Best Practices

Understanding Vulnerability Severity Scores for Smart Contract Audits

Kennedy OwiroNovember 8, 20257 min read

Every smart contract audit report classifies findings by severity. But what makes a finding "Critical" versus "Medium"? What should you fix immediately versus defer to the next release? Understanding severity classification helps you prioritize remediation, communicate risk to stakeholders, and make informed deployment decisions.

Severity Levels in Smart Contract Audits

🔴 Critical

Definition: Direct, exploitable vulnerability that leads to loss of all user funds, protocol takeover, or permanent protocol failure.

Examples: Unprotected admin function, reentrancy leading to fund drain, broken access control on withdrawals.

Action: Do NOT deploy. Fix immediately. Re-audit the fix.

🟠 High

Definition: Vulnerability that can lead to significant fund loss, unauthorized actions, or protocol manipulation under specific conditions.

Examples: Oracle manipulation possible with flash loans, missing slippage protection, governance without voting delay.

Action: Fix before deployment. Document any accepted risk.

🟡 Medium

Definition: Vulnerability with limited exploit impact or requiring unlikely conditions. May lead to partial fund loss or degraded protocol operation.

Examples: Precision loss in fee calculation, missing event emissions, centralization risk with single admin key.

Action: Fix if feasible. Document and monitor if deferred.

🔵 Low

Definition: Minor issues that are unlikely to be exploited but represent suboptimal security practices.

Examples: Floating pragma, unused variables, non-standard naming conventions.

Action: Good practice to fix. Not a deployment blocker.

ℹ️ Informational

Definition: Code quality suggestions, gas optimizations, and best practice recommendations.

Action: Consider for future improvements.

How Vultbase Scores Findings

Our scoring considers three factors:

  1. Impact: What's the maximum damage if exploited? (Fund loss, DoS, information leak)
  2. Likelihood: How easy is it to exploit? (Anyone can do it vs. requires specific conditions)
  3. Scope: Does it affect all users or a subset?
High ImpactMedium ImpactLow Impact
High Likelihood🔴 Critical🟠 High🟡 Medium
Medium Likelihood🟠 High🟡 Medium🔵 Low
Low Likelihood🟡 Medium🔵 Lowℹ️ Info

Communicating Findings to Stakeholders

  • ✅ Lead with Critical/High findings — these are deployment blockers
  • ✅ Provide clear remediation guidance for each finding
  • ✅ Track finding status: Open → In Progress → Fixed → Verified
  • ✅ Re-test all Critical/High fixes before considering the issue resolved

Every Vultbase audit report includes severity-scored findings with clear remediation steps. Get your first report and know exactly where your contracts stand.

CVSSseverityaudit findingsvulnerability classificationrisk scoring
Share

Written by

Kennedy Owiro

Founder & CTO, Vultbase

14+ years building security and QA systems at scale. Background in fintech security and Web3 smart contract testing. Built Vultbase's Intelligence Engine with 1,200+ exploit patterns from $40B+ in historical DeFi losses.

Protect your protocol before launch.

Submit your smart contracts for automated security analysis powered by 1,200+ real exploit patterns.

Start Your Audit →