What a Blockchain Platform Costs: Contracts Are the Cheap Part

Smart contracts are often the first thing quoted when a blockchain project kicks off. They shouldn't be the last thing you budget for.

The contract code itself, for a moderately complex DeFi protocol or an NFT marketplace, might run you $30,000–$80,000 in development time. That sounds significant until you map out everything else the platform needs to actually function.

The Bill of Materials Nobody Shows You Upfront

A production blockchain platform has roughly six cost layers. The contract layer is one of them.

Layer	Examples	Rough cost range
Smart contracts	Solidity, Vyper, Rust (Solana)	$30k–$80k
Audit & formal verification	Trail of Bits, Certik, Halborn	$20k–$150k
Indexing & data layer	The Graph subgraphs, custom indexers	$15k–$60k
Frontend & wallet UX	Wagmi, Ethers.js v6, WalletConnect v2	$25k–$70k
Infrastructure & DevOps	RPC nodes, monitoring, failover	$10k–$40k/yr ongoing
Ongoing maintenance	Dependency patches, incident response	$5k–$20k/month

These ranges assume a single EVM-compatible chain. Cross-chain deployments multiply most of these numbers.

The audit line deserves its own discussion because it surprises almost everyone.

Why Does Auditing Cost as Much as Building?

A serious audit from a firm like Trail of Bits or Halborn for a protocol handling real capital is not a code review. It's adversarial analysis. Auditors reconstruct your threat model from scratch, write custom fuzzing harnesses, and sometimes apply formal verification tools like Certora Prover or Echidna to prove invariants mathematically rather than test them empirically.

For a protocol with 2,000–4,000 lines of Solidity, a single audit engagement typically runs four to eight weeks and costs $40,000–$100,000. A second opinion from a different firm, which is standard practice for anything holding more than $5M in TVL, doubles that.

The reason audits cost what they do is the asymmetry of failure. A critical vulnerability in a deployed contract is usually irrecoverable. You can't patch a blockchain. You can upgrade a proxy pattern, but upgradeable contracts introduce their own attack surface (storage collisions, initialiser exploits) that itself requires audit coverage.

Bug bounty programmes through Immunefi add another layer. A protocol with a $1M cap on bug bounties can expect to pay $10,000–$50,000/year in researcher payouts for valid medium and high severity findings, even after audit.

If your budget conversation treats audit as optional, the project is not ready to launch with real funds.

What Does Infrastructure Actually Look Like in Practice?

Most teams underestimate this layer because they start development against a public RPC endpoint like Infura or Alchemy and forget that those endpoints have rate limits, geographic latency variance, and service agreements that may not match your uptime requirements.

A production setup typically involves:

• A primary RPC provider (Alchemy Growth plan runs ~$199/month at moderate request volumes)
• A fallback node, either self-hosted via Erigon or Nethermind, or a second provider
• An archival node for historical state queries, which runs $500–$2,000/month depending on chain
• A monitoring stack: on-chain event listeners (often custom), Grafana dashboards, PagerDuty alerts for mempool anomalies or contract pauses
• A transaction management layer if you're running any automated keeper or relayer logic (OpenZeppelin Defender or a custom service)

The indexing problem is separate. Reading from a blockchain directly is slow and expensive for the query patterns a frontend needs. Subgraphs on The Graph Network handle a lot of this, but a complex protocol often outgrows the GraphQL schema limitations and needs a custom indexer backed by PostgreSQL or TimescaleDB. That's a real engineering effort with ongoing operational cost.

How Should You Think About Ongoing Maintenance?

This is where the cost model diverges sharply from traditional software.

In a standard web application, a security patch is a deployment. In a smart contract system, a security patch is a governance event, a timelock delay (typically 24–72 hours), a proxy upgrade transaction, and then monitoring to confirm nothing broke in the upgrade. If you're on an immutable contract, the patch is a migration with user communication, liquidity migration incentives, and sometimes a full relaunch.

Dependency risk is significant. The Solidity compiler itself has had compiler bugs affecting codegen in specific edge cases. OpenZeppelin's library has had critical vulnerabilities in widely used modules (the 2022 GovernorBravo compatibility issue, for instance). Tracking these, assessing applicability to your deployment, and deciding whether to patch is ongoing work.

