Security review competition will offer a bounty of $1.2M

$1.2 million is one of the largest amounts offered in a security review competition to date


Hyper-Set/Shutterstock modified by Blockworks


Blast, an upcoming optimistic Ethereum roll-up, is set to collaborate with Spearbit, a leading firm in Web3 security research, to offer a security review competition with a bounty pool of $1.2 million. The competition will use Cantina, Spearbit’s open marketplace for security auditors, to facilitate and manage the challenge.

This will be one of the largest reward bounties to be offered in a security review competition designed to attract solo security auditors. The previous largest bounty pool saw $1.1 million distributed to participants, where one competitor won over $500,000 in rewards. 

Harikrishnan Mulackal, co-founder of Spearbit Labs and former Compiler Engineer at the Ethereum Foundation, told Blockworks in an interview that anyone in the world can “get a share of the pie” by participating in this competition through reading the code and submitting bugs.

Read more: 20 BTC bounty from Human Rights Foundation up for grabs to improve Bitcoin network

Mulackal notes that security itself is an extremely layered process, and every layer tries to catch a certain class of bugs. 

“These competitions are one of the last layers in this security review process before things launch on mainnet,” Mulackal said. 

Prior to security review competitions, companies relied heavily on centralized cybersecurity firms to audit their code and systems, and conflicting opinions have emerged on which solutions are better for reviewing smart contracts, Alex Beregszaszi, co-founder of Spearbit Labs and research lead at the Ethereum Foundation’s Ipsilon team told Blockworks.

“A number of platforms running competitions believe it’s the best way to get coverage for finding bugs, because it can attract so many different people, and you are likely going to find every [bug],” Beregszaszi said. “On the other end, there is a thesis from so-called traditional auditing companies, where they think the best way to audit code is to have trained people who review on a weekly basis with different clients.”

Web3 security firm Halborn’s Chief Operating Officer David Schwed believes that both these approaches have their merits, and are recommended in a comprehensive review strategy. 

He notes that when security auditing firms are engaged to audit smart contracts, the process often involves dedicated engineers who spend extensive time analyzing the code and developing test cases to uncover potential unknown issues. 

“The major advantage of this method is the depth of the analysis, which is thorough and systematic. However, this approach limits the review to a point in time and specific codebase,” Schwed said. 

On the contrary, bug bounties can offer a different perspective, often being able to reach highly skilled individuals that a dedicated team may overlook. 

Read more: LayerZero, Immunefi offer bug bounty with $15M max payout

“One significant advantage is the potential for many eyes on the project, increasing the chances of finding varied types of vulnerabilities. However, a notable drawback is the lack of guarantee that individuals are actively searching for vulnerabilities or the assurance that all potential vulnerabilities will be identified,” he said.

Schwed adds that there is also an additional risk where participants may exploit found vulnerabilities for personal gain instead of reporting them. 

Spencer Macdonald, co-founder of Spearbit and advisor for the Foundation for American Innovation, emphasized the importance of robust security in the blockchain industry. He noted that, like traditional finance, the Web3 space demands a comprehensive defense strategy for effective oversight of smart contracts and protocols.

“You can’t just get one audit and call it a day, you have to continuously monitor your protocol. Then, as you iterate, you have to continually try to get better and harden your attack surface,” Macdonald said.

Mulackal agrees with this sentiment, adding that “We’re not maximalists who believe doing one of them is enough…there is this perpetual cycle of novel bugs getting discovered and protocols getting safer over time.”

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.


Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research



Aerodrome is a "MetaDEX" that combines elements of various DEX primitives such as Uniswap V2 and V3, Curve, Convex, and Votium. Since its launch on Base, it has become the largest protocol by TVL with more than $495B in value locked, doubling Uniswap's Base deployment.


The former Valkyrie CEO chats with Blockworks about what she has her eye on as Cypherpunk Holdings’ new leader


Thursday’s CPI report shows prices are coming down more quickly than analysts had anticipated, renewing hope that central bankers will cut rates in the fall


If we tokenize all assets in a speculative rush, the risk of creating illiquid markets and trapped value will manifest on a large scale


Plus, Trump is headed to the heart of Bitcoinlandia with a speaking appearance at the Bitcoin 2024 conference


Meanwhile, stocks rally after Jerome Powell finishes his Capitol Hill tour


Plus, Blinks have reshaped many people’s understanding of what blockchains are capable of