# Smart contract audit subsidy: get your audit funded

> How a smart contract audit subsidy works, which programs offer one in 2026 for Ethereum, Avalanche and Arbitrum, what they cover and how to prepare your code.

Last reviewed 2026-10-31. Dates are UTC.

A smart contract audit subsidy pays part of the cost of a professional security audit, usually straight to the audit firm or as a discount on its invoice, not as cash to you. As of October 31, 2026, three programs in web3grant's directory work this way: the Ethereum Audit Subsidy Program (up to 30% off), Ava Labs' program for Avalanche (up to 75%) and the Arbitrum Security Program.

## Key takeaways

- As of October 31, 2026, 3 of the 99 programs in web3grant's directory pay auditors directly or as an audit discount, and 18 programs fund security work more broadly.
- The Ethereum Audit Subsidy Program covers up to 30% of an audit booked through Areta Market, from a $1M pool, for teams building on Ethereum mainnet.
- Ava Labs collects private quotes from 18 whitelisted firms within a 10-day window and can pay up to 75% of the audit you pick.
- The Arbitrum Security Program opened on September 28, 2026 with about $7.8M for 12 months and pays one of 13 approved auditors directly.
- TheDAO Security Fund will not pay for your own audit, and the Uniswap Foundation's Open Grants do not fund standalone audits.

## How does a smart contract audit subsidy work?

An audit subsidy reduces what you pay an approved security firm to review your code. You apply to the program, it approves your project and a share of the cost, and the subsidy goes to the auditor or comes off the quote. You pay the rest.

Three rules follow from that design. You don't receive the money, so it can't cover salaries or other costs. You must use a firm on the program's list. And the program judges your readiness: an audit of unfinished code wastes its budget, so most ask for a defined scope before they match you.

An audit subsidy is also different from a bug bounty, which pays outside researchers for flaws they find and disclose, usually in code that is already live. The two complement each other; [Web3 bounties vs grants](https://www.web3grant.com/guides/web3-bounties-vs-grants) explains the bounty side.

## Which programs subsidize smart contract audits?

As of October 31, 2026, three programs in web3grant's directory subsidize audits for projects on a specific chain. All three are rolling, with no deadline.

| Program | Covers | Auditors | Chain |
| --- | --- | --- | --- |
| [Ethereum Audit Subsidy Program](https://www.web3grant.com/grants/ethereum-audit-subsidy-program) | Up to 30% of the audit | 20+ firms on Areta Market | Ethereum mainnet |
| [Ava Labs Security Audit Program](https://www.web3grant.com/grants/ava-labs-audit-subsidy) | Up to 75% | 18 whitelisted firms | Avalanche |
| [Arbitrum Security Program](https://www.web3grant.com/grants/arbitrum-security-program) | A share set per project | 13 approved firms | Arbitrum One and Arbitrum chains |

### Ethereum Audit Subsidy Program

The Ethereum Foundation announced this $1M program on April 14, 2026 with Areta, Chainlink Labs and Nethermind Security. A committee from those three organizations reviews applications with Areta, and approved teams get up to 30% off an audit booked through [Areta Market](https://areta.market/faq), a marketplace of more than 20 firms. You still pick your own auditor and quote.

Any team building on Ethereum mainnet can apply, at any size or stage. Projects aligned with the Foundation's CROPS principles (censorship resistance, open source, privacy and security) get priority. No per-project dollar cap is published, and how much of the $1M remains is not public. Web3grant estimates about 3 weeks to a decision.

### Ava Labs Security Audit Program

Ava Labs runs its audit program through the Avalanche Builder Hub. You submit one audit scope, the 18 whitelisted firms (among them BlockSec, Cantina and Certora) send private quotes within 10 days, and you accept one. The program can then pay up to 75% of the cost, with no fees for builders; the exact share is decided per project.

Scope can include Solidity or Vyper contracts, protocol code in Go or Rust including Avalanche L1s, cryptography, formal verification, and frontend, OpSec and monitoring reviews. You need a project on the Builder Hub and a defined scope ready to share. See [Avalanche grants](https://www.web3grant.com/ecosystems/avalanche) for the chain's other programs.

### Arbitrum Security Program

The Arbitrum Foundation launched this program on September 28, 2026 for 12 months, with about $7.8M (1.76M USDC and 25M ARB), of which roughly $6.6M is for new audits. It replaces the Arbitrum Audit Program that started in August 2025.

After approval you confirm your code is ready for audit, agree to subsidy terms, sign a commitment agreement with the Foundation and are matched with one of 13 approved auditors, including OpenZeppelin, Trail of Bits, Certora, Cyfrin and Nethermind. The subsidy goes to the auditor, and its size depends on the agreement for each project. The Foundation expects about a month between approval and the start of the audit. Pre-launch, migrating and growth-stage projects shipping new code are all eligible.

Arbitrum's builder grants program, the D.A.O. Grant Program, closed its Season 3 on March 17, 2026 with no Season 4 proposed. The Arbitrum Foundation says a new grant program is coming soon; until then, the Security Program is its open route for builders. See [Arbitrum grants](https://www.web3grant.com/ecosystems/arbitrum) for the rest.

