“One of the pioneering firms in web3 solutions, digital assets and tokenization, recognized for its innovation and solid reputation across Spain and Latin America.”
Jorge CorredorLawyer, Rincón Cuéllar & Asociados
Smart contract audit services. Every finding, tracked to a fix.
We review your contracts' code, permissions and economic logic, write our own tests, rank every finding by severity and verify each fix before the report closes.
They trust Metlabs with their blockchain projects
Audit
What does a smart contract audit cover?
It reviews the code, permissions and economic logic of your contracts before they hold value. It combines line-by-line manual review, fuzzing and static analysis, and ends in a report that ranks every finding by severity. An audit lowers risk without removing it, which is why we also verify every fix.
$905M
lost to smart contract flaws in 2025
OWASP · 2026
122
smart contract incidents in 2025
OWASP · 2026
$953M+
lost to access control flaws in 2024
OWASP · 2025
What's included
What our smart contract audit services include.
Every piece leaves evidence your team, an investor or a supervisor can check later, showing what was reviewed, what was found and how it was resolved.
Frozen scope
We pin the contracts, the commit and the assumptions before we start, so the report is reproducible.
Manual review
Line-by-line reading of the logic, the permissions and every flow that moves value in your contracts.
Fuzzing and invariants
Properties that must always hold, tested with Foundry against thousands of random inputs.
Static analysis
Slither on known vulnerability patterns, with every warning checked by hand before we report it.
Findings report
Every finding with its severity, its impact, a proof of concept and the fix we recommend.
Fix verification
We review every change and update the report with the final status of each finding.
Method decision
Manual review, automated tools or formal verification?
The three methods work together. Manual review catches logic and design errors, tools cover what repeats on every change, and formal verification proves specific properties when the value at risk justifies it.
| Criterion | Manual review | Automated tools | Formal verification |
|---|---|---|---|
| What it catches | Logic, permission and economic design errors. | Known patterns and edge cases surfaced by fuzzing. | Any violation of the specified properties. |
| Main limit | Depends on the reviewer's experience and time. | False positives and no sense of the business rule. | Only proves what is specified. A bad spec passes. |
| Relative cost | Medium to high. Grows with code size and complexity. | Low. Runs on every change from continuous integration. | The highest. Every property has to be formalized. |
| Typical fit | Any contract that will hold third-party funds. | The continuous baseline of every project. | Critical cores such as vaults, bridges or stablecoins. |
An audit describes what was reviewed at a specific commit. If the code changes afterwards, the change needs its own review.
Methodology
How we audit your smart contracts.
Four phases, each with a deliverable. The scope is closed before we read a line, and the report is not final until the fixes are verified.
We pin the commit, the contracts and the actors, and write down what could go wrong in each flow.
We read every function against the specification and document findings with a proof of concept.
Fuzzing and invariants with Foundry plus static analysis with Slither to cover what reading misses.
We deliver the severity-ranked report, verify every fix and prepare the code for an external audit if needed.
Tools to review what moves value.
The same languages and testing frameworks the contracts are written in, so every finding can be reproduced on the real code.
- Solidity
The smart contract language for verifiable rules on EVM networks.
- Vyper
A minimalist, Pythonic alternative to Solidity focused on auditability.
- Foundry
Solidity tests, invariant fuzzing and command-line tooling for EVM networks.
- Hardhat
An environment to compile, test and deploy contracts on EVM networks from Node.
- OpenZeppelin
Audited Solidity contracts for tokens, access control and upgradeable systems.
- Ethereum
EVM contracts, tokens and final settlement on an open Proof of Stake network.
Use cases
When we audit smart contracts.
An audit makes sense before a contract holds third-party funds and every time its logic changes.
Tokenized debt issuance
Issuance, coupon and redemption contracts reviewed before the first investor comes in.
Blockchain for Banking & Finance
Real estate investment
Transfer restrictions and verified investor lists checked before the tokens are issued.
Blockchain for Real Estate
Game economies
Game tokens and NFTs reviewed so nobody can mint or withdraw more than the game logic allows.
Blockchain for Gaming & Entertainment
Carbon credits
Credit retirement without double counting, with every burn traceable on-chain.
Blockchain for Energy & Sustainability
Reviews
What do our clients think of Metlabs?
“We structured the tokenization of real estate projects with them, and I value the team's ability to understand our corporate needs and genuinely solve them.”
Joan MejíaManager, GLOBYNE
“They advised us on the feasibility of tokenizing real estate assets in Uruguay with direct, cordial treatment. A professional team, responsive and always available.”
Álvaro Silva SantamaríaCEO, Sp Inmuebles
“Great professionals at structuring tokenized projects, with technical command and attention to detail that inspire full confidence at every stage of the work.”
Francisco BetancourtVerified Google review
“As a blockchain lawyer, I value their experience and professionalism in consulting and executing tokenization projects. Technology partners you can fully trust.”
Vanessa RivasBlockchain lawyer, El Salvador
“Great professionals, very attentive to their clients and always mindful of every detail. Working with their team has been a genuine pleasure from start to finish.”
