Timeline drivers
Audit duration depends on code size, protocol complexity, network model, documentation quality, tests, external dependencies, upgradeability, and whether remediation review is included.
Why simple line counts are not enough
A small contract can be risky when it controls funds, signatures, bridges, governance, or oracle reads. A larger codebase can be easier to review when architecture and tests are clear.
Remediation time
Teams should reserve time after findings are delivered. Some fixes are direct, while business-logic changes may require design decisions, new tests, and a second review pass.
How to speed up review
Provide a frozen commit, concise architecture notes, existing tests, deployment instructions, threat model, and a list of known assumptions before the audit begins.
Next step
Use this guide to improve your scope, then request a review when the contracts, documentation, and tests are ready for a frozen commit audit.