  An important problem in smart contract security is understanding the
likelihood and criticality of discovered, or potential, weaknesses in
contracts. In this paper we provide a summary of Ethereum smart contract audits
performed for 23 professional stakeholders, avoiding the common problem of
reporting issues mostly prevalent in low-quality contracts. These audits were
performed at a leading company in blockchain security, using both open-source
and proprietary tools, as well as human code analysis performed by professional
security engineers. We categorize 246 individual defects, making it possible to
compare the severity and frequency of different vulnerability types, compare
smart contract and non-smart contract flaws, and to estimate the efficacy of
automated vulnerability detection approaches.
