From Audit Contests to Bug Bounties: Our Journey with Immunefi Audit Competitions
This article was written by the A2 Security Team.
At A2 Security, we specialize in securing lending protocols and have built a strong reputation through our extensive experience in audit contests, with over 15 top-five finishes. While we’ve refined our auditing skills, we’ve always been drawn to expanding our contribution to the security ecosystem through bug bounties. Protecting on-chain protocols aligns perfectly with our mission to enhance the safety of the ecosystem.
Although auditing pre-production code and identifying on-chain vulnerabilities may appear similar, they require different skill sets. Understanding this distinction, we embarked on our journey with Immunefi Audit Competitions—the leading platform in the bug bounty space—knowing that the first step is often the hardest.
In this article, we’ll explore key differences between traditional audit formats and bug bounties based on our experiences with Immunefi Audit Competitions. We’ll also share the mistakes we made and offer advice on how you can avoid them to succeed in your first Immunefi competition or bounty!
Key Differences Between Traditional Audit Contests and Immunefi Audit Competitions
1. Only Bugs with Real Impact are Considered Critical, High, or Medium
In traditional audit contests, bugs that aren’t immediately fixable or highly impactful can still be accepted. For example, an issue like “No partial liquidation allowed” might be considered medium-severity in audit engagements because it holds value for protocols during early development stages. However, in bug bounties and Immunefi Audit Competitions, these types of issues are generally classified as insights, which offer lower rewards and are not seen as critical.
Immunefi Audit Competitions take a more rigorous approach, focusing on the feasibility and real-world impact of vulnerabilities. Only bugs that lead to actionable fixes are classified as medium, high, or critical severity.
Our Advice: Ensure your submission includes a clear and well-documented Proof of Concept (PoC). Without strong evidence of the bug’s impact, the Triage Team may close your report before it reaches the sponsor for review.
2. Focus on the Most Impactful Bugs
In Immunefi Audit Competitions, high-impact bugs are divided into High and Critical categories, similar to bug bounty programs. This reward structure heavily favors critical vulnerabilities, making it crucial to prioritize high-impact findings.
For context: a solo critical bug can earn up to 39.6 shares of the prize pool, while a solo medium bug might only get 3.3 shares. This system encourages SRs to focus on finding critical and high-severity vulnerabilities, as these hold the greatest influence on the leaderboard.
Our Advice: Focus your efforts on identifying critical or high-impact bugs, especially if a critical vulnerability has already been reported. This will greatly improve your chances of ranking higher.
3. Real-Time Bug Validation and Closures
In most audit contests, bug evaluations and discussions occur after the event ends. However, Immunefi Audit Competitions operate on a faster timeline. Bugs are validated within 24 hours, providing real-time feedback.
A significant bonus is awarded to the first submitter of a confirmed bug. However, if your submission lacks sufficient detail (such as a PoC or a complete explanation of its impact), another researcher submitting the same bug with more thorough information can claim the bonus.
Our Mistake: In our first Immunefi Audit Competition, we rushed to submit issues without fully understanding their impact. This led to wasted time on escalations and discussions. In our eagerness, we neglected to properly prove the bug's significance.
Our Advice: Before submitting, invest time in thoroughly investigating the issue. Prepare a complete PoC, along with examples and explanations. A well-documented report will increase your chances of success and save time.
Our Story: Transitioning from Audits to Bug Bounties
At A2 Security, we broadened our horizons by transitioning to bug bounties through Immunefi Audit Competitions. Our first two competitions were a learning experience, where we placed 2nd in one and 1st in the other. However, the journey wasn’t without its challenges.
In our first competition, we made several mistakes, including rushing submissions and failing to fully research the impact of the bugs we found. These oversights caused confusion in explaining and proving the severity of the issues, leading to unnecessary back-and-forth and time wasted on escalations.
Through this process, we learned that while audit contests and bug bounties share some similarities, the mindset required is quite different. Immunefi Audit Competitions provide an ideal platform for security researchers (SRs) transitioning from traditional audits to bug bounties. The experience of submitting multiple issues, learning from mistakes, and adapting your strategy will fast-track your development in the competitive world of bug hunting.
Final Thoughts
Immunefi Audit Competitions offer a dynamic blend of audit contests and bug bounties. The fast-paced environment, real-time bug validation, and emphasis on impactful vulnerabilities create an excellent space for security researchers to grow and make meaningful contributions to on-chain protocol security.
For those considering a shift from auditing to bug bounties, Immunefi Audit Competitions are the perfect launchpad to sharpen your skills and contribute meaningfully to protocol security.
Put on your white hat, join the hunt, and get ready to make a difference!
