Code4rena Is Winding Down. Your Audit Plan Is Out of Date
19 min
On this page▾
TL;DR
- Nine kinds of product can get your contracts reviewed today: audit firms, independent researchers, audit contests, bug bounties, free tools, AI review, ecosystem subsidies, short scoped reviews, and monitoring or cover after launch. They are not substitutes. Each one checks a different slice.
- Most providers publish no prices. The public figures that do exist are for tools (free), AI credits, bounty platform fees, contest prize pools and a few fixed-price short reviews.
- The contest market moved this year. Code4rena's homepage says it is winding down, and Sherlock and Cantina now sell AI-assisted or hybrid reviews next to human ones (all checked 3 Nov 2026).
- The gaps that hurt early teams are the price you only learn after asking, the wait, a scope that assumes frozen code, and what happens after the findings land.
- A workable path runs from free tools in CI, through a short scoped review or a subsidised audit, to a full audit before real value arrives, with a bounty and monitoring once you are live.
Code4rena's homepage now opens with one line: "Code4rena is winding down." The same page says active competitions and bounties are being seen through to completion. If your plan from last year had a Code4rena contest in it, that plan needs a second look.
It isn't the only change. Sherlock now lists an Audit Engine that runs AI auditors and human researchers in one engagement. Cantina's site leads with Apex, an AI security product. The Ethereum Foundation put $1M into subsidising audits for mainnet builders in April 2026. The map most founders carry in their head is out of date.
So this is the map as of 3 November 2026, for a founder or developer working out how to get their contracts reviewed: each kind of review, providers whose public pages back what we say, how it is priced where a public page says so, how fast it is, and where it leaves you exposed. Links to every page are in Sources.
Zealynx is an audit firm and sells some of these things. Where we have an offer in a category, we say what it is in one line so you can weigh it. We don't rank anyone, and where a provider publishes no price we say that instead of guessing.
The market on one page
| Option | Examples (checked 3 Nov 2026) | How it is priced | How fast | Main gap |
|---|---|---|---|---|
| Audit firm | OpenZeppelin, Trail of Bits, Cyfrin | Quote per scope; none of the three lists a price | Set at scoping | You learn the cost floor and the start date only after asking |
| Independent researchers and small groups | Pashov Audit Group; quote marketplaces such as Areta Market | Quote per scope | Pashov: 3 to 5 days for one focused contract | Quality depends on the people; vetting them is your job |
| Audit contest | Sherlock, Cantina, CodeHawks, Immunefi | You fund a prize pool; platform terms set when booking | Sherlock: about 3 days at ~500 nSLOC, about 38 days at ~6,000 | Coverage follows the pool; fix review is sometimes a separate step |
| Bug bounty | Immunefi, Cantina, Sherlock | Pay per valid finding, by severity; Immunefi charges a 10% platform fee on payouts unless you take its annual subscription | Continuous | Only useful once code is deployed or about to be |
| Free tools | Slither, Aderyn, Echidna, Medusa, Foundry, Halmos | Free and open source | Minutes, in CI | Finds patterns and broken properties you wrote down, not your intent |
| AI review | Krait, Nethermind AuditAgent, Sherlock Audit Engine, Cantina Apex | Free (Krait), starting credits (AuditAgent), quote (the others) | Minutes to days | Misses most logic bugs on its own; nobody signs for what it missed |
| Subsidies and grants | Ethereum Security Subsidy Program, Arbitrum Audit Program, firm-run grants | Covers part or all of an audit | Application cycles | Eligibility, timing and conditions such as chain exclusivity |
| Short scoped review | Trail of Bits Early Stage Assessment, Pashov focused review, Immunefi PR Reviews | Quote, or a fixed price where one is published | Days | Covers the agreed surface only |
| Monitoring and cover | OpenZeppelin Monitor, Hypernative, Nexus Mutual, Sherlock Shield | Open source, demo request, or cover premiums | Continuous | Acts after the code ships; finds nothing before |
The rows below say what each one actually gives you.
