Security review competition will offer a bounty of $1.2M

$1.2 million is one of the largest amounts offered in a security review competition to date

article-image

Hyper-Set/Shutterstock modified by Blockworks

share

Blast, an upcoming optimistic Ethereum roll-up, is set to collaborate with Spearbit, a leading firm in Web3 security research, to offer a security review competition with a bounty pool of $1.2 million. The competition will use Cantina, Spearbit’s open marketplace for security auditors, to facilitate and manage the challenge.

This will be one of the largest reward bounties to be offered in a security review competition designed to attract solo security auditors. The previous largest bounty pool saw $1.1 million distributed to participants, where one competitor won over $500,000 in rewards. 

Harikrishnan Mulackal, co-founder of Spearbit Labs and former Compiler Engineer at the Ethereum Foundation, told Blockworks in an interview that anyone in the world can “get a share of the pie” by participating in this competition through reading the code and submitting bugs.

Read more: 20 BTC bounty from Human Rights Foundation up for grabs to improve Bitcoin network

Mulackal notes that security itself is an extremely layered process, and every layer tries to catch a certain class of bugs. 

“These competitions are one of the last layers in this security review process before things launch on mainnet,” Mulackal said. 

Prior to security review competitions, companies relied heavily on centralized cybersecurity firms to audit their code and systems, and conflicting opinions have emerged on which solutions are better for reviewing smart contracts, Alex Beregszaszi, co-founder of Spearbit Labs and research lead at the Ethereum Foundation’s Ipsilon team told Blockworks.

“A number of platforms running competitions believe it’s the best way to get coverage for finding bugs, because it can attract so many different people, and you are likely going to find every [bug],” Beregszaszi said. “On the other end, there is a thesis from so-called traditional auditing companies, where they think the best way to audit code is to have trained people who review on a weekly basis with different clients.”

Web3 security firm Halborn’s Chief Operating Officer David Schwed believes that both these approaches have their merits, and are recommended in a comprehensive review strategy. 

He notes that when security auditing firms are engaged to audit smart contracts, the process often involves dedicated engineers who spend extensive time analyzing the code and developing test cases to uncover potential unknown issues. 

“The major advantage of this method is the depth of the analysis, which is thorough and systematic. However, this approach limits the review to a point in time and specific codebase,” Schwed said. 

On the contrary, bug bounties can offer a different perspective, often being able to reach highly skilled individuals that a dedicated team may overlook. 

Read more: LayerZero, Immunefi offer bug bounty with $15M max payout

“One significant advantage is the potential for many eyes on the project, increasing the chances of finding varied types of vulnerabilities. However, a notable drawback is the lack of guarantee that individuals are actively searching for vulnerabilities or the assurance that all potential vulnerabilities will be identified,” he said.

Schwed adds that there is also an additional risk where participants may exploit found vulnerabilities for personal gain instead of reporting them. 

Spencer Macdonald, co-founder of Spearbit and advisor for the Foundation for American Innovation, emphasized the importance of robust security in the blockchain industry. He noted that, like traditional finance, the Web3 space demands a comprehensive defense strategy for effective oversight of smart contracts and protocols.

“You can’t just get one audit and call it a day, you have to continuously monitor your protocol. Then, as you iterate, you have to continually try to get better and harden your attack surface,” Macdonald said.

Mulackal agrees with this sentiment, adding that “We’re not maximalists who believe doing one of them is enough…there is this perpetual cycle of novel bugs getting discovered and protocols getting safer over time.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (1).jpg

Research

As AI supercharges surveillance, privacy becomes a prerequisite and the winning stack will combine confidentiality with selective disclosure. Zcash’s Tachyon, composable standards on Ethereum/Solana, and compliance-aware pools aim to make private rails the new norm.

article-image

375ai will hold TGE at the end of the month, CEO Harry Dewhirst told Blockworks

article-image

Block’s subsidiary adds direct Bitcoin integration and AI-powered ordering tools for small businesses seeking streamlined transactions

by Blockworks /
article-image

The deal integrates Dinero’s staking suite into Plume’s real-world asset platform as it gains SEC transfer agent status

by Blockworks /
article-image

The state’s decision opens staking access to New Yorkers, signaling a regulatory shift toward broader crypto participation

by Blockworks /
article-image

The startup says it aims to rival Stripe and Worldpay by using stablecoins to speed merchant settlements from days to seconds

by Blockworks /
article-image

“S&P 500” for crypto comes as segment gains “established role in global markets,” S&P exec says