How Crypto Presales Are Ranked by Smart Contract Audit Depth

The distinction matters operationally, not rhetorically. Surface audits check one contract. Protocol audits trace state mutations across the entire call graph.

What separates a single-contract review from a full-protocol audit

Single-contract review isolates the deployed bytecode. The auditor reads one source file, flags reentrancy, access-control failures, arithmetic overflow, signature malleability. The output is a findings list bounded by that file's scope.

Full-protocol logic inspection starts differently. The auditor maps the invariant set first — every property the protocol claims to preserve. Each invariant is then tested against the full call graph: deposit, withdraw, oracle read, liquidation path, reward distribution. Oracle manipulation, flash-loan price dependencies, cross-contract state drift, upgrade-tower state continuity — these defects only surface when the system is read as one deterministic machine.

The benchmark's axis is scope, not severity. A team with a clean single-contract report and zero protocol-level coverage scores low by definition. Surface hygiene does not equal protocol soundness.

What to verify before committing capital

Three artifacts are non-negotiable.

The full report PDF. Marketing summaries strip context. A "medium" finding with no proof-of-concept code is unverifiable.

The commit hash of the audited code. Compare it to the deployed bytecode at the contract address. If the hash does not match the on-chain runtime, the audit certifies a different binary than the one users interact with. This is the most common mismatch in presale audits.

The remediation log. Open findings without linked fixes invalidate the audit. A "fixed" finding without a corresponding commit hash is theater.

A report that names zero critical or high-severity findings across a multi-contract protocol is itself an invariant violation. Treat silence as data.

Adjacent signal: Stacks PoX-5

Stacks has initiated a security audit for PoX-5 ahead of its Q3 mainnet launch, according to TradingView. The upgrade introduces native Bitcoin staking as a new utility layer. Native staking pulls in cross-chain state assumptions: Bitcoin block confirmations, signer set rotations, reward settlement across two consensus domains.

A single-contract review cannot contain that surface. The auditor must trace the cross-chain message path from Bitcoin UTXO commitment through the PoX-5 signer contract and into the staking ledger. If the published report scopes itself to the staking contract boundary alone, it is incomplete by the same standard the new presale benchmark applies.

The benchmark is coarse. Use it as a filter. Then read the report.