Code4rena

Code4rena is a competitive audit and bug bounty platform where independent researchers ("wardens") compete for a sponsor-funded prize pool, with judges setting severity and payouts. It was acquired by Zellic in August 2024 and announced in May 2026 that it is winding down, so as of September 2026 it is more useful as a large public archive of contest reports rather than a vendor you can newly hire. The strongest evidence-backed signal is scale: the site reports 512 completed audits, 26,898 findings and 1,607 unique high-severity vulnerabilities, all with public reports.

At a glance

Founded	First public contest (Slingshot Finance) dated 2021-02-21; The Block described it in March 2023 as "first formed last year"
Headquarters / jurisdiction	not verified
Engagement model	Competitive contest platform plus bug bounties and mitigation reviews (docs); winding down since May 2026 (homepage)
Core specialties	Time-boxed crowd audits of DeFi codebases; post-fix mitigation reviews
Ecosystems / languages	EVM (Solidity), Solana (Rust), Stellar/Soroban (Rust), Cosmos-based bridge code — see below
Public report index	code4rena.com/reports and code4rena.com/audits
Open-source tooling	none found as a maintained security tool; the code-423n4 GitHub org holds per-contest repos
Published pricing	No platform fee; sponsor sets prize pool with guidance (sponsor docs). Recent pools ranged $4,000–$135,000 USDC (audits list)

What they do

Code4rena's documentation describes itself as a "competitive audit and bounty platform where security researchers review codebases for vulnerabilities in exchange for bounties" (docs). Roles are wardens (researchers), sponsors (the projects paying into a prize pool) and judges who decide validity and severity.

Per the sponsor guide: projects start via an intake form, the team scopes the work and recommends a package, code and docs must be delivered at least two business days before start, audits are locked in only after a deposit, and code is made public at audit time in most cases (KYC-restricted and private competition options exist). Code4rena states it charges no platform fee for competitions; the pool size is set by scope.

Payouts are formula-driven. High findings are worth 10 shares and Mediums 3 shares, reduced as duplicates split them, with bonuses for selected reports and for the wardens with the most unique and most valid findings; QA reports are paid on a curve to the top three (awarding docs). Follow-up "mitigation review" contests check the sponsor's fixes; several appear on the audits list (e.g. two Swafe rounds and two Panoptic rounds in 2026).

Current status. The homepage now reads that Code4rena "is closing its doors" after five years and that active competitions and bounties are being seen through to completion (homepage). The Block reported the announcement on 13 May 2026 and that Immunefi would onboard Code4rena's bug bounty customers, porting over scopes, rules and reward structures. Zellic's acquisition (22 August 2024) was framed around pairing a Zellic consultative audit with a Code4rena contest ("Audits+") (Zellic blog).

Specialties and ecosystem coverage

From reports published in 2026:

• EVM / Solidity: Olas (40 Solidity contracts) (report); Panoptic Next Core (6,356 lines of Solidity) (report).
• Solana / Rust: Jupiter Lend (report).
• Stellar / Soroban Rust: LayerZero Stellar endpoint, 86 contracts, 5,002 lines (report).
• Cosmos-side bridge: Injective Peggy Bridge (contest page).

The directory lists Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain and Avalanche; EVM coverage is confirmed generally, but this pass did not map reports to each L2 individually. Solana and non-EVM Rust work is evidenced but not in the directory's chain list.

Recent public work

Pulled from the audits list and individual report pages, accessed 2026-09-24:

1. Jupiter Lend — 12 Feb–13 Mar 2026, $107,000 pool (contest); report published 11 Jul 2026, 0 High / 3 Medium (report).
2. LayerZero – Stellar endpoint — 1–14 Apr 2026, $101,000 pool; report 6 May 2026, 0 High / 0 Medium, 131 QA reports (report).
3. Olas — 22 Jan–9 Feb 2026; report 18 May 2026, 11 High / 12 Medium (report).
4. Panoptic: Next Core — 19 Dec 2025–7 Jan 2026; report 9 Mar 2026, 3 High / 19 Medium, followed by mitigation review (report).
5. Injective Peggy Bridge — 25 Feb–17 Mar 2026, $105,500 pool (contest).
6. K2 — 17 Apr–27 May 2026, $135,000 pool (audits list).
7. Chainlink Payment Abstraction V2 — 18–27 Mar 2026, $65,000 pool (audits list).
8. Monetrix — 24 Apr–4 May 2026, $22,000 pool (audits list).

