Cantina

Cantina is a security company that began in web3 as the marketplace launched by the Spearbit researcher network. It now sells onchain security (Spearbit-led and Cantina-managed reviews, public competitions and bug bounties) alongside a newer set of AI-driven products for general software security. It fits teams that want to pick the format themselves: a senior multi-researcher Spearbit review, a shorter managed or solo review, a public competition, or an ongoing bounty, all through one vendor. The strongest evidence-backed signal is its public portfolio, which listed 774 distinct engagements from November 2021 to September 2026 when parsed on 2026-09-24. These include Ethereum's Pectra client competitions and repeated work for Coinbase, Sky, Morpho and OP Labs.

At a glance

Founded	Spearbit was founded in November 2021 and raised funding in August 2023 to launch Cantina (TechCrunch, Aug 2023). Cantina's own about page gives no founding year.
Headquarters / jurisdiction	Not published (about, contact)
Engagement model	Platform plus guild: Spearbit guild reviews, Cantina managed and solo reviews, public competitions, bug bounties (portfolio)
Core specialties	Smart-contract and protocol review, L2/rollup upgrades, client/consensus code via competitions, zkVMs, bug bounty triage
Ecosystems / languages	EVM (Solidity) predominant; OP Stack; Ethereum execution and consensus clients (Go, Rust, Java and others); Solana (Rust); Aptos (Move); Bitcoin-adjacent (Babylon, Citrea); zkVMs (OpenVM)
Public report index	cantina.xyz/portfolio
Open-source tooling	Not much for web3. spearbit/armory (educational material) and a spearbit/portfolio repo; cantina-xyz has no public repos
Published pricing	Not published

Spearbit and Cantina: how they relate

• Origins. Spearbit started as a network of vetted researchers. In August 2023 it raised $7M, led by Framework Ventures, to launch Cantina as an open marketplace for web3 security reviews (TechCrunch).
• Cantina's own account. Cantina's July 2026 funding post says the company "began in the digital assets space" where it built Spearbit, a community of security researchers (Cantina blog).
• Unification. In May 2025 the two were brought onto one platform. rekt.news describes it as a merger in late May 2025 that the companies called "two parts of the same mission". Cantina's original announcement post now returns HTTP 404.
• Current state. spearbit.com now shows only "Spearbit now lives on Cantina" and redirects. Spearbit's offering is presented on Cantina's Spearbit solutions page and onchain security page as hybrid audits that pair Spearbit researchers with AI analysis. The portfolio still labels a separate "Spearbit Guild" category.
• In practice. Spearbit is the senior guild brand, and Cantina is the company and platform through which Spearbit reviews, Cantina-managed reviews, competitions and bounties are bought. The same leadership speaks for both; rekt.news quotes "Cantina/Spearbit's CEO Hari", and Cantina's about page lists Harikrishnan Mulackal as co-founder and CEO.

What they do

The onchain security page describes two services: hybrid smart-contract audits that combine independent researchers with AI-native analysis, and managed bug bounties. It sets out a four-step flow: scope, review, fix with validated findings, then stay protected with a post-launch bounty. The bounties page covers web3 and web2 programs, with human triage of AI-assisted filtering. The competitions listing shows platform-wide figures ($65.1M in payouts available, 7,776 vulnerabilities, 23,700+ researchers). These are the platform's own figures.

Beyond web3, the homepage now leads with an "autonomous agentic security platform". It includes Apex (code security and pentesting), Clarion (security operations, launched with $8M of new funding in July 2026), Bounties, and Onchain Security. Recent blog posts are mostly general software research (Node.js, Ruby, CompCert, RabbitMQ CVEs). Buyers who want web3 work should confirm the web3 team and staffing on their engagement.

No published pricing, platform fees, fix-review terms or report publication policy were found.

Specialties and ecosystem coverage

Counted from the portfolio page data on 2026-09-24 (774 unique entries by ID):

Category	Entries
Cantina managed reviews	492
Spearbit guild reviews	177 (174 web3, 3 web2)
Public competitions	65
Cantina solo reviews	40

Entries by year: 2021: 2, 2022: 40, 2023: 84, 2024: 178, 2025: 322, 2026 to date: 148.

A keyword match on client names, titles and repo links in the same data gives about 31 Optimism/OP Labs entries, 18 Solana, 17 ZK-related (OpenVM, Polygon zkEVM), 8 Polygon, 3 Aptos (Aave on Aptos), 3 Bitcoin-adjacent (Babylon, Citrea), 2 Arbitrum (MakerDAO bridge) and 1 Stellar (Aquarius). The Ethereum Pectra competition (February–March 2025) covered protocol specifications and eleven execution and consensus clients.

Directory comparison:

• Ethereum, Polygon, Arbitrum, Optimism, Base (via Coinbase work) and Solana are evidenced.
• Cosmos is listed in the directory but no Cosmos entries were found in the portfolio data.
• The "incident-response" specialty and audit type are not described on the current onchain security page.
• Of the directory's notable audits, Ethereum Foundation (Pectra), Aave (the Aave v3.1 competition and Aave-on-Aptos reviews) and Morpho are confirmed in the portfolio. Scroll was not found in the portfolio data.

Recent public work

From the portfolio, newest first:

• Morpho: Midnight whitelist enter gate, Spearbit guild, September 10, 2026
• Coinbase: fixed-rate loan protection policy, Cantina managed, September 7–8, 2026
• Ondo: rwa-internal, Cantina solo, August 28 – September 2, 2026
• Coinbase: solana-stable-swapper, Cantina managed, August 13–14, 2026
• Optimism: Upgrade 20, Cantina managed, August 6–12, 2026
• Solana Foundation: token-acl-gate, Cantina managed, July 21–23, 2026
• Morpho Midnight competition, May 29 – June 12, 2026
• VII Finance competition, January 12–26, 2026
• Citrea Clementine competition, August 11 – September 8, 2025

Many recent managed reviews are short (one to three days), which suggests incremental reviews of upgrades and PRs for repeat clients such as Coinbase and Sky.

