Immunefi
Contact Our Team
Product

Audit Competitions

Find your criticals before launch, while your team can still fix them

Run an audit competition, put up a prize pool, and get two hundred researchers reviewing your code.

Contact our team

6.2 average critical and high findings per competition, against 1.5 per tier-1 audit

2 serious bugs found by the median competition. The median tier-1 audit finds zero.

71% of audit competitions surfaced at least one serious finding

$6,548 to find a critical or high in a public audit competition, against roughly $66K in a tier-1 private audit*

*Audit cost assumes $100,000 per report. Competition cost is researcher rewards only, before the Immunefi fee.

Product01/ 05What it is

You're buying all the best security researchers alive

An Immunefi audit competition puts hundreds of security researchers on your code for a fixed window before launch, and pays them from a reward pool you cap.

Spec sheet

Scope
Your code, before launch
Who does the work
Hundreds of AI-augmented researchers, alongside autonomous AI vulnerability-hunting systems
What you receive
Findings reach you sorted and pre-triaged, not as a flood of spam
How you pay
You pay the reward pool, which we help you size and structure, and the Immunefi fee, which covers the launch, triage, evaluation, disputes and the results report
Fig. 01Two hundred researchers reviewing your code

Product02/ 05The evidence

Audit competitions find far more bugs

Across 58 finished competitions, researchers surfaced 159 unique criticals and 361 unique critical-and-high findings.

Serious findings per engagementAverage
Immunefi audit competitions6.2
Tier-1 private audits1.5

1,178 published reports from Trail of Bits, Zellic and OpenZeppelin, and 58 Immunefi audit competitions

One report in six, against more than one competition in two

More than half of all competitions find at least one critical, and the ones that do average five.

The single best report in the 1,178-audit dataset found 21 critical-and-high issues. One Immunefi competition on a $100K pool found 43 double the best report any of the three firms has ever published.

Tier-1 private audits found a critical in 1 of 6 engagements.

Immunefi audit competitions found one in more than 1 of 2.

A serious bug for $6,548 before launch, or the same bug for $24.5M after it.

Contact our team

Product03/ 05Coverage

Audit competitions cover more code in the time you have

An audit assigns 2 to 5 people to your code for a fixed engagement. What they can realistically code review in that time is your ceiling on code coverage.

  1. Hundreds of researchers in parallel

    Recent Immunefi audit competitions each drew 952, 943, and 1,415 submissions. They aren't assigned to you; they show up because they think they can find something the others can't.

  2. AI hunters alongside them

    Competitions now field dozens of autonomous AI vulnerability-hunting systems. They read your code in parallel with the humans, and they don't get tired, bored, or out of time.

  3. The specialist your code needs

    A single protocol can touch smart contracts, bridges, oracles, MEV, liquidations, governance and economic design. An Immunefi audit competition practically guarantees the niche specialists your code needs are already hunting on it, matched to the exact module where their expertise pays off.

Case study

Flare's FAssets v1.1

In May 2025, we ran a $125K competition on Flare's FAssets v1.1 codebase, the same code that had been audited repeatedly since 2022, including a dedicated Core Vault review one month earlier that surfaced zero high-severity issues.

Over four weeks, 151 researchers filed 633 submissions, which surfaced 9 distinct high-severity, fund-loss bugs.

9 high-severity, fund-loss bugs 151 researchers, 633 submissions, four weeks

Product04/ 05Where it fits

Use all of them, all together

Audits still earn their place for architecture and design review, and bug bounties are essential the moment code is live.

  1. Brand-new code

    Architecture and design review

    A private firm is the right call for architecture review, design-intent and business-logic discussion, and the structured first pass on brand-new code.

  2. Before launch

    Audit competition

    For the most bugs found per dollar before launch, an audit competition wins on every metric.

  3. Once live

    Bug bounty

    Bug bounties are essential the moment code is live and funds are at risk.

    Bug Bounty Programs

Launching soon? If protecting everything you've built is the priority, let's talk.

Contact our team

Product05/ 05Questions

The honest objection to audit competitions

Q.01How do Audit Competitions work?

You set the number upfront

  • You set the terms. You define the scope, the reward pool, the dates, whether researchers need KYC, and the proof-of-concept standard.
  • We launch it to 85,000+ registered researchers. The live window runs for 1 to 4 weeks. Researchers pay a fee for each report they submit, which cuts spam.
  • Your team fixes as reports arrive. Our AI triage agent reviews every report on arrival and escalates the ones that need your review.
  • We close it out. After the window closes, we confirm severity, chief findings and duplicates, run the dispute window and payouts, and publish the findings once the pool is paid.
Q.02How are researcher rewards distributed?

Researchers eat only if they find what everyone else missed

Rewards are distributed to researchers based on the value of their individual bug reports as measured by Immunefi's grading criteria and weighted against all other submissions.

A pool tiered by severity pays out only for what researchers find, and 1 in 3 competitions paid out less than their cap.

Q.03How do Audit Competitions compare to other similar products on the market?

Audit competitions work best on Immunefi

Audit competitions are strongest on Immunefi, which can't be copied anywhere else.

  • The highest payouts on record pull the best hackers alive, and they bring their AI hunters with them.
  • Every finding, severity and payout is public at immunefi.com/audit-competition, including Firedancer V1, Base Azul and the Ethereum Protocol Attackathon.
  • Managed triage and AI triage agents mean findings reach you sorted and pre-triaged, not as a flood of spam.
  • Roughly 92% of every critical vulnerability disclosed in crypto flows through Immunefi, about 14x the nearest platform.
Q.04Won't AI spam and low-quality reports bury a small team?

Report overload is an almost-solved problem

Immunefi now prices out spam with pay-to-submit mechanics, so a junk report costs the sender something, and the flood thins out.

We run managed triage so your team isn't drowning in reports, and our AI triage agents are already showing strong results.

Q.05Haven't we just handed our unlaunched code to our attacker?

A competition front-runs exposure

The moment you launch, your code is already exposed to every adversary on earth, for free, with real money incentivizing a breach.

A competition doesn't create that exposure. You get the best hackers alive crawling your code before the funds are live, reporting to you instead of draining you, under disclosure rules and a budget you set and control.

End of fileAudit CompetitionsProduct

The obvious choice

If you're the founder with a launch date and a finite budget, and you want the most possible bugs found and code covered for the fewest dollars, an audit competition is the highest-ROI security money you can spend.

Two auditors, or two hundred researchers. You decide.

Contact our team
ProductAudit CompetitionsContact our team