What Does “The Protocol Has Been Audited” Actually Mean?

“Audited” is the DeFi world’s go-to reassurance. Yet the list of “audited” protocols that have been hacked goes on for pages. Let’s break down what an audit really is.

What an auditor does

The team reviews the code within a limited timeframe against known classes of vulnerabilities and writes a report detailing critical, high, and medium-severity findings, along with the team’s response. This reduces the likelihood of known errors-and that’s it.

What an audit does NOT cover

• Code after an audit: just one “minor fix” after the report-and you’re back in an unaudited contract. Verify that the deployed bytecode matches the audited commit.
• Economic attacks: oracle manipulation, tokenomic spirals, governance takeovers-these are often outside the scope.
• Operations: keys, multisigs, team phishing-code audits say nothing about the main vector of modern thefts.
• Dependencies: The protocol itself is clean, but the integrated oracle, bridge, or token is not.

How to interpret the signal

Trust hierarchy: multiple audits by different firms on fresh code + an active bug bounty program with a substantial cap + months of operation under TVL > a single audit “that happened somewhere” > an “audited” badge without a link to the report (= nothing). And read the reports yourself: the number of critical findings and the team’s response say more about the culture than the fact that an audit was conducted. Our protocol analyses are in the DeFi section.