Audit firms
A firm assigns named researchers to a fixed commit for a fixed number of days, writes a report, and checks your fixes. OpenZeppelin's audit page describes four stages, ending in a fix review where researchers "meticulously review the fixed issues" before the final report. Trail of Bits says it will "re-test patches when the work returns" and that Slither, Echidna and Medusa, which much of the industry audits with, are its own tools. Cyfrin describes its audits as manual review with "mitigation support".
None of those three pages lists a price, a minimum engagement or a lead time. That is normal for the category, and it is the first gap for a small team: you find out whether a firm will take a small scope, and what it costs, only after a scoping call. Our scoping guide covers what a firm needs from you to give a real quote, and Sherlock's public timeline table (in the contests section below) is a decent proxy for how review time grows with code size.
Independent researchers and small groups
A lot of the people who place well in contests also take private work, alone or in small groups. The appeal is speed and direct contact with whoever reads your code. Pashov Audit Group says every audit is done by a team of four senior researchers, that a focused review of a single contract can take 3 to 5 days, a complex DeFi protocol roughly 2 to 4 weeks, and that audits can start within 24 hours. Those are the group's own claims.
If you'd rather compare several quotes, marketplaces do the matching. Areta Market says requesting quotes is free for builders (providers pay it a referral fee), that quotes arrive within 48 hours and that audits kick off within a week.
Vetting is on you. A one or two person review is as deep as those people, so read their past public reports, check their contest history, and ask before signing whether a fix review is included, because not every page says.
Audit contests
You put up a prize pool, the platform opens your code to many researchers for a fixed window, judges remove duplicates and settle severities, and you get the deduplicated findings. Competitive audits buy breadth: many different people reading the same code.
Sherlock's contest page describes a senior review pass by a Lead Senior Watson, then hundreds of researchers in parallel, then the Senior Watson returning after your patches "to review the changes and confirm the final state". Its docs publish how long a contest runs by code size:
| nSLOC | Sherlock contest timeline |
|---|---|
| ~500 | ~3 days |
| ~1,000 | ~6 days |
| ~3,000 | ~18 days |
| ~6,000 | ~38 days |
Cost is set at scoping and isn't published. What is public is the pools. CodeHawks' contest listing showed pools from 3,200 USDC to 500,000 USDC, in public, private and invite-only formats. Cantina's opportunities page listed one live competition, with a 50,000 USDC pool, next to dozens of bounties. Immunefi runs audit competitions with a capped rewards pool and includes free managed triage during them.
Code4rena's listings show how the after-findings step can work in this model: its mitigation reviews were separate listings with their own pools (4,000 USDC and 12,000 USDC on its homepage). The platform is winding down, so treat that as a pattern to ask about, not a place to book.
Where contests fall short: they need a frozen commit, coverage follows the size of the pool, and a public contest means your code is read by everyone who joins.
Bug bounties
A bug bounty pays researchers for valid findings in code that is already live, scaled by severity. Immunefi describes reports arriving with proof of concept and impact analysis, triage by AI agents and human triagers, and suggests running an audit competition before launch and a bounty "from the day you deploy, including a capped launch". Its annual subscription "removes the 10% platform fee on all payouts". Cantina and Sherlock also run bounties with triage.
A bounty costs little until someone finds something, and then it can cost a lot. That is how it should work. The gap is timing. A bounty reviews nothing before you deploy, so it sits after a review, not in place of one.
Free and open-source tools
Every team should run these, whatever else they buy:
- Static analysis: Slither (Solidity and Vyper) from Trail of Bits' crytic organisation, and Aderyn from Cyfrin, which plugs into your editor.
- Fuzzing: Echidna and Medusa, both from crytic, plus Foundry's built-in fuzz and invariant tests.
- Symbolic testing: Halmos, from a16z.
They are free, they run in CI, and they remove the bugs a reviewer would otherwise spend paid hours on. They know patterns and the properties you wrote down. None of them knows that your liquidation path was supposed to work when the oracle is stale. Our pre-audit checklist covers setting them up before a review.
AI review
Public numbers matter more here than anywhere else in this map, so these are the ones vendors have published about their own tools.