Research, tooling and methodology

• The portfolio data records, for each engagement, the repositories, commit hashes, the researchers and their roles, and issue counts by severity (critical, high, medium, low, informational, gas) with fixed and acknowledged counts (portfolio).
• Spearbit's GitHub has armory (educational material for researchers) and a portfolio repository. The cantina-forks org holds three repos, and cantina-xyz has no public repositories. No maintained open-source web3 analysis tool was found.
• Recent published research on the blog and disclosures pages is mostly general software security from the Apex product, not smart-contract research.

Track record and incidents

• Cork Protocol, May 28, 2025, about $12M. rekt.news lists Cantina among four reviewers (with Quantstamp, Sherlock and Runtime Verification) and says Cantina's review did not detect the Cork Hook access-control flaw. A follow-up rekt.news piece says Cantina and Spearbit later stated the vulnerable code was not in their scope. It also criticises missing commit hashes and scope clarity in the documentation. It quotes Cantina/Spearbit's CEO calling rekt's reporting "a gross misrepresentation of facts" while declining specifics, citing confidentiality. Whether the hook was in Cantina's scope is disputed and not independently confirmed here. Cork's own post-mortem returned HTTP 403 in this pass.
• Makina Finance, January 20, 2026, about $4.13M. rekt.news lists a Cantina engagement among six audits. It notes that Cantina's September–October 2025 CTF explicitly excluded losses from oracle/pool price manipulation, the vector later used, and that the exploited integration was deployed after the audits finished.

An exploit after an audit is not by itself proof of a missed finding.

Who should consider them — and who might look elsewhere

The strongest public evidence is in EVM protocol and L2 work (OP Stack upgrades, Coinbase/Base contracts, Sky/Spark, Morpho, Aave). It also covers large public competitions on Ethereum client code and zkVMs, and a growing Solana set. The model suits teams that want to combine formats over time: a Spearbit guild review before launch, short managed reviews for later upgrades, a competition, then a bounty. Teams building on Cosmos, Move-native chains other than Aptos, or Cairo will find little public evidence here. Given the Cork dispute, every buyer should insist on written scope with commit hashes and a list of excluded components. Buyers should also note that the company's public focus is widening beyond web3.

How to engage

Use the contact form or demo request. The form asks for name, company, title, work email and your main problem, and says to expect a reply within one business day. For onchain work, state whether you want a Spearbit guild review, a managed or solo review, a competition or a bounty. Prepare the repositories, frozen commit hashes, an explicit in-scope and out-of-scope list (including integrations and deployment scripts), and your timeline.

Gaps and unverified claims

• Headquarters and legal entity are not published.
• The directory's founding year (2023) matches Cantina's launch as reported by TechCrunch; Spearbit dates from November 2021. The firm's own pages give neither.
• The directory's team size ("9,000+ researchers") matches the onchain page ("9,000+ researchers in network"). The competitions page shows 23,700+ researchers. The size of the vetted Spearbit guild is not published.
• Cosmos (directory chain), incident response (directory specialty and audit type) and Scroll (directory notable audit) are not evidenced in current pages or portfolio data.
• Cantina's May 2025 Spearbit/Cantina announcement post returns HTTP 404. The merger timing rests on rekt.news.
• The directory's socials.github (cantina-forks) is a small forks org rather than a tooling org.
• Client logos on the homepage (e.g. large non-web3 companies) could not be matched to public engagements and are treated as self-reported.
• Cork Protocol's own post-mortem (cork.tech) returned HTTP 403 and could not be read.

Sources

1. Cantina homepage, accessed 2026-09-24
2. Cantina onchain security, accessed 2026-09-24
3. Cantina Spearbit solutions page, accessed 2026-09-24
4. Cantina about, accessed 2026-09-24
5. Cantina bounties, accessed 2026-09-24
6. Cantina contact, accessed 2026-09-24
7. Cantina demo request, accessed 2026-09-24
8. Cantina blog index, accessed 2026-09-24
9. Cantina blog: The next chapter of Cantina, accessed 2026-09-24
10. Cantina disclosures, accessed 2026-09-24
11. Cantina portfolio, accessed 2026-09-24
12. Cantina competitions, accessed 2026-09-24
13. spearbit.com (redirect notice), accessed 2026-09-24
14. TechCrunch: Spearbit raises $7M to launch Cantina, accessed 2026-09-24
15. Spearbit GitHub, accessed 2026-09-24
16. cantina-forks GitHub, accessed 2026-09-24
17. cantina-xyz GitHub, accessed 2026-09-24
18. rekt.news: Cork Protocol, accessed 2026-09-24
19. rekt.news: After the Post-Mortem, accessed 2026-09-24
20. rekt.news: Makina, accessed 2026-09-24
21. Portfolio: Ethereum Pectra competition, accessed 2026-09-24
22. Portfolio: Morpho Midnight whitelist gate, accessed 2026-09-24
23. Portfolio: Coinbase fixed-rate loan protection, accessed 2026-09-24
24. Portfolio: Ondo rwa-internal, accessed 2026-09-24
25. Portfolio: Coinbase solana-stable-swapper, accessed 2026-09-24
26. Portfolio: Optimism Upgrade 20, accessed 2026-09-24
27. Portfolio: Solana Foundation token-acl-gate, accessed 2026-09-24
28. Portfolio: Morpho Midnight competition, accessed 2026-09-24
29. Portfolio: VII Finance competition, accessed 2026-09-24
30. Portfolio: Citrea Clementine competition, accessed 2026-09-24