Fidesium publishes its prices. Continuous automated scanning is $399, $799 or $1,499+ a month, and a manual smart contract audit starts at $5,000, quoted against your scope. The scanner is free to try with no card. All three plans can add a manual audit, and two of them carry a discount on it.
23 of our audit reports are published in full in the public audit portfolio, covering 16 protocols across EVM chains and Solana. Read one before you decide anything here.
Every plan can add a manual audit. A manual audit is line-by-line human review, logic and economic risk analysis, and two rounds of fix verification, and it starts at $5,000.
Fid Pro takes 5% off that. Fid Enterprise takes 10% off. Fid Basic adds it at the standard rate. The discount applies to the audit as it is quoted for your scope rather than to the starting price, so it is worth more on a larger engagement than on a small one.
Automated scanning runs on every commit and catches the classes of bug a scanner can reach. A manual audit is for the classes it cannot: business logic, economic and incentive design, and the way your contracts behave against each other. Most teams shipping value want both.
A manual smart contract audit at Fidesium starts at $5,000, priced against your scope once we have read the code. Continuous automated scanning is $399, $799 or $1,499+ a month depending on the plan. The $5,000 figure is an entry point for a standard contract scope, not an average engagement, and the honest way to compare it with a larger quote is to compare the file lists rather than the invoices.
Six things, and line count is only the first. How much code is in scope, counted without comments, tests or unmodified libraries. How dense the logic is, because 300 lines of custom curve maths is a harder review than 3,000 lines of standard token plumbing. Every oracle, bridge or lending market you compose with. The language and the chain. Proxies, admin keys and timelocks. And your deadline, because a compressed window adds reviewers rather than removing work.
Line-by-line human review of the code in scope, logic and economic risk analysis, and two rounds of fix verification at no extra cost. You get a public report, a badge, and an on-chain NFT record of what was reviewed at which commit. One month of continuous automated scanning runs alongside it after delivery. We are chain agnostic with an EVM specialism.
A subscription buys cadence. Deterministic analysis runs against your repository on every commit, pull request and deployment through GitHub, so the code that ships today is checked today rather than at the next audit window. A manual audit buys depth: engineers reading the code, reasoning about incentives and economics, and testing what happens when your contracts meet each other. One is bounded by what a scanner can decide. The other is bounded by the commit it reviewed.
A quote comes back within 24 hours of the request. A scoping call follows within 24 to 48 hours of the repository landing, and the delivery date is fixed there, because scope is what drives it. For a sense of the upper end, the Adrena assessment covered 33,747 lines of Rust across 168 source files: the review ran from 10 February to 18 March 2026, and the report was delivered on 11 April after a separate remediation pass.
Fixing findings from your own report costs nothing extra, because two rounds of verification are already in the price. An edit to an in-scope file is a delta review of the diff and is quoted small. A new contract or a structural rewrite is a new scope. And a report whose commit hash no longer matches your deployed bytecode describes code that is not running, which is a check almost nobody performs.
Usually, because the audit is the diff rather than the whole codebase. It is still real work. The modules your change touches are read as context, and that context is where the risk sits: the dangerous part of a fork is rarely the code you changed, it is the invariant in the base that your change quietly broke. Forking an audited protocol does not inherit its report, and an unmodified fork has not been audited for your deployment.
No. The starting point is the same $5,000. Rust programs on Solana are scoped on the account model, the program structure and the cross-program invocation surface, where a Solidity codebase is scoped closer to line count. Four of the reports in the public portfolio are Solana programs, including Adrena, BlockAsset and Banana Zone, so you can read that work before you commission any.
It goes in the report graded Critical, with its location, its mechanism and the remediation, and the two rounds of fix verification already in the price cover confirming your fix. It does not change what you are charged. The Adrena assessment raised 42 findings including one Critical, and the protocol’s risk score moved from 43 out of 100 at first delivery to 11 out of 100 once the remediation had been reviewed.
Yes, on every plan including Fid Basic. Fid Pro takes 5% off the manual audit and Fid Enterprise takes 10%. The discount applies to the audit as quoted for your scope rather than to the $5,000 starting price. It is requested rather than bought at checkout, because the scope has to be agreed before there is a price to discount.
If you know what you are shipping and when, request a quote and we will come back with a scope and a price. If you are still deciding whether we are the right people for your code, read the audits first.
Fidesium is a security platform dedicated to making automated smart contract audits continuous, accessible, and affordable for Web3 teams worldwide.
Audits
Copyright @ Fidesium LTD 2023. All Rights Reserved.