## Which grants can pay for an audit?

Several broader grant programs fund audits as one kind of security work, usually for open-source or shared code. In web3grant's directory, as of October 31, 2026:

- **[Horizen Builder Ecosystem Fund](https://www.web3grant.com/grants/horizen-builder-ecosystem-fund)** lists security audits among the support it gives promising products, and its typical payout schedule includes an audit milestone.
- **[Lido Ecosystem Grants](https://www.web3grant.com/grants/lido-ecosystem-grants)** fund security assessments and audits of staking tools.
- **[MAGIC Monero Fund](https://www.web3grant.com/grants/magic-monero-fund)** funds security audits and fuzzing for open-source Monero work.
- **[Zcash Community Grants](https://www.web3grant.com/grants/zcash-community-grants)** fund core development and audits for Zcash.
- **[Canton Development Fund](https://www.web3grant.com/grants/canton-development-fund)** funds security auditing and hardening as shared goods for the Canton ecosystem.
- **[Kusama OpenGov Treasury](https://www.web3grant.com/grants/kusama-opengov-treasury)** funds audits and security work by on-chain vote.
- **[Bitcoin Quantum Readiness Grants](https://www.web3grant.com/grants/galaxy-bitcoin-quantum-readiness-grants)** from Galaxy fund formal security audits of proposed post-quantum implementations.

Two well-funded programs explicitly exclude your own audit. [TheDAO Security Fund](https://www.web3grant.com/grants/thedao-security-fund) pays for shared Ethereum security work such as compilers, wallets and incident response, and will not fund a project's own audits. The Uniswap Foundation's Open Grants do not fund standalone audits; audits for Uniswap v4 hooks go through its separate Security Fund run by Areta.

Some programs require an audit without paying for it. Tezos Foundation Grants require DeFi projects to pass a third-party audit of all smart contracts, Cardano PRIME asks new contracts for a realistic audit plan, and Compound pays later milestones only after contracts that interact with Compound pass an OpenZeppelin audit. In those cases, put the audit in your [Web3 grant budget](https://www.web3grant.com/guides/web3-grant-budget) if the program allows it. All 18 security programs are listed under [Web3 security and audit grants](https://www.web3grant.com/categories/security).

## Which audit subsidies did we leave out, and why?

Two audit subsidy programs exist but are not in web3grant's directory. Both are worth knowing about.

- **Solana Audit Subsidy Program.** Areta launched it with Superteam, MonkeDAO and Jito in October 2025: a $1M program with subsidies of $5,000 to $50,000, capped at 30% of the quote, run in monthly cohorts. The latest cohort we found, Cohort VI, closed on March 7, 2026. As of October 1, 2026 Areta still listed the program as active with a live form, but we found no later cohort deadline, so we left it out for too little verified information. Check Areta directly if you build on [Solana](https://www.web3grant.com/ecosystems/solana).
- **Zealynx Audit Grants.** Seasonal grants that cover 25%, 50% or 100% of a Zealynx audit, worth up to about $24,000 at the top tier. Season 2 ran from September 20 to October 4, 2026, with winners due October 11. We left it out because it is a discount on one firm's own invoice, not cash funding.

## How do you prepare for a subsidized audit?

Prepare as if you were paying the full price, because the subsidy usually doesn't change what the auditor needs from you. These steps follow general audit practice and the programs' own conditions.

1. **Freeze the code.** Audit a specific commit. Changes after the audit starts can push the work back or need a re-review.
2. **Write the scope.** List the contracts and files in scope, their size, external dependencies and what is out of scope. Ava Labs asks for a defined scope before quotes, and Arbitrum for audit-ready code before matching.
3. **Test it.** Unit and integration tests, plus fuzz or invariant tests for the core logic, let auditors spend their time on design flaws rather than basic bugs.
4. **Document intent.** A short spec of what each contract should do, its roles and trust assumptions, and known issues.
5. **Compare quotes.** Ava Labs and Areta Market both let you see several quotes; compare scope and duration, not only price.
6. **Budget your share and the fixes.** You pay the part the subsidy doesn't cover, plus the engineering time to fix findings and any re-review.
7. **Plan the calendar.** Arbitrum expects about a month from approval to audit start. Apply before your code is final, but only once your scope is stable.

Publish the final report when the audit is done; grant reviewers and users both look for it. For the application itself, see [how to apply for Web3 grants](https://www.web3grant.com/guides/how-to-apply-for-web3-grants).

## FAQ

### How much does a smart contract audit cost?

Smart contract audit costs depend on the size and complexity of the code and the firm, and the programs in web3grant's directory publish no typical price. One published rate is Zealynx's scoping at $6,000 per auditor per week, so a two-week review by two auditors would come to about $24,000 at that rate. Get quotes from several firms before you budget.

### Does an audit subsidy pay cash?

An audit subsidy usually does not pay cash to your team. The Arbitrum Security Program pays the approved auditor directly, the Ethereum Audit Subsidy Program applies a discount when you book through Areta Market, and Ava Labs pays a share toward the firm you choose. If you need money for salaries or other costs, you need a grant, not an audit subsidy.

### Can I get an audit subsidy before launch?

You can get an audit subsidy before launch from all three programs in web3grant's directory. The Ethereum Audit Subsidy Program funds audits before launch for teams of any stage, the Arbitrum Security Program covers pre-launch, migrating and growth-stage projects, and Ava Labs takes requests from any team on the Avalanche Builder Hub with a defined scope. Each wants audit-ready code first.

### Can I choose my own auditor with a subsidy?

An audit subsidy limits you to the program's approved firms. The Ethereum Audit Subsidy Program covers audits booked through Areta Market's 20+ firms, Ava Labs only subsidizes firms on its 18-firm whitelist, and the Arbitrum Security Program matches you with one of 13 approved auditors. If your preferred firm is not on the list, the subsidy will not apply to it.

---

From web3grant: https://www.web3grant.com/guides/smart-contract-audit-subsidies. Program details change often: confirm on each program's official site before applying.