Start 12-16 weeks before TGE, minimum. A thorough audit takes 4-8 weeks depending on codebase complexity, and you need buffer time for remediation and re-review. Projects that compress this timeline inevitably ship with unresolved findings or skip the re-audit entirely — both are unacceptable for a token launch.

The sequence matters: complete feature development first, freeze the codebase, then audit. Auditing a moving target wastes time and money. If your development timeline is still fluid, push TGE rather than cutting the audit short.