Code complexity vs audit coverage

Evidence summary #

14+ audit engagements across 7 firms covering every major contract module: V1 core (Halborn 13-day, Veridise 9-day), V2 full stack (OZ 32-day Golang+EVM, Veridise 65-day EVM only, Halborn V2), Yield Bearing (OZ + Sherlock), StakeAndBake (ABDK), BridgeV2/BTC.b (OZ), Multipauser (OZ + Sherlock). Each successive audit targeted a specific feature set rather than the entire codebase, keeping scope focused and audit depth appropriate. OZ V2 at 32 days covering the most complex release (39 findings identified) demonstrates adequate depth. No indication of audit-complexity ratio exceeding reasonable bounds.

Sources #

Methodology #

Determine whether the cyclomatic complexity or LOC-per-audit-day ratio exceeds the curator-declared credibility threshold for the audit to be meaningful.

See the full factor methodology and distribution across all protocols →