Our protocol was audited — why is that not enough?
Short answer
In the first half of 2026, 76.7% of funds lost in DeFi were taken from audited protocols. In 94.4% of those cases the contracts ran exactly as written — what failed were the keys, the permissions, and the process. A contract audit never examines that layer, and that is where three quarters of the money goes.
Typical duration: 3–4 weeks
What this looks like
- One person holds a key that can move funds alone
- A multisig exists, but its threshold can be lowered by its own holders
- Nobody knows within how many minutes abuse would be detected
- Price comes from a single liquidity pool with no fallback
- The audit report is a year old while the contracts have been upgraded several times
Why this happens
A contract audit answers one question well: does this code do what it says? That question matters, and the answer is usually yes. What it does not answer: who may change the code later, who holds keys that can move funds, where the price number comes from, and whether anyone will wake up if something happens at three in the morning.
The first-half 2026 figures show the consequence bluntly. Of roughly $940 million lost, $721 million came from audited protocols — and 94.4% of those cases were not contract flaws the auditors missed. The contracts complied. What did not comply were the conditions around them.
An audit certificate therefore becomes dangerous when misread: it grants a sense of safety that closes off exactly the questions that decide the outcome.
How we solve it
- 01
Authority mapping
We list who can do what alone today — move funds, replace contracts, change parameters. The list is usually longer than the team expects.
- 02
Key restructuring
Authority moves to a multisig whose threshold cannot be lowered unilaterally, with a rotation procedure for when people leave.
- 03
Price source hardening
Price sources gain fallbacks and time-weighted averaging, then are stress-tested against real historical moves.
- 04
Monitoring that wakes someone
Solvency invariants and every privileged call are watched, alerting a person — not a dashboard nobody looks at.
Numbers from our own work
We run our own mainnet protocols — a decentralised exchange, lending, a launchpad, and milestone escrow
Our internal audits use several auditors working from different angles, plus invariant and fuzz testing
Our milestone escrow went through three rounds of internal audit before being declared mainnet-ready
Mistakes we keep seeing
- Treating an audit report as permanent while the contracts have been upgraded several times since
- Installing a multisig but letting its holders lower the threshold themselves
- Installing a dashboard with no alert that actually wakes anyone up
Questions we are asked most
So contract audits are useless?
Not at all. Contract audits remain necessary, and exchanges and investors do demand them. The error is treating one as sufficient: it closes one layer while three quarters of losses arrive through another.
We are a small team in one time zone. Does monitoring make sense for us?
It makes the most sense precisely for you. Large teams across time zones always have someone awake; a small team in one time zone has eight hours every night when nobody is watching.
How long does key restructuring take?
Two to three weeks, including the authority migration and a recovery drill to confirm the protocol does not lock up if one key holder is lost.
Updated 30 July 2026 · Neuraltan
If this is happening to you
Tell us the situation. We will say plainly whether this is worth doing now, and how long it takes.