounties (some lists are shorter).
6ClusterSort them into 6 groups: claims with a linked report, claims without a report, reports with open serious findings, reports on an older code version, bug bounty claims, and vague security language.
3DistillReduce the 6 groups to 3: claims you could verify against deployed code, claims you could only partly verify, and claims you could not verify at all.
1CrystallizeWrite 1 sentence explaining what an audit report can and cannot tell you about the code running on chain today.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS