This report covers the fourth and final operational quarter of the DAO-approved Arbitrum Audit Program (AAP), from 1 May to 31 July 2026, and the overall results of the program, whose application period ran from 1 August 2025 to 31 July 2026. The first part presents Q4 results, followed by a review of the program across the full season.
Introduction
The program aimed to make professional security audits more accessible to teams building on Arbitrum. With its first year of applications now concluded, this report reviews the principal results and lessons emerging from its delivery.
Over the year, the program progressed from establishing its evaluation and auditor-matching processes in the first quarter to managing a sustained pipeline of applications thereafter. Following an initial period of operational validation, the second quarter saw improvements in applicant readiness and referral-driven participation. Application volumes increased in the second half of the program, with Q4 recording the highest quarterly intake.
Across the Arbitrum Audit Program, 367 applications were submitted in total. Of these, 40 (10.9%) were initially accepted. 22 distinct applicants completed 25 audits (3 additional due to audit extensions), and 17 were subsequently cancelled. The principal constraints concerning teams’ ability to deliver audit-ready projects, sustain their activities, and agree to the commitments expected for Arbitrum alignment led to audit offers being withdrawn or cancelled. Exclusivity requirements were a recurring source of friction, prompting a move toward a more flexible alignment framework during the program.
22 distinct projects in total benefited from audit support, with a total audit expenditure of $1,477,810 (see the 'Capital allocated, projects in production and learnings’ section for more details).
In total, 126,737 lines of code were audited and 510 security findings were identified, including 17 critical and 54 high-severity findings.
The final results also reinforce the importance of ecosystem referrals in identifying teams able to progress through the program: 90.9% of projects that completed an audit reported a referral, compared with 38.4% of the overall applicant pool. DeFi remained the largest category among both applicants and completed audits. Taken together, these results highlight the importance of reaching teams at the appropriate stage of development, confirming readiness early, and establishing clear ecosystem commitments before audit engagements begin.
Arbitrum Audit Program Results
AAP Q4
The fourth and final operational quarter of the Arbitrum Audit Program covered the period from 1 May to 31 July 2026. The program received 109 applications in Q4, its highest quarterly intake since launch, slightly surpassing the 108 applications received in Q3 and continuing the elevated application volume seen in the second half of the program. Following a rigorous selection process, two Q4 applications were initially approved, of which one (Stabilizer) subsequently completed its audit with Nethermind, receiving $15,840 in audit funding.
DeFi remained the largest category during Q4, accounting for 52% of applications, followed by Infrastructure (25%), AI (5%), and Gaming (3%), with other categories representing 15%. Both initially accepted applications, Stabilizer and Ostium, were DeFi protocols.
Full Program
Total Application volume and outcomes
During the Arbitrum Audit Program, 367 applications in total were received, of which 40 applications from 39 distinct teams were approved; 22 distinct projects completed 25 audits, and 17 were subsequently cancelled, while the remaining 327 applications were rejected.
The 23 applications resulted in 25 completed audits. Of the 17 cancelled audits, eight were cancelled because the teams were unable to reach agreement on commitments required for Arbitrum alignment, including exclusivity, token launch on Arbitrum, use of Arbitrum’s network for key users and protocol transactions or other ecosystem commitments. Two teams explicitly reported funding constraints that prevented them from continuing their activities. The remaining seven did not deliver the work needed to bring their audits to completion.
Rejections primarily reflected concerns about teams’ capacity to execute and sustain their projects. These included limited team capacity, particularly among solo founders, incomplete applications, insufficiently defined value propositions, and a lack of credible development plans or a clear path to continued delivery.
Applicant categories
DeFi remained the program’s dominant category, accounting for 52.3% of all applications and 63.6% of projects completed audits. Its higher representation among completed audits indicates that the projects progressing through the program were more concentrated in DeFi than the overall applicant pool. Gaming also increased its representation, from 5% of applications to 9.1% of completed audits, while infrastructure, AI, and other categories accounted for smaller shares of completed audits than of applications.
Regional distribution
Europe accounted for the largest share of applications (31.6%), followed by Asia (27%) and North America (25.6%). Among completed audits, Europe’s representation increased to 50%, North America represented 22.7% and Latin America increased from 9% to 13.6%. Asia accounted for 13.6% of completed audits, compared with 27% of applications. No applications from Africa or Oceania resulted in completed audits.
Referrals
Among all applicants, 38.4% came through referrals, while 61.6% did not report a referral. By contrast, 90.9% of applications resulting in completed audits came through referrals. These referrals predominantly involved Offchain Labs and participating audit firms, often with the same team supported by contacts from both.
| Referral | All applicants | % of 367 | Projects completing audits | % of 22 |
|---|---|---|---|---|
| Yes | 141 | 38.4% | 20 | 90.9% |
| No | 226 | 61.6% | 2 | 9.1% |
| Total | 367 | 100% | 22 | 100% |
Security findings
During the program, auditors reviewed 126,737 LOCs and identified 510 security findings, including 17 classified as critical, 54 high severity, 144 medium severity and 295 low severity findings.
Across all completed audit engagements, the average audit cost was $61,575, with an average cost of $14.8 per line of code. For audits covering more than 3,000 lines of code, this figure was $11.5[1].
The program’s average audit cost of $61,575 was approximately 12% below publicly reported benchmark of $70,000 for audits of mid-complexity DeFi protocols which reflects efforts to compare auditor, negotiate lower rates and help teams access professional security reviews while preserving the program’s budget[2].
Alongside the average costs of completed audits, the offers received from auditors allow us to compare pricing across different codebase sizes. During the program, auditors submitted 87 quotes in total, including quotes that were not ultimately accepted. As illustrated below, average quoted costs per line go from $47 for codebases below 1,000 lines, to $30 for those between 1,000 and 3,000 lines and $15 for those above 3,000 lines. The overall cost of completed audits was $14.8 per line i.e. very close to the lowest prices observed in quotes. These figures provide further context to support that the rates secured through the program were competitive.
Capital allocated, projects in production and key learnings
During the program, 22 distinct projects benefited from audit support, with a total audit expenditure of $1,477,810 spent over 25 audits. The program’s contribution extends beyond completed security reviews to products now serving users and expanding Arbitrum’s financial infrastructure. At the follow-up assessment, 16 of the 22 supported projects (72.7%) were operating or continuing to build following mainnet deployment, or progressing toward launch.
Several supported teams illustrate the scale and range of this continued delivery:
Variational, operates Omni, its perpetuals and swaps platform on Arbitrum. The project reports more than $448 billion in cumulative trading volume, open interest exceeding $2 billion, access to over 550 markets. Its coverage spans cryptocurrencies, equities, commodities and indices demonstrating Arbitrum’s capacity to support trading infrastructure connecting crypto and traditional financial markets.
Fairblock has launched Stabletrust Pay for confidential stablecoin transfers and CUSD, a confidential stablecoin, on Arbitrum first. CUSD uses PYUSDx infrastructure involving M0, PayPal and MoonPay, combining optional confidentiality for balances and payment amounts with compliance controls and selective disclosure. These products extend the network’s capabilities for payments, payroll, treasury management and settlement, addressing the exposure of commercially sensitive financial information on public blockchains.
Superset selected Arbitrum One as the mainnet hub for its unified liquidity execution layer for stablecoins and onchain foreign exchange. The protocol aggregates liquidity across chains into virtual pools, allowing pricing and execution to draw on consolidated liquidity rather than isolated pools. With connections to Base and Unichain, its architecture places Arbitrum at the center of cross-chain liquidity coordination. Superset also secured $4 million in seed funding, with backing from institutional investors and participation from former ClearBank CEO Charles McManus.
T3tris has deployed vault infrastructure holding approximately $14 million in TVL on Arbitrum at the follow-up assessment. This provides a concrete example of supported infrastructure progressing beyond deployment and starting to attract capital within the ecosystem.
Taken together, these outcomes demonstrate the broader value of the program: audit funding was not simply an upfront security expense but a mechanism for helping teams move production-grade financial infrastructure through a critical stage of development. The fact that several supported projects are already operating products on Arbitrum, with several progressing toward deployment, highlights how security support can translate into live ecosystem infrastructure and expanded utility.
