What a smart contract auditor does
A smart contract auditor examines contract code before and after deployment to find vulnerabilities, logic errors and design weaknesses. The work combines manual line-by-line review with automated analysis, fuzzing and, on some engagements, formal verification. Auditors think like attackers: they look for ways to drain funds, manipulate prices, bypass access controls or break assumptions about how contracts interact with each other and with outside protocols.
For a protocol, exchange or custodian, an auditor protects users and reputation in ways that are hard to repair after a public exploit. An in-house auditor also shortens the cycle between code changes and review, and helps you get more from external audit firms. Finch screens for auditors whose findings have held up, who explain severity clearly and who can work with developers without turning reviews into conflicts.
Typical responsibilities
- Review smart contracts manually for vulnerabilities, logic flaws and unsafe assumptions
- Run static analysis, fuzzing and invariant tests with tools such as Slither, Echidna and Foundry
- Build threat models covering oracles, bridges, governance and economic attacks
- Write findings with severity ratings, proof-of-concept exploits and recommended fixes
- Verify that fixes resolve each issue without introducing new ones
- Advise developers on secure design patterns before code is written
Qualifications and credentials
- Strong Solidity and EVM knowledge, including low-level behaviour such as storage layout and delegate calls
- A portfolio of audit reports, published findings or results from public audit contests and bug bounty programs
- A background in software engineering, security research or penetration testing is common
- Familiarity with DeFi mechanisms such as lending markets, automated market makers and liquidations
- Experience with formal verification or Rust-based chains is an asset for some employers
Who hires a smart contract auditor
- Blockchain security and audit firms
- DeFi protocols with internal security teams
- Crypto trading platforms reviewing tokens and integrations
- Custody providers and digital asset infrastructure companies
Where we recruit smart contract auditor candidates
We fill smart contract auditor roles for employers across Toronto and the GTA, including North York, Scarborough, Etobicoke, Vaughan, Markham, Richmond Hill, Mississauga, Brampton, Oakville, Burlington, Oshawa and Pickering, and for employers across Canada. GTA employers can meet us at our North York office by appointment.
What Finch checks before you meet a candidate
- Published reports or findings, with the candidate's own contribution made clear
- A walk-through of a significant vulnerability they found and how they proved it
- Their review method, tooling and how they prioritize time on a large codebase
- Written communication, including how they rate and explain severity
- Conflicts of interest, confidentiality practices and eligibility to work in Canada
Interview questions to ask
- Tell me about the most serious issue you have found. How did you confirm it was exploitable?
- How would you approach a protocol you have never seen, with a large codebase and a short review window?
- When a developer disagrees with your severity rating, how do you resolve it?