What Does a Security Audit Mean?
Some people ask: when will there be an audit? But what does it actually mean? How much does it cost? What do they examine? Here's everything you need to know.
"When will there be an audit?"
We sometimes get this question. But before we answer when, let's talk about what an audit actually means.
What Is an Audit?
Simply put: external experts review the code and look for bugs.
Think of it like a car inspection. You don't get to say your car is safe - an independent inspector verifies it.
In the blockchain world, this means:
- Security experts receive the code
- They analyze it for weeks or even months
- They find vulnerabilities
- They write a report
- We fix the bugs
- They verify the fixes
- The final report becomes public
Is It Mandatory?
Legally: no. There's no EU regulation that requires it.
In practice: yes. If we're serious about the project.
Why?
- Exchanges expect it
- The community expects it
- Trust is built on transparency
Without an audit, anyone can say "our code is secure". With an audit, independent experts verify it.
What Do They Examine?
Not all audits are the same. Different areas can be examined:
| Area | What it means | Why it matters |
|---|---|---|
| Smart contract | Token operation, vesting, governance | If there's a bug, tokens can be stolen |
| Consensus | How validators agree | If there's a bug, the network can be taken over |
| Node software | The validator/node program code | If there's a bug, the network can stop |
| Infrastructure | Servers, encryption, network | If there's a bug, data can leak |
How Much Does It Cost?
Here's the hard part. Audits aren't cheap.
Basic level
- Only the most important smart contracts
- Quick review
- Cost: €5,000 - €20,000
- Time: 1-3 weeks
What do you get? Basic security. The most severe bugs are filtered out.
What don't you get? Detailed analysis. Coverage of all areas.
Standard level
- Smart contract + consensus mechanism
- Detailed report
- Verification of fixes
- Cost: €20,000 - €60,000
- Time: 3-6 weeks
What do you get? What's enough for most serious projects. Exchanges accept this.
Premium level
- Everything: contract, consensus, infra, node software
- Multiple auditor firms simultaneously
- Active attack testing
- Continuous monitoring
- Cost: €100,000 - €500,000+
- Time: 2-6 months
What do you get? Institutional-grade security. What the top 20 projects do.
What Are We Planning?
Dorsium is a bootstrap project. There's no VC (Venture Capital) millions behind us. Every euro comes from the community.
So we need to think realistically.
Our plan: Standard + HDC focus
What does this mean?
- Smart contract audit: Token, vesting, core functions
- HDC audit: The Hierarchical Delegated Consensus is a unique mechanism - it deserves special attention
- Node software review: Security review
- Fixes + re-verification: What they find, we fix, and have it verified
Estimated cost: €30,000 - €60,000
Estimated time: 4-8 weeks
Which Company?
We haven't decided yet. We're evaluating multiple options:
- Certik - The biggest name, but expensive
- Halborn - Good reputation, Cosmos experience
- Hacken - EU-focused, cost-effective
- Oak Security - Cosmos specialist
What matters in the decision:
- Cosmos SDK / Tendermint experience (our tech stack)
- Reputation in the community
- Thoroughness vs. speed
- Cost
When we decide, we'll communicate immediately.
When?
Late 2026 / Early 2027 - before mainnet.
Why not now?
-
The code is still changing. We're developing now. What's ready today might change tomorrow.
-
The audit applies to final code. If we audit, then change things, the audit becomes invalid.
-
It would be throwing money away. We don't waste the community's money unnecessarily.
The timing:
| Date | What happens? |
|---|---|
| Dec 31, 2025 | Alpha Network launches |
| 2026 | Testnet phases, development |
| Late 2026 | Code finalization |
| Late 2026 / Early 2027 | Audit |
| Q1 2027 | Mainnet |
What Will You See?
At the end of the audit:
- Public report - Anyone can read it
- List of found issues - Classified as critical, high, medium, low
- Fix status - What was fixed, what wasn't
- Auditor's opinion - Summary evaluation
We hide nothing. Transparency isn't just a word - it's practice.
The Bottom Line
An audit isn't magic. It doesn't guarantee there will never be bugs.
But it guarantees that independent experts reviewed the code. That the most important problems were found. That we take security seriously.
This is the minimum a serious project can do.
We're doing it.
Trust. Honor. Security.
Questions? Reach out: hello@dorsium.com