Security review competition will offer a bounty of $1.2M

$1.2 million is one of the largest amounts offered in a security review competition to date

article-image

Hyper-Set/Shutterstock modified by Blockworks

share

Blast, an upcoming optimistic Ethereum roll-up, is set to collaborate with Spearbit, a leading firm in Web3 security research, to offer a security review competition with a bounty pool of $1.2 million. The competition will use Cantina, Spearbit’s open marketplace for security auditors, to facilitate and manage the challenge.

This will be one of the largest reward bounties to be offered in a security review competition designed to attract solo security auditors. The previous largest bounty pool saw $1.1 million distributed to participants, where one competitor won over $500,000 in rewards. 

Harikrishnan Mulackal, co-founder of Spearbit Labs and former Compiler Engineer at the Ethereum Foundation, told Blockworks in an interview that anyone in the world can “get a share of the pie” by participating in this competition through reading the code and submitting bugs.

Read more: 20 BTC bounty from Human Rights Foundation up for grabs to improve Bitcoin network

Mulackal notes that security itself is an extremely layered process, and every layer tries to catch a certain class of bugs. 

“These competitions are one of the last layers in this security review process before things launch on mainnet,” Mulackal said. 

Prior to security review competitions, companies relied heavily on centralized cybersecurity firms to audit their code and systems, and conflicting opinions have emerged on which solutions are better for reviewing smart contracts, Alex Beregszaszi, co-founder of Spearbit Labs and research lead at the Ethereum Foundation’s Ipsilon team told Blockworks.

“A number of platforms running competitions believe it’s the best way to get coverage for finding bugs, because it can attract so many different people, and you are likely going to find every [bug],” Beregszaszi said. “On the other end, there is a thesis from so-called traditional auditing companies, where they think the best way to audit code is to have trained people who review on a weekly basis with different clients.”

Web3 security firm Halborn’s Chief Operating Officer David Schwed believes that both these approaches have their merits, and are recommended in a comprehensive review strategy. 

He notes that when security auditing firms are engaged to audit smart contracts, the process often involves dedicated engineers who spend extensive time analyzing the code and developing test cases to uncover potential unknown issues. 

“The major advantage of this method is the depth of the analysis, which is thorough and systematic. However, this approach limits the review to a point in time and specific codebase,” Schwed said. 

On the contrary, bug bounties can offer a different perspective, often being able to reach highly skilled individuals that a dedicated team may overlook. 

Read more: LayerZero, Immunefi offer bug bounty with $15M max payout

“One significant advantage is the potential for many eyes on the project, increasing the chances of finding varied types of vulnerabilities. However, a notable drawback is the lack of guarantee that individuals are actively searching for vulnerabilities or the assurance that all potential vulnerabilities will be identified,” he said.

Schwed adds that there is also an additional risk where participants may exploit found vulnerabilities for personal gain instead of reporting them. 

Spencer Macdonald, co-founder of Spearbit and advisor for the Foundation for American Innovation, emphasized the importance of robust security in the blockchain industry. He noted that, like traditional finance, the Web3 space demands a comprehensive defense strategy for effective oversight of smart contracts and protocols.

“You can’t just get one audit and call it a day, you have to continuously monitor your protocol. Then, as you iterate, you have to continually try to get better and harden your attack surface,” Macdonald said.

Mulackal agrees with this sentiment, adding that “We’re not maximalists who believe doing one of them is enough…there is this perpetual cycle of novel bugs getting discovered and protocols getting safer over time.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates (19).png

Research

Suilend has grown into the top money market and liquid staking provider on Sui. STEAMM, Suilend’s Superfluid AMM, presents a compelling avenue for growing market share within Sui’s DEX landscape and revenue generation for the protocol. Suilend’s multi-product suite position it well for owning market share across key verticals. While current metrics across the Sui ecosystem are likely inflated due to Sui Foundation incentive programs, SEND trades at amongst the lowest multiples in the lend/borrow sector, suggesting that a bull case for continued growth in the ecosystem may be mispriced.

article-image

Strive board member Ben Werkman expects thousands of firms to hold BTC, if only “to protect themselves”

article-image

To date, 12.6 million humans have scanned at a World Orb

article-image

One small step for man, one giant leap for Bitcoin

article-image

Jay Woods, Chief Global Strategist at Freedom Capital Markets, said it would be “very rare” for an acquisition to happen since the IPO may occur as soon as next week

article-image

Sponsored

Money is one of the most consequential pieces of infrastructure, and M0 believes its architecture should serve builders, not extract from them

article-image

The financial backwaters they laughed at might be the only thing keeping the dollar afloat