Nethermind ran its AuditAgent across 29 of its own audits and reported, in October 2025, that it found valid issues in 62% of projects and 30% of all auditor findings, and that it "still produces noise that requires expert filtering". New AuditAgent accounts start with $50 in credits, which its docs put at roughly 1,000 billable lines. Sherlock's Audit Engine comes in three depths, from "fast AI-led coverage" to "full-scale AI + human review", priced by quote. Cantina's Apex is pitched as AI code security and pentesting that proves exploitable paths and verifies fixes.
Krait is ours: an open-source (MIT) AI auditor, free at krait.zealynx.io, built as a pre-audit check, not a replacement for an audit.
AI review is cheap and fast enough to run on every pull request, and on its own it still misses most of what human reviewers find, especially logic that depends on what the protocol is meant to do. Nobody is accountable for what it didn't report.
Ecosystem subsidies and grants
Some chains and foundations pay part of the audit bill.
The Ethereum Foundation's Ethereum Security Subsidy Program, announced in April 2026, put up $1M through Areta Market. The Block reported that selected projects can have up to 30% of their audit costs covered, that new cohorts are chosen monthly, and that more than 20 firms take part. Nethermind's page on the program says applications run in rolling cohorts through the year.
The Arbitrum Audit Program was announced on 1 August 2025 as $10M in ARB over 12 months to subsidise third-party audits. Applications are reviewed on a rolling basis by an Arbitrum Audit Committee, approved firms are matched with projects, and firms are compensated "partially or fully". Only new or significantly modified code qualifies, and the audited code must stay exclusive to Arbitrum for a set period. The 12-month window means you should confirm the program is still accepting projects before planning around it.
Some audit firms run their own grant rounds too. Ours, Zealynx Audit Grants, pays 25%, 50% or 100% of a Zealynx engagement as credit; Season 2 applications are closed, and updates are posted at grants.zealynx.io.
Timing and conditions are what bite. A cohort that selects monthly doesn't help a launch next week, a partial subsidy still leaves you paying the rest, and chain exclusivity is a real business decision.
Short scoped reviews
Between "tools only" and "full audit" there is now a real middle: a few days of senior time on the part of the system that holds or moves the money.
Trail of Bits offers an Early Stage Assessment for projects "early on in their SDLC but are ready to receive feedback", including ones where the code isn't finalised, and a separate Design Assessment. Pashov's focused single-contract review of 3 to 5 days fits here too. Immunefi PR Reviews put researchers on your pull requests while you build.
Some firms now sell this as a fixed-price entry point. Ours is the Founder Security Sprint: three days on your agreed highest-risk contracts for $1,500, with an audit report, one fix re-check round and 12 months of Zealynx Insiders, and the $1,500 comes off a Zealynx full audit booked within 12 months.
The limit is in the name. A scoped review covers the agreed surface, so it tells you nothing about the contracts outside it, and it isn't a release sign-off for the whole protocol.
Monitoring and cover
These sit after the code ships, and our post-audit security article goes deeper on them.
OpenZeppelin Monitor is an open-source service that watches for on-chain activity you define and sends notifications. Hypernative offers real-time on-chain and off-chain monitoring with automated response; its site asks you to request a demo. On the cover side, Nexus Mutual offers cover for smart contract hacks, custody failure, slashing and depegs. Sherlock Shield covers certain bounty and exploit payouts after launch, up to $500,000, but only for code that went through a Sherlock audit with an approved fix review, and it is not included by default.
None of these finds a bug before launch. They shorten how long an exploit runs, or pay part of the loss, and our audit vs insurance piece covers how cover and review fit together.
