Hats Finance

Hats Finance is a decentralized platform for on-chain bug bounty vaults and crowdsourced audit competitions. It is run by a DAO whose docs say it is affiliated with a Cayman Islands foundation. It suits teams that want pay-for-results competitive review of EVM code rather than a fixed-fee private audit. The strongest evidence is its public GitHub record of competition repositories and its published competition write-ups. However, Hats Finance announced on 2025-12-01 a "final wind-down of its hosted operations": the hosted UI and servers went offline on 2025-12-31, and only the protocol contracts remain on-chain under the DAO (Hats Finance on X, 2025-12-01). It is not available for new engagements; this page is kept as an archive.

At a glance

Founded	not verified (the GitHub org was created 2021-02-22 per the GitHub API; that is not a founding date)
Headquarters / jurisdiction	DAO "affiliated with the Incentive Alignment Foundation in the Cayman Islands" (governance docs)
Engagement model	competitive audit platform plus on-chain bug bounty vaults; optional "skin-in-the-game" vaults for audit firms
Core specialties	audit competitions, bug bounties, on-chain submission and payout
Ecosystems / languages	EVM / Solidity (competition repos for Ethereum, Celo, Gnosis Chain and Sonic projects)
Public report index	none found as a single index; results were published on Medium and in GitHub competition repos
Open-source tooling	protocol contracts (hats-contracts, MIT) and the frontend app
Published pricing	fee model described (management fee plus success fee) but percentages not published (pricing docs)

Platform status

• Hosted operations closed. On 2025-12-01 Hats Finance announced on X a "final wind-down of its hosted operations". Users were asked to withdraw through the UI by 2025-12-17; after that, withdrawals require direct contract interaction. The hosted UI and servers went offline on 2025-12-31. The protocol contracts stay on-chain under the DAO, and an IPFS front end exists but its availability "cannot be guaranteed" (Hats Finance on X, 2025-12-01; secondary coverage: ChainCatcher, Bitget News).
• On 2026-10-14 the hats.finance homepage returned an unrendered application shell (HTTP 200, title only), and the app domain used for competitions, submissions and the contact form (app.hats.finance) still did not resolve in DNS.
• The documentation site was still up.
• In the org's public repositories, sorted by last push (GitHub API), the most recent competition-style repo was pushed 2025-09-23. The frontend repo was last pushed 2025-12-12.

The September 2026 version of this profile said no shutdown announcement had been found; the 2025-12-01 X post is that announcement. The directory lists Hats as unavailable. The sections below describe how the platform worked and are kept as a record.

What they do

According to the docs overview, Hats offers "non-custodial Bug Bounties and Audit Competitions" with "payment only for valid vulnerabilities". Its products are:

• Audit competitions. These are time-boxed, crowdsourced reviews, run either public or private (whitelisted). Findings are submitted on-chain and only "the first unique submission for each issue" is paid (audit competitions).
• Bug bounty vaults. Protocols fund a vault (the docs suggest "up to 1% of its circulating token supply"). A project committee approves payouts for disclosures made through encrypted, on-chain-proven submissions (bug bounties).
• Skin-in-the-game audits. "Audit firms can stake part of their fee using Hats.finance vault mechanism" to share post-audit risk (skin-in-the-game). The directory describes Hats as a platform "where auditors stake their own capital". The docs describe this as an option for audit firms, not the default competition model.
• Audit Frame Game. A community prediction game layered on competitions (docs).
• Dispute resolution. Disputes can be escalated to Kleros arbitration (FAQs).

The published engagement process for projects has six steps: needs assessment, contact, scope discussion, codebase preparation, competition launch and findings implementation. The docs say the team typically responds within 48 hours (requesting an audit).

Specialties and ecosystem coverage

The public competition repositories are Solidity codebases:

• Mento (Celo)
• Circles (Gnosis Chain)
• dTRINITY (Sonic)
• Raft on Ethereum, per the Raft final note

The directory's DeFi, competitive-auditing and bug-bounty specialties are confirmed by the docs and repos. This pass did not find evidence for specific directory chains such as Polygon, Arbitrum, Optimism, Base or BNB Chain. Nor did it find evidence of non-EVM languages (Rust, Move, Cairo).

Recent public work

Taken from the org's repository list sorted by last push (GitHub API, retrieved 2026-09-24). Push dates are not competition dates.

1. Cross-chain Realitio Proxy — last push 2025-09-23
2. dTRINITY (Sonic, Solidity) — last push 2025-08-22 — repo
3. DAOsis — last push 2025-03-19
4. Mento (Celo, Solidity/Foundry) — last push 2025-02-20 — repo
5. Euro-Dollar — last push 2024-12-07
6. Metrom — last push 2024-12-04
7. Spectra — last push 2024-11-11
8. Circles (Gnosis Chain) — last push 2024-10-07 — repo

Hats published a results write-up for one earlier competition, Raft (May 2023). It reported 61 submissions, 19 of which qualified, and a $64,000 prize total (Raft final note, dated 2023-06-05).

