Mutation Testing for Solidity: The Audit Quality Metric Your Protocol Is Ignoring

Mutation Testing for Solidity: The Audit Quality Metric Your Protocol Is Ignoring Your test suite shows 100% line coverage. Every function is touched, every branch is hit. Ship it, right? Not so fast. In Q1 2026 alone, DeFi protocols have lost over $137 million to exploits — and many of those protocols had "comprehensive" test suites and professional audits. The uncomfortable truth: line coverage tells you what code your tests execute, not what bugs they would catch. This is where mutation testing comes in — and it's the most underused weapon in the Solidity security toolkit. What Mutation Testing Actually Does The core idea is deceptively simple: Take your contract code Introduce a small, deliberate bug (a "mutant") Run your test suite If your tests still pass → your tests have a blind spot Each surviving mutant represents a class of bugs your test suite cannot detect. A flipped >= to >, a removed require check, a swapped + to - — if none of your tests notice, that's exactly the