alix40

The Death of the Audit Contest? A 2025 Retrospective I will always be thankful for audit contest companies. They pioneered the open-sourcing of Web3 security knowledge, allowing security researchers (SRs) like myself to improve at a fast and consistent pace. However, looking back from 2025, it is clear that the landscape has shifted dramatically. 2024: The Golden Era 2024 was undoubtedly the best year in the history of Web3 audit contests. The volume of opportunities was unprecedented; almost every month featured a million-dollar prize pool, often with a dozen other contests running in parallel. The hype was strong, and the space was filled with highly trained competitors. During this time, the number of submissions was manageable, and "report spam" was significantly lower than what we see today. However, 2024 was also the beginning of the end for the traditional contest model. The Profitability Problem In the early days (pioneered by Code4rena), audit contest platforms typically charged a 40% margin on the total audit pot. Despite these large margins, most companies were burning through VC cash and failing to turn a profit. They were in "growth mode," prioritizing market share over sustainability. As the model's initial success became visible, it inspired a wave of new competitors. These companies introduced new models or used existing relationships with protocols to sell audits. This fierce competition was a win for protocols—they received high-coverage, deep-vulnerability reports as SRs competed to break their code—but it forced contest platforms into a "race to the bottom" on pricing. The Shift in Incentives To lower costs for clients, platforms had two options: - Reduce the SR Prize Pool: This led to "conditional pots" and custom rules that favored the client (e.g., defining a "High" severity only if >50% of TVL could be stolen). - Reduce Platform Fees: Platform fees shrank to 10%–20%, which is too low to sustain long-term growth or quality operations. This created two major shifts: For Platforms: They pivoted to private audits, which require less effort to manage and offer healthier margins. For SRs: The most capable researchers with personal brands grew tired of "unlocked" pots—where they could work for a month and earn $0 because a specific threshold wasn't met. These top-tier researchers moved to private auditing as freelancers or by joining major firms. The State of the Market in 2025 Today, most platforms are growing their profits by running fewer public contests and focusing heavily on the private/team audit sector. It no longer makes sense for them to sell a contest when a private audit is more efficient and profitable. For SRs, the ecosystem feels broken. The top talent has moved to private work, while public contests are increasingly flooded with low-quality spam reports fueled by the 2024 hype and AI-generated submissions. The original incentive alignment between SRs, protocols, and platforms has fractured. The Path Forward I want the "Golden Era" of audit contests to reemerge. To do this, we must fix the incentives: Healthy Margins: Platforms need to make enough profit to prioritize contests again. SR-Friendly Terms: We must enforce terms that protect researchers' time and attract top talent back to the public arena. Value for Protocols: By attracting the best researchers, protocols will once again receive the substantial security value that only a competitive environment can provide. I have avoided naming specific companies because my goal isn't to create drama or attack anyone. These thoughts are based on my own analysis and data from friends in the industry. My only goal is to propose a way for our space to innovate and thrive once more.

Contests aren’t dead yet, phases or a month or two where there’s little contests happen a lot , and has happened around the same times the last two years People are afraid of anything nowadays 🤷🏻‍♀️

🔒We're hiring developers! Valkyri is dedicated to building security toolsets & frameworks that matter for Web3 Security Space. Technical Requirements: - Golang - Frontend, UI/UX is a plus Interested? DM or email - [email protected]