A realistic maintenance budget for a live protocol:

• 1 engineer at 25–50% capacity for dependency tracking, incident triage, and upgrade preparation
• Quarterly re-audit of any changed modules ($10,000–$25,000 per engagement)
• On-call coverage with defined response SLAs if the protocol manages significant TVL

Teams that don't budget for this end up making reactive decisions under pressure, which is exactly the condition under which mistakes happen.

Is Building In-House Cheaper Than Outsourcing?

Straightforwardly: sometimes, but usually not in the first 18 months.

A senior Solidity engineer with meaningful DeFi protocol experience commands $150,000–$220,000/year in base salary in most markets. A frontend engineer fluent in Wagmi and WalletConnect, who also understands enough on-chain context to debug transaction failures intelligently, is in a similar range. You need both. You also need someone who can run the audit relationship, which is a skill set distinct from writing contracts.

The in-house route makes sense when:

• The protocol is core IP and you intend to iterate on it continuously for three or more years
• Your team already has two or more engineers with production EVM deployment experience
• You have the organisational capacity to manage the hiring, retention, and knowledge continuity risk

Outsourcing makes sense when the protocol is one product line among several, the timeline is under 12 months to launch, or you don't have an existing blockchain engineering function. The risk with outsourcing is knowledge transfer: if the development firm doesn't structure contracts to include documentation, test coverage above 90% on critical paths, and handoff sessions, you end up dependent on them for maintenance indefinitely.

At Sodio, we've seen both patterns. We work with clients who hand off to internal teams and with clients who keep us on retainer for maintenance. The handoff-ready model requires more investment upfront in documentation and test infrastructure, but it's almost always the right call for a client building long-term internal capability.

Conclusion

The contract code is the most visible artefact of a blockchain platform. It's rarely the largest cost driver when you account for audits, infrastructure, indexing, frontend integration, and ongoing maintenance over a realistic product lifecycle.

Before your next budgeting conversation, map out all six layers in the table above with realistic numbers for your chain, your TVL target, and your uptime requirements. The total will almost certainly be higher than your initial estimate, and knowing that before you start is significantly better than discovering it after launch.

If you're scoping a blockchain platform and want a second opinion on the architecture before committing to a budget, reach out to the team at Sodio.

FAQ

Are smart contract audits mandatory? Not legally, but practically yes if the contract holds user funds. A single critical vulnerability can drain a protocol entirely. Audits from reputable firms reduce that risk substantially. Two audits from independent firms is the standard for any protocol targeting more than $1M in TVL.

What's the difference between an audit and formal verification? An audit uses manual code review combined with automated tools and fuzzing to find vulnerabilities. Formal verification uses mathematical proofs, via tools like Certora or Echidna, to guarantee specific properties hold under all inputs. Formal verification is more expensive and time-consuming, but it's the strongest guarantee available for critical invariants.

How much does running a blockchain platform cost per month? Infrastructure costs for a production EVM platform typically run $2,000–$8,000/month in provider fees, depending on request volume and whether you self-host any nodes. Maintenance engineering adds $5,000–$20,000/month depending on protocol complexity and incident frequency. These are ongoing costs that don't go away after launch.

Can you deploy the same contract on multiple chains to reduce cost? You can deploy the same Solidity contract on any EVM-compatible chain. But each deployment is a separate audit surface, a separate infrastructure setup, and a separate operational responsibility. Gas economics also differ significantly between Ethereum mainnet, Arbitrum, and Polygon, so the same contract can behave very differently in terms of user cost.

When does it make sense to use an upgradeable proxy pattern? When the contract logic is likely to change due to regulatory requirements, protocol governance, or early-stage iteration. The trade-off is that upgradeable contracts introduce additional attack surface and require more complex audit coverage. For truly immutable logic (like a token contract with fixed supply mechanics), a non-upgradeable deployment is simpler and more auditable.

Have a project in mind? Contact Sodio Technologies to discuss your requirements and explore the right technology solution for your business.