Cost is auditor-days multiplied by a rate. Everything interesting is in the first term. The inputs that move it are the size of the codebase, how much of it is genuinely novel versus a well-understood pattern, how many external protocols it integrates with, how good the tests and documentation are, and how many auditors the system warrants.
Composability is usually the biggest multiplier. Every external protocol you integrate is a new trust boundary that has to be understood on its own terms before anyone can reason about your contract's behaviour against it.
A thousand lines of standard ERC-20 logic is close to zero risk and takes very little time. A thousand lines of leveraged farming with oracle dependence, liquidation logic and four external integrations can absorb weeks.
Any firm quoting purely on line count is either padding the simple case or underestimating the hard one. Ask what their estimate assumes about complexity, and whether the quote changes if your test coverage is poor.
Good documentation and a written specification, meaningful test coverage, a frozen commit, and a codebase that has already had an internal review. These are not courtesies — they directly reduce the hours spent reconstructing intent, and a firm that scopes honestly will reflect that.
Conversely, a moving target is expensive. Auditing a branch that changes during the engagement wastes review that has to be redone.
A quote that arrives without anyone looking at the repository. A price that does not change when you describe a substantially more complex system. And a scope that quietly excludes the parts most likely to lose you money — the backend that feeds your oracle, the custody system holding your keys, the upgrade path.
The cheapest audit is the one that finds nothing because it looked at the wrong thing.
LAST UPDATED
Everything above is easier to trust if you can verify it. The full engagement record, with per-engagement severity counts and links to published reports, is public.
We would rather answer the hard questions before the engagement than during it.