Smart contract audits: what they cover at a decentralized casino and what they don't
Checks 4 and 5 · contracts and audits
An audit is an outside firm reading the code before it holds money. Only two of the six live platforms we checked name their auditors: Azuro lists eleven reports, Dexsport links two. Three more say "audited" and stop there. Here is how to read an audit claim and how to check a contract address yourself.
Two of our five checks are about paperwork: are the contract addresses published, and has anyone outside the team reviewed the code. They sound dry. They are also the checks that most platforms calling themselves decentralized fail, and the ones that protect you from the most common way people lose money on-chain: signing a transaction for a contract that isn't the one they thought.
What an audit is
A security firm reads a platform's smart contracts before, or soon after, they go live, looking for bugs that could let someone take funds or break the rules. It writes a report listing what it found, how serious each issue is and whether the team fixed it. A good report names the contracts and the version it covered.
Who names their auditors
Azuro is the clear leader. Its developer hub lists eleven audits by protocol version:
| Version | Firm | Date |
|---|---|---|
| V3 | Maxim Timofeev (PayMaster contract) | April 2025 |
| V3 | Hexens | March 2025 |
| V3 | Pessimistic | March 2025 |
| V3 | Maxim Timofeev | March 2025 |
| V2 | HYDN | June 2024 |
| V2 | Pashov Audit Group | February 2024 |
| V2 | Codeshell | December 2023 |
| V2 | Pessimistic | April 2023 |
| V2 | Pashov Audit Group | March 2023 |
| V2 | Pessimistic | February 2023 |
| V2 | g0 group | January 2023 |
Every app built on Azuro, including Bookmaker.xyz, inherits that coverage for the protocol contracts.
Dexsport links a CertiK project page and a Pessimistic security analysis. The scope and dates weren't stated on the pages we read.
Overtime says each casino game is “a separate, audited smart contract”, and publishes the source on GitHub under an MIT licence. It doesn't name the auditor in its docs. WINR and JustBet describe audited contracts and an audited escrow without naming a firm. SX Bet and Gamba had no audit in the docs we read.
“Audited” with no name earns half a point in how we score, because it's a claim you can't check. A named firm with a report earns the point.
What an audit doesn't cover
- Later versions. Azuro's V2 reports don't cover V3. A protocol that upgrades after its audit is running unaudited code until the next one.
- Upgrade keys. Many contracts can be upgraded or paused by an admin key. Who holds it matters as much as the code.
- The website. A perfect contract behind a hijacked front-end still gets you to sign the attacker's transaction.
- The inputs. An audit checks that the contract uses the random number or the result correctly, not where it came from. That is the subject of where randomness comes from.
- Business behaviour. ZKasino's problem in 2024 wasn't a bug. Users' bridged ETH was converted into the project's token and sent to Lido. More on what went wrong.
Published contract addresses
The fourth check is simpler and just as useful. A platform that publishes its contract addresses lets you compare what you are about to sign with the real thing.
- Azuro publishes its liquidity pool, vault, bet and core contracts per chain; on Polygon the bet token is USDT.
- SX Bet publishes its escrow and USDC contracts on SX Rollup, chain 4162.
- Gamba publishes its program ID on Solana.
- BetSwirl published a bank contract per chain and a Dice contract, the same addresses on each EVM chain; they are still on-chain.
- Overtime publishes contract source rather than deployed addresses, which earns half.
How to check a contract before you sign
- Open the platform's docs and copy the contract address for the chain you are on.
- When your wallet asks you to sign, open the details and look at the “to” address, or the contract being approved.
- Compare the first and last six characters at least. If they differ, cancel.
- Paste the address into a block explorer. A real platform contract has a history of calls from many wallets.
- For token approvals, approve only the amount you plan to bet.
That routine takes a minute and blocks the most common drain. The rest of the habits are in safe play on-chain, and how the platforms compare on all five checks is on the decentralized casinos ranking.