Research, tooling and methodology

The published methodology is the contest rulebook itself: a three-level severity scheme (High: assets can be stolen/lost; Medium: function or availability impacted, or value leak under stated assumptions; QA/Low for the rest), with guidance on dust amounts, yield loss and privilege escalation (severity docs), plus the award formulas above. The GitHub org lists 881 public repositories as of 2026-09-24 (count shown on the org page), mostly per-contest code and findings repos. No maintained open-source analysis tool was found.

Track record and incidents

Two rekt.news write-ups name Code4rena in connection with later exploits; in both, the writers state the exploited component was outside the Code4rena scope:

• YieldBlox on Blend V2 (22 Feb 2026, $10.97M): Blend V2 ran a $125,000 Code4rena contest in February 2025 focused on the Backstop contract. rekt.news states the oracle, the Reflector integration and illiquid-collateral behaviour were not in scope.
• Abracadabra (October 2025, about $1.8M): Code4rena's March 2024 review covered the new MIMSwap module; rekt.news states it did not include the CauldronV4 contracts that were exploited.

No Code4rena response to either was found in this pass. An exploit after an audit is not by itself evidence of a missed finding.

Who should consider them — and who might look elsewhere

Because the platform is winding down, teams planning a new audit should look elsewhere; Code4rena's former bug bounty customers were directed to Immunefi (The Block). The archive remains useful to buyers and engineers: hundreds of public reports show how contest results vary (0 High/Medium on LayerZero Stellar vs 11 High on Olas), and a Code4rena report on a protocol you depend on is a detailed, public record of what was in scope and what was found. Teams that valued the contest format may want to look at other competitive platforms or at Zellic's own services.

How to engage

The sponsor docs still point to an intake form, but the homepage says the platform is closing and only existing competitions and bounties are being completed. Confirm directly through the channels linked from the homepage before assuming any new engagement is possible.

Gaps and unverified claims

• The final closing date was reported by secondary outlets but not confirmed from a Code4rena primary page in this pass.
• Founding year: the first public contest is dated February 2021, while The Block (March 2023) said it was "first formed last year"; the directory's 2021 matches the contest record.
• Headquarters and legal entity were not found.
• The directory's team size is "16,600+ registered wardens", matching the homepage. Its "1-3 weeks" turnaround understates recent contests (several ran 3–6 weeks) and excludes the gap before reports publish (about three weeks to four months across the 2026 reports above).
• The directory's notable audits (ENS, OpenSea, Canto, Juicebox, Nouns DAO) were not checked one by one.
• Some report URLs (e.g. Chainlink Payment Abstraction V2, Injective Peggy Bridge) returned 404 on 2026-09-24; reports may not yet be published.

Sources

1. Code4rena homepage — accessed 2026-09-24
2. Code4rena audits list — accessed 2026-09-24
3. Code4rena reports index — accessed 2026-09-24
4. Code4rena docs overview — accessed 2026-09-24
5. Code4rena sponsor docs — accessed 2026-09-24
6. Code4rena awarding docs — accessed 2026-09-24
7. Code4rena severity categorization — accessed 2026-09-24
8. code-423n4 GitHub org — accessed 2026-09-24
9. Slingshot Finance report (2021) — accessed 2026-09-24
10. Olas report — accessed 2026-09-24
11. Jupiter Lend contest page — accessed 2026-09-24
12. Jupiter Lend report — accessed 2026-09-24
13. LayerZero Stellar endpoint report — accessed 2026-09-24
14. Panoptic Next Core report — accessed 2026-09-24
15. Injective Peggy Bridge contest page — accessed 2026-09-24
16. The Block: Immunefi to absorb Code4rena bug bounty customers — accessed 2026-09-24
17. The Block: Paradigm funds Code4rena — accessed 2026-09-24
18. Zellic: Why We Acquired Code4rena — accessed 2026-09-24
19. rekt.news: YieldBlox — accessed 2026-09-24
20. rekt.news: Abracadabra Rekt III — accessed 2026-09-24