The gaps, mapped
| Gap | Where the market stands (checked 3 Nov 2026) | What to ask a provider |
|---|---|---|
| Cost floor | Tools are free, AI has free or credit tiers, bounties publish fees, and only a few short reviews publish a price. Firms and contests quote per scope. | What is the smallest scope you take, and what does it cost? |
| Wait time | Few pages state a lead time. Claims run from "start an audit in 24 hours" (Pashov) to a team "in days, not months" (Sherlock collaborative audits); contests run about 3 to 38 days by size. | When can you start, and when do I get the report? |
| Scope fit | Full audits and contests need a frozen commit. Early-stage assessments and PR reviews take code that still moves. | Do you review a fixed commit or a moving branch? |
| Depth | Contest depth follows the pool, AI recall is published and low, firm depth depends on who is staffed and for how long. | Who reads the code, and for how many days? |
| After the findings | OpenZeppelin and Trail of Bits describe fix review; Sherlock's Senior Watson returns after patches; Code4rena ran mitigation reviews as separate listings. | Is a fix review included, and how many rounds? |
| Early-stage fit | Trail of Bits Early Stage Assessment and Immunefi PR Reviews take unfinished code; most other products assume it is done. | Can you help before the code is frozen? |
Two of those rows need more than a line. One is what happens after the findings. A report is a list of problems, and the patches you write under deadline are new code nobody has read; if the fix review is a separate purchase, budget for it before you book. At Zealynx the fix review is included in every engagement at no additional cost.
The other is early-stage fit. While the code changes every week, most of what you need is someone to pressure-test design decisions, not a review of a commit you'll replace; our still-building guide covers what to settle in that phase. Zealynx Insiders, at $50 a month or $500 a year, is that kind of help: advice and feedback from our founder while you build, not a full audit or ongoing code review.
How to choose
The path from free to full follows the state of your code, not your budget alone.
| Where you are | What fits | What it won't do |
|---|---|---|
| Code still moving, no user funds | Static analysis and fuzzing in CI, an AI pass on meaningful changes, design feedback or an early-stage assessment | Tell you the shipped code is safe |
| Code freezing, launch in sight | A short scoped review of the contracts that hold or move value, or a subsidy application if you're eligible and the timing works | Cover the contracts outside the agreed scope |
| Before real value arrives | A full audit or a contest, with a fix review, on a frozen commit | Describe any commit after the one reviewed |
| Live | A bug bounty, monitoring, cover if it fits, and a fresh review for each upgrade | Find bugs before an attacker does, on its own |
You don't have to do every row, and you don't have to do them with one provider. A small team with no funding can get far on the first row and one scoped review. A team about to hold other people's money needs the third row, whoever does it. Our audit timeline covers when each step usually lands.
FAQ
1. Is an AI review enough before launch?
Not on the numbers vendors publish about their own tools. Nethermind reported that AuditAgent found 30% of the findings its auditors found across 29 audits, and Krait's own site calls it pre-audit verification, not audit replacement. Run AI review often, and treat what it misses as the reason you still need people.
2. We planned a Code4rena contest. What now?
Code4rena's homepage says it is winding down and that active competitions and bounties are being seen through to completion. If yours hasn't started, the same format is offered by Sherlock, Cantina, CodeHawks and Immunefi. Ask each one how the fix review works, since that step differs between platforms.
3. Can I use an ecosystem subsidy with any auditor?
Usually not. The Ethereum Security Subsidy Program runs through Areta Market's network of participating firms, and the Arbitrum Audit Program matches eligible projects with the firms it approved. A firm-run grant, such as ours, applies only to that firm's own engagements. Check the auditor list before you apply.
Glossary
| Term | Definition |
|---|---|
| Audit Scope | The defined boundaries of a security audit, specifying which contracts, functions, and concerns will be reviewed. |
| Competitive Audit | Public security review where multiple auditors compete to find vulnerabilities with rewards based on severity and discovery priority. |
| Bug Bounty | Reward program incentivizing security researchers to find and report vulnerabilities before malicious exploitation. |
| Fix Verification Round | A second review to confirm that patches actually fix the reported vulnerabilities without introducing new ones. |
| Static Analysis | Automated examination of smart contract code without executing it to identify potential vulnerabilities, bugs, and code quality issues. |
| Code Freeze | Halting all changes to the audited codebase from kickoff through final report delivery, locking the audit to a specific commit hash. |
Sources
All pages checked on 3 November 2026 unless a date is given.
