In crypto, “audit” almost always means one of two things, and neither is what a team needs before a launch. It means a smart-contract security review—reentrancy, overflow, access control—which says nothing about whether the economic design holds. Or it means a paid rating: a letter grade from AAA to D, a hexagon score, a “BB,” published without the checks that produced them—hard to reproduce and effectively impossible to contest.
A tokenomics audit is a third thing: an independent review of the economic design—the claims, the math, the market context, the on-chain reality, the mechanism, and the inputs underneath all of it. A protocol can pass a flawless code audit and still ship a fatal design flaw, because the two audits answer different questions. This article is the method we run, published in full: the six review tracks, the concrete pass/fail checks inside each, the severity ladder that ranks what they find, and a worked pre-mortem on a token that failed exactly these checks in public. None of it is framing you have to take on faith. You can run it yourself.
What it is not
A security audit reads the contract; a tokenomics audit reads the economy the contract enforces. OpenZeppelin, Hacken, and Trail of Bits will tell you whether the mint function can be called by the wrong address. They will not tell you whether the mint schedule inflates the token to zero, whether the only people with a reason to buy are the people already selling, or whether the “stable” asset is collateralized by its own demand. Those are design questions, and a clean code report is silent on every one of them. A serious launch needs both audits; confusing them is how a project ships an exploit-free contract around an economy that was never going to work. Where code and operations fail instead of design—compromised keys, malicious verifiers, blind-signed multisigs—is its own catalog, covered in our taxonomy of 2026’s hacks.
The six tracks
The method runs six tracks. Four are analytical passes over the material—claims, market, math, on-chain—and two, mechanism integrity and inputs, are lenses applied across those four. Every finding on every track is bound to a specific piece of evidence: a quoted sentence from the whitepaper, a cell in the model, a transaction on-chain, or a market reference with a capture date. A finding that cannot name its evidence is an opinion, and opinions do not go in the report.
Track 1: Claims and narrative
Pull every quantitative and mechanical claim from the whitepaper, deck, and public channels, then verify each against a primary source and against the model or contract that supposedly implements it. This is where the gap between what a project says and what it built shows up first.
| Check | Fails when | Typical severity |
|---|---|---|
| Every named-protocol fact is verifiable at a primary source and not contradicted by it | A claim is contradicted by its source or cannot be located | Critical |
| Every statistic, quote, and citation traces to its named origin | A number or attributed quote cannot be located at the source | Critical |
| Public “no X” promises survive contact with the mechanism | The design implements the opposite of what it promises | Critical / High |
| The document agrees with itself | Two numbers or two names for the same thing conflict | High |
| A stated, reachable reason to acquire and hold exists | The target buyer gets no yield, no utility, and no scarcity | Critical |
Track 2: Market context
Every external number—market size, competitor benchmark, a rival’s mechanic, a regulatory status—is verified against current data with a snapshot date. Markets move faster than whitepapers, and a comparison that was true at drafting is often false at launch.
| Check | Fails when | Typical severity |
|---|---|---|
| Every external rate and status carries a capture date and matches reality | A benchmark is stale enough to change the conclusion | High / Critical |
| Each described rival mechanic still works the way it is described | A protocol changed its model and the deck cites the old one | High |
| TAM, SAM, and SOM are sourced and reproducible | A market-size or competitor figure is unsourced or invented | High |
| Both ends of every range have support | One bound of a stated range rests on no source | High |
Track 3: Mathematics and formulas
Recompute every number the reader is shown, independently, from the model’s own inputs. Off-by-one errors in vesting schedules and supply that fails to reconcile across sheets are not rare edge cases—in our own reports they recur more than any other class of Critical.
| Check | Fails when | Typical severity |
|---|---|---|
| Total unlocks for each group equal that group’s allocation | A group releases more—or fewer—tokens than it holds | Critical |
| Every period reconciles: circulating = prior + emissions − burns | Any stated identity breaks between two sheets | High / Critical |
| Units are coherent across the model (currency, time, supply, %) | Percentages and token counts are mixed in one formula | High |
| Events at a schedule boundary do not silently vanish | A cliff or unlock at the horizon edge drops to zero unseen | Critical |
| An independent recompute reproduces every displayed figure | A headline number is off by a factor, not a rounding | Critical |
| No printed verdict contradicts the arithmetic on the same screen | The model says “loses money” while the net is positive | Critical |
A note on reachability: if a wrong number appears for any input combination a user can actually reach, it fails—the rarity of the combination is never a reason to downgrade it. The risk-management article covers the stress-test and VaR machinery that this track leans on.