Research, tooling and methodology

• Protocol code: The hats-contracts repository is MIT-licensed and includes an audits directory for Hats' own contracts. Security issues go to the maintainers by email, not public issues. The frontend is also public.
• Severity scheme: High (theft or loss of funds, permanent freezing, insolvency, unauthorized control), Medium (temporary disruption, no direct loss) and Low. Projects may customise these definitions (severity guide).
• Governance: $HAT token voting and guild-based treasury allocation, with plans for veHAT (governance docs).
• Publications: No standalone security research or CVEs by Hats were found in this pass.

Track record and incidents

Raft (November 2023). Raft suffered a $6.7M unbacked mint of its R stablecoin on 10 November 2023. Crypto Daily reported that, according to Raft's post-mortem, the exploited contracts had been reviewed by Trail of Bits and Hats Finance, and "the vulnerabilities leading to the incident were not detected" (Crypto Daily). rekt.news also lists Hats among Raft's auditors. It links Raft's post-mortem on Mirror, which could not be loaded in this pass: the link redirected and returned "post not found".

Scope is unresolved. The Hats competition ran in May 2023 (final note), six months before the exploit. This pass could not confirm whether the exploited code was at the reviewed commit. A crowdsourced competition also pays per finding rather than giving a firm's sign-off. No Hats response to the incident was found.

Who should consider them — and who might look elsewhere

The public evidence fits teams with Solidity codebases that want a pay-per-valid-finding competition or an on-chain bounty vault with a project-controlled committee, and that are comfortable with DAO-run tooling. Since hosted operations closed on 2025-12-31, Hats cannot run a new competition or host a new vault, so it is not a current option for any buyer; the description above is historical. Buyers who need a fixed-scope private audit with a named team, non-EVM coverage, or a published fee schedule found little public evidence for those here.

How to engage

Not possible: hosted operations closed on 2025-12-31. The docs still route projects to a contact form at app.hats.finance/contact and a Calendly booking link (requesting an audit), but the app domain does not resolve. For a competition, prepare a frozen, well-documented Solidity repo, a severity-tiered reward budget and a committee who can triage on-chain submissions quickly (requesting an audit).

Gaps and unverified claims

• Site availability: the hosted UI is offline since 2025-12-31 per the firm's announcement, so live competition listings, vault data and leaderboards cannot be checked.
• Activity: no competition-style repo was updated after 2025-09-23. What happens to existing on-chain vaults under the DAO after the wind-down was not described beyond the X post.
• Pricing: the docs describe a management fee plus a success fee without percentages (pricing docs). A July 2023 forum proposal by a Hats business-development representative quoted "10% of payouts" for one prospective client (Frax governance forum). That may not reflect current terms.
• Founding year: 2021 in the directory is not verified by a Hats page.
• Chains: the directory's chain list (Polygon, Arbitrum, Optimism, Base, BNB Chain) was not evidenced. Evidenced chains are Ethereum, Celo, Gnosis Chain and Sonic. The contracts docs show only Etherscan links.
• Directory description: the directory's "auditors stake their own capital" describes an optional skin-in-the-game model, not the standard competition format.
• Raft post-mortem: Raft's own post-mortem could not be loaded. The attribution rests on rekt.news and Crypto Daily.

Sources

1. hats.finance homepage (unrendered shell) — accessed 2026-10-14
2. app.hats.finance/contact (DNS does not resolve) — accessed 2026-10-14
3. Hats docs home — accessed 2026-09-24
4. Docs index (llms.txt) — accessed 2026-09-24
5. Docs: overview — accessed 2026-09-24
6. Docs: audit competitions — accessed 2026-09-24
7. Docs: bug bounties — accessed 2026-09-24
8. Docs: skin-in-the-game audits — accessed 2026-09-24
9. Docs: Audit Frame Game — accessed 2026-09-24
10. Docs: FAQs — accessed 2026-09-24
11. Docs: pricing structures — accessed 2026-09-24
12. Docs: requesting an audit — accessed 2026-09-24
13. Docs: evaluating severity — accessed 2026-09-24
14. Docs: governance — accessed 2026-09-24
15. Docs: Hats contracts — accessed 2026-09-24
16. GitHub API: hats-finance org — accessed 2026-09-24
17. GitHub API: repos by last push — accessed 2026-09-24
18. GitHub: hats-contracts — accessed 2026-09-24
19. GitHub: hats frontend — accessed 2026-09-24
20. GitHub: dTRINITY competition repo — accessed 2026-09-24
21. GitHub: Mento competition repo — accessed 2026-09-24
22. GitHub: Circles competition repo — accessed 2026-09-24
23. Hats Medium: Raft competition final note — accessed 2026-09-24
24. Frax governance forum: Hats competition proposal (2023) — accessed 2026-09-24
25. rekt.news: Raft — accessed 2026-09-24
26. Crypto Daily: Raft hacked for $6.7M — accessed 2026-09-24
27. Raft post-mortem on Mirror (redirected; "post not found") — accessed 2026-09-24
28. Hats Finance on X: final wind-down of hosted operations (2025-12-01) — accessed 2026-10-14
29. ChainCatcher: Hats Finance winds down hosted operations — accessed 2026-10-14
30. Bitget News: Hats Finance wind-down — accessed 2026-10-14