> For the complete documentation index, see [llms.txt](https://docs.moduluszk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.moduluszk.io/the-problem/an-industry-built-on-pricing-the-gap.md).

# An industry built on pricing the gap

Everything the industry calls security tooling exists to narrow the gap after the fact. None of it removes the gap, because none of it can: as long as the rule and the code are separate objects, they can disagree. 

The pricing of that disagreement is public. A standard DeFi protocol audit runs 50,000 to 100,000 dollars over three to six weeks; an L1, a bridge, or anything with a zero-knowledge component runs 150,000 to 500,000 dollars over two to six months; protocols with meaningful value at stake budget 150,000 to 500,000 dollars a year once contests, bounties and monitoring are counted (Sherlock, Zealynx and Procur3 market references, 2026). Good auditors book weeks ahead, and rush fees add 20 to 50 percent. Formal verification, the strongest tool on the shelf, sells at 20,000 to 50,000 dollars on top of an audit, and its vendors say plainly that it layers onto a manual review rather than replacing one. It has to, because there are still two artifacts to reconcile.

<br>