CriptorentVerified Google review
“A very professional yet approachable company that empathizes with your doubts and needs. Highly recommended for entrepreneurs with a tokenization project.”
Javier EspasaTokenization entrepreneur
“Exceptional in every sense. From legal support I value their rigor and transparency: working with Metlabs means professionalism, innovation and security.”
Pedro A. Agúndez MéndezGoogle Local Guide
“Excellent service across blockchain development, asset tokenization and consulting. A very professional team that I recommend wholeheartedly, without reservation.”
José Luis DíazVerified Google review
“I have worked with them on several projects and they are very professional. A guarantee that everything turns out perfectly. Without a doubt, 100% recommended.”
Ignacio Fernández JiménezVerified Google review
“One of the pioneering firms in web3 solutions, digital assets and tokenization, recognized for its innovation and solid reputation across Spain and Latin America.”
Jorge CorredorLawyer, Rincón Cuéllar & Asociados
“Great professionals at structuring tokenized projects, with technical command and attention to detail that inspire full confidence at every stage of the work.”
Francisco BetancourtVerified Google review
“A very professional yet approachable company that empathizes with your doubts and needs. Highly recommended for entrepreneurs with a tokenization project.”
Javier EspasaTokenization entrepreneur
“I have worked with them on several projects and they are very professional. A guarantee that everything turns out perfectly. Without a doubt, 100% recommended.”
Ignacio Fernández JiménezVerified Google review
“We structured the tokenization of real estate projects with them, and I value the team's ability to understand our corporate needs and genuinely solve them.”
Joan MejíaManager, GLOBYNE
“As a blockchain lawyer, I value their experience and professionalism in consulting and executing tokenization projects. Technology partners you can fully trust.”
Vanessa RivasBlockchain lawyer, El Salvador
“Exceptional in every sense. From legal support I value their rigor and transparency: working with Metlabs means professionalism, innovation and security.”
Pedro A. Agúndez MéndezGoogle Local Guide
“They advised us on the feasibility of tokenizing real estate assets in Uruguay with direct, cordial treatment. A professional team, responsive and always available.”
Álvaro Silva SantamaríaCEO, Sp Inmuebles
“Great professionals, very attentive to their clients and always mindful of every detail. Working with their team has been a genuine pleasure from start to finish.”
CriptorentVerified Google review
“Excellent service across blockchain development, asset tokenization and consulting. A very professional team that I recommend wholeheartedly, without reservation.”
José Luis DíazVerified Google review
Team
In-house blockchain development team
Metlabs is a blockchain development company based in A Coruña, Spain. An in-house team covers every part of the project, from product and engineering to infrastructure and legal fit. The people who design your architecture write, test and deploy the code.
Meet the team- Projects in production
- +30
- In tokenized assets
- +$40M
- In‑house development
- 100%
Isaac González
Head of Innovation
Carlos Peña
Full Stack Engineer
Pablo Castro
DevOps Engineer
Helena Ramos
Product Designer
Javier Yáñez
Legal
Security
What we check before a smart contract audit
Every delivery goes through the same checklist before it reaches mainnet. What changes between projects is the depth of each control, because an MVP does not carry the same risk as a contract that holds third-party funds.
Before mainnet
- Roles and permissions defined for every critical function
- Unit and invariant tests, and fuzzing on the logic that moves value
- Static analysis and peer review of every change
- Multisig and timelock on administration when the risk justifies it
- Custody and rotation of the deployment keys agreed
- External audit when the value at risk requires it
We work with leading audit firms
FAQ
Smart contract audit questions
The price depends on scope, not on a flat rate. The main drivers are the lines of code in scope, how complex the logic is, integrations with oracles or bridges, upgradeability and how many fix rounds you need. We quote a fixed price once the contracts and the commit are frozen.
It depends on the same factors as the price, mainly the size and complexity of the code in scope. The timeline includes the review, the report and a fix verification round. Code that arrives with a specification, tests and frozen scope moves faster, because review time goes to design risks instead of questions.
We freeze the scope and write a threat model for each flow. Then we read every function against the specification, run fuzzing and invariant tests with Foundry and static analysis with Slither. Each finding gets a severity and a proof of concept, and we verify every fix before closing the report.
No audit can guarantee that. An audit describes a process applied to a specific commit by a specific team, and it lowers the risk of known classes of errors. Monitoring, upgrade controls through a multisig with a timelock and a new review for every change are what keep that risk low afterwards.
Blockchain development
More blockchain development services.
Build the product
Connect your operations
Represent assets and rights
Blog
Related articles
Smart contract certification: what an audit demonstrates
What a smart contract audit should cover, how to verify its scope and why a report cannot guarantee security or legal compliance.
Hardhat vs Foundry: which to choose in 2026
Solidity and TypeScript tests, fuzzing, plugins and deployments: criteria for comparing Hardhat 3 and Foundry without context-free benchmarks.
OpenZeppelin and ERC-3643: how a security token is built
What OpenZeppelin libraries and ERC-3643 controls provide, and what a securities issuance also requires: rights, permissions, operations and review.
Let's build the rails for your product.
Send us the repository and the commit you want reviewed. We come back with the scope, the method and the audit timeline.
