Audit

The definition above notes the limits. The scope statement inside the report is where those limits are actually written down: an audit covers a named set of files at a specific commit, for a fixed number of engineer weeks. Everything outside that is excluded by construction, including dependencies, the deployment process, admin key handling, off-chain infrastructure, and any code written after the review closed.

That last exclusion is the one that most often matters. Contracts are frequently modified between review and deployment, so the audited commit and the deployed bytecode can differ without anyone misrepresenting anything. Findings also carry a disposition, and a report can list an issue rated high severity that the team acknowledged and chose not to fix. The protocol still launches described as audited.

The financial statement audit is the natural comparison, and it holds only partly. Both are paid opinions on a snapshot, commissioned by the party being examined. A statutory audit runs against a published standard, by a licensed firm, under a regulator, with liability attached. Smart contract review has no accreditation, no common standard, and engagement terms that disclaim liability almost entirely.

Which makes the report a document to read rather than a badge to check: scope, commit hash, findings left unresolved, and whether the deployed address matches what was reviewed.