Track 4: On-chain reality
Marketing numbers meet the chain. Claimed TVL, holder counts, treasury balances, and liquidity are checked against explorer and protocol data, not taken from a dashboard screenshot. The concentration and flow toolkit lives in our on-chain analytics guide; the audit applies it as a pass/fail gate.
| Check | Fails when | Typical severity |
|---|---|---|
| Holder concentration is healthy (CR₁₀ under ~70% ex-exchange/contract/treasury—a practitioner heuristic, not a standard) | The top ten wallets hold most of the free float | High |
| Max supply is an enforced on-chain invariant | Mint, freeze, or upgrade authority is still un-revoked | Critical |
| Withdrawable liquidity is material against FDV | A few thousand dollars of real depth backs a nine-figure cap | Critical |
| The pool has real bid-side support, not just ask-side inventory | A modest sell drops the price by tens of percent | Critical |
| Claimed TVL and volume survive an explorer and DefiLlama check | Stated growth just revalues its own inventory | High |
Track 5: Mechanism integrity
Does the system hold up under rational actors and stress? This is the track that separates a design that works from one that only works while everything goes up. Governance-specific checks draw on the voting-models breakdown; the unlock-cliff-versus-liquidity question is quantified in the vesting-benchmarks piece.
| Check | Fails when | Typical severity |
|---|---|---|
| Collateral price is independent of demand for the token it backs | The asset is collateralized by its own reflexive demand | Critical |
| Sink ≥ source at realistic activity, over the modeled horizon | Emission structurally outruns every burn and sink | Critical |
| “Exit first” is never the rational play on a shared, exhaustible pool | The design rewards front-running other holders’ exits | Critical / High |
| The system survives a 30/50/80% drop, a mass exit, an oracle failure | Any named stress scenario breaks the mechanism | Critical / High |
| Flash-loan, bribe, and treasury-capture vectors are closed | No snapshot-at-prior-block, timelock, or per-transaction limit | Critical |
| The largest scheduled unlock clears against real liquidity | A cliff dwarfs the pool’s turnover over its unlock window | High / Critical |
Track 6: Inputs and sources
A model is only as solid as its weakest input. This lens runs across the four analytical tracks: every number that drives a result is traced to where it came from and when.
| Check | Fails when | Typical severity |
|---|---|---|
| Every input has a source and a capture date | A result rests on an unsourced magic number | Medium / High |
| Simulations disclose their parameters and seeds | A distribution is asserted with no μ, σ, or seed to reproduce it | High / Medium |
| Every pass/fail threshold is cited or labeled a heuristic | A rule of thumb is presented as a hard fact | Medium |
| Result-changing conventions are stated | An undisclosed convention flips the headline number | Medium |
The severity ladder
Findings are ranked on five tiers, and the definitions go into the report so nothing is hand-waved.
- Critical—a false reader-facing number, fact, or verdict with no defensible reading, or a design flaw that structurally breaks the system. Requires two independent confirmations before it lands.
- High—materially misleading but not fatally false: a directionally-true exaggeration, a missing-but-needed safeguard, or a stale mechanic where the direction still holds.
- Medium—defensible but weak: disclosure that is necessary but insufficient, partial coverage, or an unsourced threshold.
- Low—cosmetic or documentation-completeness issues; the qualitative conclusion is unaffected.
- Note—an observation rather than a defect—including the positives, so the report is balanced and cannot be dismissed as a hatchet job.
The tiers are the easy part. What makes an audit worth more than a checklist is how findings get elevated, and three rules do most of that work:
- Cross-track corroboration becomes the verdict. A single flaw that surfaces independently on four tracks—as a claim, as broken math, as an on-chain fact, and as a mechanism failure—is no longer four findings. It is the top-line conclusion. A launch-blocking “do not ship” is almost never one finding; it is one flaw the whole method converges on.
- A defect active on defaults outranks one that needs an exotic input. A wrong number on the first screen, with no sliders touched, ranks above the same error reachable only through an unusual combination. This orders findings within a tier; it never sets one—rarity never downgrades a defect (a wrong number reachable at all still fails at full severity), it only decides what leads the executive summary.
