Last updated Jul 21, 2026 · 16:57 UTC
Showing 241–260 of 295
59 audit contests236 bug bounty programs
| Protocol | Source | Prize | Window | Link |
|---|---|---|---|---|
|
Audit Comp | Immunefi Arbitration
|
Immunefi
Finished
|
$30K |
Mar 12 - Apr 02, 2024
21 days
|
View |
|
IOP | Hinkal
|
Immunefi
Finished
|
— |
Apr 16 - May 07, 2024
21 days
|
View |
|
Audit Comp | Alchemix
|
Immunefi
Finished
|
$125K |
Apr 30 - May 21, 2024
21 days
|
View |
|
IOP | Ionic
|
Immunefi
Finished
|
$4K |
Jun 12 - Jun 19, 2024
7 days
|
View |
|
Attackathon | Fuel Network
|
Immunefi
Finished
|
$1.0M |
Jun 17 - Jul 29, 2024
42 days
|
View |
|
Audit Comp | Folks Finance
|
Immunefi
Finished
|
$100K |
Jul 16 - Aug 06, 2024
21 days
|
View |
|
Audit Comp | Shardeum: Core
|
Immunefi
Finished
|
$500K |
Jul 08 - Aug 14, 2024
37 days
|
View |
|
Audit Comp | Shardeum: Ancillaries
|
Immunefi
Finished
|
$200K |
Jul 08 - Aug 14, 2024
37 days
|
View |
|
Audit Comp | Firedancer v0.1
|
Immunefi
Finished
|
$1.0M |
Jul 10 - Aug 21, 2024
42 days
|
View |
|
Audit Comp | IDEX
|
Immunefi
Finished
|
$45K |
Jul 30 - Aug 23, 2024
24 days
|
View |
|
IOP | ThunderNFT
|
Immunefi
Finished
|
$65K |
Aug 12 - Sep 02, 2024
21 days
|
View |
|
Audit Comp | Acre
|
Immunefi
Finished
|
$50K |
Aug 20 - Sep 03, 2024
14 days
|
View |
|
Audit Comp | Lido: Mellow Vault
|
Immunefi
Finished
|
$100K |
Aug 15 - Sep 05, 2024
21 days
|
View |
|
Mitigation Audit | Folks Finance
|
Immunefi
Finished
|
$25K |
Aug 27 - Sep 05, 2024
9 days
|
View |
|
Audit Comp | Shardeum: Core II
|
Immunefi
Finished
|
$150K |
Sep 04 - Oct 16, 2024
42 days
|
View |
|
Audit Comp | Shardeum: Ancillaries II
|
Immunefi
Finished
|
$100K |
Sep 04 - Oct 16, 2024
42 days
|
View |
|
IOP | Swaylend
|
Immunefi
Finished
|
$45K |
Oct 01 - Oct 22, 2024
21 days
|
View |
|
Audit Comp | Anvil
|
Immunefi
Finished
|
$50K |
Oct 16 - Nov 06, 2024
21 days
|
View |
|
Audit Comp | Anvil: Letters of Credit
|
Immunefi
Finished
|
$30K |
Nov 11 - Nov 22, 2024
11 days
|
View |
|
Audit Comp | Jito Restaking
|
Immunefi
Finished
|
$150K |
Nov 04 - Dec 02, 2024
28 days
|
View |
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi
Finished
Immunefi launched in 2020 and is the dominant ongoing-bounty platform in Web3. Unlike audit competitions which run for fixed windows, Immunefi bounties are ongoing programs where each valid vulnerability submission earns a direct per-bug reward. Critical-severity payouts have reached $15 million (Wormhole, MakerDAO). Immunefi also recently added time-boxed audit competitions.
This page shows only programs aggregated from Immunefi. For audit contests on other platforms, see the full Web3 audit competition tracker.
Six major platforms host the Web3 audit competitions and smart contract bug bounty programs aggregated above. Click any platform to see only its active contests.
| Platform | Type | Typical Prize | Contest Length | Best For |
|---|---|---|---|---|
Code4rena
|
Audit contests | $50K to $500K | 3 to 14 days | DeFi protocols pre-launch |
Sherlock
|
Contests + bounties | $50K to $300K | 7 to 30 days | Insurance-backed audits |
CodeHawks
|
Audit contests + First Flights | $5K to $200K | 3 to 21 days | Newer auditors building a track record |
Cantina
|
Mega-comps + bounties | $200K to $2M+ | 14 to 30 days | Experienced researchers, high-value protocols |
|
Immunefi
|
Ongoing bug bounties | Up to $15M per critical | Ongoing | Production protocol vulnerability hunting |
HackenProof
|
Bounties + crowdsourced audits | $1K to $1M+ | Ongoing or time-boxed | Managed Web3 programs and exchange/protocol bounties |
Immunefi has paid multiple $10M+ bounties for critical vulnerabilities. Notable payouts include $10M from Wormhole and $10M from MakerDAO. Critical-severity ceilings on the largest programs reach $15 million per finding.
Find the protocol's program page on immunefi.com, review the scope and severity classification, then submit a detailed proof-of-concept through the Immunefi platform. Submissions are triaged by Immunefi's in-house team before reaching the protocol team.
The leading Web3 bug bounty platforms are Immunefi (largest, $15M max payouts on DeFi protocols), Cantina (Spearbit's bounty program plus audit competitions), HackenProof (managed Web3 bounties and crowdsourced audits), Sherlock (audit contests with insurance-backed bounties), and Code4rena (best known for time-boxed audit competitions). Codehawks rounds out the field with Cyfrin-run contests focused on emerging protocols and beginner-friendly First Flights.
Cantina runs the largest audit competitions ($2M+ prize pools for protocols like EigenLayer and Uniswap v4). Immunefi pays the highest per-bug bounty (up to $15M for critical findings). Code4rena and Sherlock typically run $100K-$500K audit contests. Codehawks First Flights are smaller but accessible to newer auditors.
Audit competitions invite security researchers to review a protocol's smart contract code for a fixed prize pool over 1-4 weeks. Rewards are split based on unique valid findings, weighted by severity (critical, high, medium). Code4rena, Sherlock, Codehawks, and Cantina are the main platforms.
Top auditors earn $10,000-$500,000+ per competition. Cantina and Code4rena regularly run $500K-$2M prize pool contests. Bug bounties can pay up to $15M per critical finding on platforms like Immunefi.
Audit contests run for a fixed time window with a fixed prize pool shared among all valid findings. Bug bounties are ongoing programs where each valid submission earns a direct per-vulnerability reward (often $50K-$15M depending on severity). Bug bounties require finding a real vulnerability in production code.
Learn the most common vulnerability classes first: reentrancy, flash loan attacks, oracle manipulation, and access control. The SCH Smart Contract Hacking Course covers all the core attack patterns that audit competitions test, starting from zero experience.
A practical path from learning vulnerability classes to submitting your first contest finding.
Master reentrancy, access control, oracle manipulation, flash loan attacks, and arithmetic overflows. These five classes account for most contest findings.
Read every public report from past Code4rena and Sherlock contests. Try to spot findings yourself before reading the writeup. This is how every top auditor trained.
First Flights are small audit contests designed for newer auditors. Prize pools are under $20K, scope is small, and competition is lighter. They build real submission history.
Pick an active audit contest from the tracker above filtered by Solidity and a $50K-$200K prize range. Spend 20 to 40 hours on the contest, even if you only find one valid medium-severity issue.
Publish your findings, share writeups on Twitter and Mirror, and start accumulating valid submissions across multiple platforms. A documented track record is what opens bug bounty access and full-time auditor roles.