Across the full cohort, the follow-up assessment identified the following project outcomes:
| Project status | Projects | Number | Share |
|---|---|---|---|
| Deployed on mainnet and operating or building | Capx AI, Nashpoint, Kleros, Footium, idOS, Fairblock, Triumph Games, Bleap, Variational, Superset, CoBuilders, T3tris.finance | 12 | 54.5% |
| Discontinued or abandoned | Stimpak / Duels, Kandle Finance | 2 | 9.1% |
| Reconsidering product priorities | Tezoro, Stormbit Finance, CYBRO, Palpitada | 4 | 18.2% |
| Progressing toward mainnet deployment | ByteStrike, ARU Reserve, Stabilizer, Lotus | 4 | 18.2% |
| Total | 22 | 100% |
The cohort shows strong continued activity following audit support despite volatile market conditions, with 16 of 22 projects (72.7%) either deployed on mainnet and actively operating or building or progressing toward mainnet deployment. The 12 projects already deployed on mainnet are operating live products or continuing to build within the Arbitrum ecosystem, while a further four projects are progressing toward deployment. Four additional projects have reassessed their product direction or reduced activity but continue to report some level of ongoing work. For example, Palpitada faces an additional external constraint: its South America-focused prediction-market proposition has been affected by restrictions in Brazil, and the team is awaiting further regulatory clarification. The assessment therefore captures project-level progress at a point in time; continued tracking will provide a clearer view of how these teams evolve and how audited products contribute to the ecosystem over the longer term.
These outcomes also demonstrate both the value and the limits of audit support. An audit can address security risks and support deployment but does not by itself ensure sustained delivery or adoption.
The experience reinforces the importance of assessing organizational capacity, relevant founder experience and financial resilience alongside technical readiness. These observations informed the stronger readiness requirements introduced for the audits that will be selected under the Arbitrum Security Program, including criteria requiring teams to hold a minimum of 12 months of runway, to improve the likelihood that supported teams can deploy, maintain and grow their products after completing the audit.
The importance of financial runway is also reflected in the cohort outcomes. Of the 12 projects deployed on mainnet and operating or building, 10 (83.3%) reported prior funding or grants (the exceptions were CoBuilders and T3tris). These were also the only two of the eight projects without reported prior funding to reach the deployment stage (25%). In addition, both discontinued projects, Stimpak and Kandle Finance, had not reported prior funding or grants. While funding is not the sole determinant of project outcomes, maintaining sufficient runway can give teams the time and resources needed to continue development, reach deployment and pursue adoption following the audit.
Among projects that completed audits, 63.6% reported prior fundraising or grants, compared with 36.4% who did not.
Conclusion and next steps
The Arbitrum Audit Program delivered on its objective of making professional security reviews more accessible by allocating $1,477,810 to audit support for 22 distinct projects building on Arbitrum. Across 25 audit engagements, auditors reviewed 126,737 lines of code and identified 510 security findings, including 17 critical and 54 high-severity findings. This support helped teams developing trading, lending, vault, payments and infrastructure products identify and address risks to users and their assets.
The follow-on from the program provides evidence of continued delivery: 12 of the 22 projects (54.5%) are deployed on mainnet and actively operating or building, while a further four (18.2%) are progressing toward deployment. Examples include Variational’s trading platform, Fairblock’s confidential-payment products, T3tris’s vault infrastructure and Superset’s Arbitrum-based liquidity coordination hub.
The experience also clarified the conditions under which audit support is most useful. Discontinued projects, changes in product priorities and delayed launches demonstrate that security support alone cannot ensure sustained execution. Technical readiness, relevant team experience, organizational capacity, sufficient runway and clear ecosystem commitments remain important for translating a completed audit into a maintained product.
Capital discipline was intentional throughout the program, with funding committed according to demonstrated need and project readiness rather than seeking to exhaust the available budget. The program delivered independent security reviews for 22 projects while preserving funds for continued ecosystem security support. The Arbitrum Audit Program has now been extended for 12 months into a broader Arbitrum Security Program; all teams interested in applying may do so here.
The program supported 25 audits covering 126,737 lines of code. Of these, 24 audits covering 99,998 lines were financed from the AAP budget, while one was covered by existing auditor credits. Across the budget-funded audits, average expenditure was $61,575 per audit and $14.8 per line of code. ↩︎
https://sherlock.xyz/post/smart-contract-audit-pricing-a-market-reference-for-2026; https://procur3.io/blog/smart-contract-audit-cost-2026 ↩︎