- A recommendation is a claim, and gets fact-checked like one. The most insidious error we find is a false fact that entered a document through a previous audit’s own fix—a correction nobody verified. Any assertion inside a recommendation passes the claims track before it ships, or it becomes the next audit’s Critical.
A worked pre-mortem: Axie Infinity’s $SLP
Run the method backward on a public failure and it stops being abstract. Axie Infinity is usually remembered for the Ronin bridge hack—$625M in March 2022. That was an operational failure, and it is not what we are auditing here. The token-design failure was separate, it predates the hack, and it is the cleaner lesson: $SLP, the game’s reward token, was inflating toward zero long before a single key was compromised. The same project exhibited two independent failure modes—one code-and-ops, one design—which is the whole argument for running both.
Here is what the method flags, pre-mortem, on dated public facts:
| Failed check | Public evidence | Severity |
|---|---|---|
| Sink ≥ source (Track 5) | $SLP emitted from Adventure, PvP, and Daily Quest but had one sink—the breeding fee. Public mint-and-burn data put the daily ratio in the region of 2–3× through late 2021—and far higher at the peak of the scholarship boom—so the float rose with no ceiling. | Critical |
| “Exit first” / reflexive new-user dependence (Track 5) | The only sink, breeding, is demand from new players. When new-user inflow stalled, the sink evaporated while emission continued—a growth-dependent loop that unwinds the moment inflow stops. | Critical |
| Named-mechanic and market currency (Track 2) | $SLP fell from $0.3645 (2 May 2021) to $0.0094 (3 Feb 2022) to under $0.004 by mid-2022, roughly −99%. The “150 SLP ≈ $55” scholar wage in Manila became about $1.41. | High |
| A reachable reason to hold (Track 1) | The “sustainable play-to-earn” narrative rested on unit economics that only cleared while the player base grew. | High |
Notice the shape. This failure carries almost entirely on the mechanism track—two Critical checks—with market and claims corroborating. That is the common case for a public post-mortem: one track holds the verdict and the others confirm it. The four-track pile-up that makes a finding unarguable needs a live deck, model, and contract to cross-check against each other; a dead token no longer offers them, and a mechanism Critical blocks a launch on its own regardless.
Sky Mavis cut emissions on 8 February 2022—zeroing Adventure and Daily Quest $SLP, roughly 130M fewer tokens a day, a 56% cut to daily supply. By then the token had lost nearly all of its value against the May 2021 peak, and the loop had already unwound. A sink-source check on the model would have raised a Critical the day the schedule was written, not the day the price confirmed it.
The pattern is not unique to Axie. STEPN’s move-to-earn $GST repeated it in 2022—reward token emitted for activity, sinks (minting and repairing sneakers) all new-user-dependent, $GST falling to $0.18 by 13 June 2022, down over 90% in the six weeks from its early-May high, as reported monthly active users fell from over 2M to 482K. A regulatory shock was the trigger there, but the reflexive design was the precondition. Terra’s UST is the depeg cousin of this failure family, dissected in the stablecoin article; we use Axie precisely because it is a different failure—emission outrunning sinks, not collateral collapsing—and because it has not already been written to death.
When you run it
The honest limits
An audit reviews what already exists; it does not build the fix—that is a separate modeling engagement, and running the two together (audit to find, model to repair) is usually the right sequence. Without a model or specs detailed enough to reconstruct one, the math track goes qualitative: you can name the risk, but you cannot recompute the number. And every market and on-chain finding is dated—true on the day it was captured, worth re-checking before the report is six weeks old. The method is reproducible, which also means it is falsifiable: if a finding’s evidence does not hold, the finding does not either. That is the point. A rating you cannot contest is a rating you cannot trust.
Have a design to audit?
Send a model, a deck, a whitepaper, or an on-chain identifier. We read it cold and come back with severity-ranked findings, evidence bound to each one, and a recommended depth—full multi-track or a single focused track.
Get in touchThe takeaway
A tokenomics audit is not a letter grade, and it is not a code review. It is six tracks of concrete pass/fail checks, each finding bound to evidence and ranked by a severity ladder whose elevation rules are written down. The value is not in the tiers but in reproducibility: a method a founder, a CFO, or an investor can contest line by line and defend without the auditor in the room. Axie’s $SLP failed the sink-source check the day its emission schedule was drafted. The whole purpose of an open methodology is to catch that on paper—while it is still a design decision, and not yet a chart.