Security review competition will offer a bounty of $1.2M

$1.2 million is one of the largest amounts offered in a security review competition to date


Hyper-Set/Shutterstock modified by Blockworks


Blast, an upcoming optimistic Ethereum roll-up, is set to collaborate with Spearbit, a leading firm in Web3 security research, to offer a security review competition with a bounty pool of $1.2 million. The competition will use Cantina, Spearbit’s open marketplace for security auditors, to facilitate and manage the challenge.

This will be one of the largest reward bounties to be offered in a security review competition designed to attract solo security auditors. The previous largest bounty pool saw $1.1 million distributed to participants, where one competitor won over $500,000 in rewards. 

Harikrishnan Mulackal, co-founder of Spearbit Labs and former Compiler Engineer at the Ethereum Foundation, told Blockworks in an interview that anyone in the world can “get a share of the pie” by participating in this competition through reading the code and submitting bugs.

Read more: 20 BTC bounty from Human Rights Foundation up for grabs to improve Bitcoin network

Mulackal notes that security itself is an extremely layered process, and every layer tries to catch a certain class of bugs. 

“These competitions are one of the last layers in this security review process before things launch on mainnet,” Mulackal said. 

Prior to security review competitions, companies relied heavily on centralized cybersecurity firms to audit their code and systems, and conflicting opinions have emerged on which solutions are better for reviewing smart contracts, Alex Beregszaszi, co-founder of Spearbit Labs and research lead at the Ethereum Foundation’s Ipsilon team told Blockworks.

“A number of platforms running competitions believe it’s the best way to get coverage for finding bugs, because it can attract so many different people, and you are likely going to find every [bug],” Beregszaszi said. “On the other end, there is a thesis from so-called traditional auditing companies, where they think the best way to audit code is to have trained people who review on a weekly basis with different clients.”

Web3 security firm Halborn’s Chief Operating Officer David Schwed believes that both these approaches have their merits, and are recommended in a comprehensive review strategy. 

He notes that when security auditing firms are engaged to audit smart contracts, the process often involves dedicated engineers who spend extensive time analyzing the code and developing test cases to uncover potential unknown issues. 

“The major advantage of this method is the depth of the analysis, which is thorough and systematic. However, this approach limits the review to a point in time and specific codebase,” Schwed said. 

On the contrary, bug bounties can offer a different perspective, often being able to reach highly skilled individuals that a dedicated team may overlook. 

Read more: LayerZero, Immunefi offer bug bounty with $15M max payout

“One significant advantage is the potential for many eyes on the project, increasing the chances of finding varied types of vulnerabilities. However, a notable drawback is the lack of guarantee that individuals are actively searching for vulnerabilities or the assurance that all potential vulnerabilities will be identified,” he said.

Schwed adds that there is also an additional risk where participants may exploit found vulnerabilities for personal gain instead of reporting them. 

Spencer Macdonald, co-founder of Spearbit and advisor for the Foundation for American Innovation, emphasized the importance of robust security in the blockchain industry. He noted that, like traditional finance, the Web3 space demands a comprehensive defense strategy for effective oversight of smart contracts and protocols.

“You can’t just get one audit and call it a day, you have to continuously monitor your protocol. Then, as you iterate, you have to continually try to get better and harden your attack surface,” Macdonald said.

Mulackal agrees with this sentiment, adding that “We’re not maximalists who believe doing one of them is enough…there is this perpetual cycle of novel bugs getting discovered and protocols getting safer over time.”

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

Mon - Wed, March 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience: Attend expert-led panel discussions and fireside chats Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts.

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Top Icon.png


Osmosis thrived in H2 2023 on the back of increased DeFi activity deriving from recently launched Cosmos-related projects and better market conditions. With new value accrual mechanisms for the native token, Osmosis is well-positioned to continue its strong performance in 2024.



Though the opposing flow trend is likely to slow over time, industry watchers note, bitcoin fund assets could one day eclipse the $90 billion gold ETF space


Celestia had the first mover advantage. EigenDA has staked ether. What sets Avail apart?


Bitcoin moved 1% higher Monday morning in New York, Matrixport analysts say $62,000 could happen next month


It’s hard to believe right now that crypto — even with all of its flexibility and massive capabilities — could ever be like cash on the internet


Michael Saylor announced Monday morning that MicroStrategy bought 3k more bitcoin after the X account was compromised over the weekend


Plus, Pudgy Penguins grows its brand and a group of Autoglyphs sell for $14.5 million