- Code4rena homepage, "Code4rena is winding down", mitigation review pools: code4rena.com
- Sherlock audit contests (Lead Senior Watson, fix review after patches): sherlock.xyz/solutions/audit-contests
- Sherlock contest timeline by nSLOC: docs.sherlock.xyz, audit pricing and timeline
- Sherlock collaborative audits ("in days, not months"): sherlock.xyz/solutions/collaborative-audits
- Sherlock Audit Engine (Light, Comprehensive, Intensive): sherlock.xyz/solutions/audit-engine
- Sherlock Shield (up to $500,000, Sherlock audit and fix review approval required): sherlock.xyz/solutions/sherlock-shield
- Cantina (Apex, bounties, onchain security): cantina.security and cantina.security/web3
- Cantina opportunities (one 50,000 USDC competition live when checked): cantina.xyz/competitions
- CodeHawks contest listing (pools from 3,200 USDC to 500,000 USDC; public, private and invite-only): codehawks.cyfrin.io
- Immunefi bug bounties (10% platform fee removed by the annual subscription): immunefi.com/bug-bounty-program
- Immunefi audit competitions (capped rewards pool, free managed triage): immunefi.com/audit-competitions
- Immunefi PR Reviews: immunefi.com/pr-reviews
- Immunefi homepage (competition before launch, bounty after deploy): immunefi.com
- OpenZeppelin security audits (four stages, fix review): openzeppelin.com/security-audits
- Trail of Bits blockchain services (re-testing patches, Early Stage Assessment, Design Assessment, Slither, Echidna, Medusa): trailofbits.com, blockchain
- Cyfrin services: cyfrin.io
- Pashov Audit Group (four researchers per audit, 3 to 5 days for a focused review, 2 to 4 weeks for a complex protocol, start within 24 hours): pashov.com
- Areta Market (free quotes for builders, quotes within 48 hours, kickoff within a week): areta.market
- Slither: github.com/crytic/slither
- Aderyn: github.com/Cyfrin/aderyn
- Echidna: github.com/crytic/echidna
- Medusa: github.com/crytic/medusa
- Foundry: github.com/foundry-rs/foundry
- Halmos: github.com/a16z/halmos
- Nethermind AuditAgent docs ($50 starting credits, about 1,000 billable lines): docs.auditagent.nethermind.io
- Nethermind, "How Nethermind Security uses AuditAgent alongside manual audits" (1 October 2025; 29 audits, 62% of projects, 30% of findings): nethermind.io blog
- Krait (free, pre-audit verification, not audit replacement): krait.zealynx.io
- Krait repository (MIT licence): github.com/ZealynxSecurity/krait
- The Block, Ethereum Foundation $1M security subsidy (14 April 2026; up to 30% of audit costs, monthly cohorts, over 20 firms): theblock.co
- Nethermind, audit subsidy programs (Ethereum Security Subsidy Program rolling cohorts; Arbitrum Audit Program): nethermind.io/audit-subsidy-programs
- Arbitrum Foundation, "Arbitrum's $10M Audit Program Is Live" (1 August 2025; rolling review, partial or full compensation, exclusivity, new or significantly modified code): blog.arbitrum.foundation
- OpenZeppelin Monitor: github.com/OpenZeppelin/openzeppelin-monitor
- Hypernative: hypernative.io
- Nexus Mutual: nexusmutual.io
- Zealynx Audit Grants (25%, 50% and 100% tiers applied as credit to a Zealynx engagement): grants.zealynx.io; Season 2 applications closed: zealynx.io homepage
- Zealynx Founder Security Sprint ($1,500, three days, audit report, one fix re-check round, 12 months of Insiders, credit within 12 months): Founder Security Sprint
- Zealynx Insiders ($50 a month or $500 for a year; advice and feedback, not a full audit or ongoing code review): academy.zealynx.io/membership
- Zealynx fix review included in every engagement at no additional cost: zealynx.io homepage FAQ
If you are at the full-audit stage, you can request a scoped quote.
Start with three days, not a five-figure commitment
The Founder Security Sprint is how teams start working with Zealynx: a senior three-day pre-audit of your highest-risk contracts and an audit report you can show investors, for $1,500. Every dollar is credited toward your full audit.
No spam. Unsubscribe anytime.
Or see the Sprint and book now →
Keep reading
