Spearbit

Spearbit is a network of independent security researchers that runs multi-person smart contract reviews. It now operates inside Cantina, the security platform built by the same company: spearbit.com redirects visitors with the notice "Spearbit now lives on Cantina". It fits protocols that want a team-based review. Cantina's portfolio describes typical review teams of 4 to 5 researchers (the portfolio's figure, not the firm headcount). The directory team size is 100+. The same vendor may also cover contests, bug bounties or monitoring. The strongest evidence-backed signal is repeat work for large DeFi and L2 clients. The public portfolio lists Morpho engagements from 2022 through September 2026, and OP Labs, Coinbase and Sky reviews appear through August–September 2026.

At a glance

Founded	November 2021, per TechCrunch (2023); the earliest entry in the public portfolio is also November 2021
Headquarters / jurisdiction	Not confirmed on the firm's own pages in this pass
Engagement model	Researcher network ("guild") running multi-researcher reviews, delivered through the Cantina platform (Cantina — Web3 security)
Core specialties	DeFi lending and DEX, L2 and rollup infrastructure, bridges, ZK systems (evidenced by portfolio entries)
Ecosystems / languages	EVM (Solidity) well evidenced; ZK rollups (Polygon zkEVM, zkSync) evidenced; Solana Foundation appears as a Cantina portfolio client, but no Spearbit-labelled Solana report was confirmed
Public report index	cantina.xyz/portfolio; historical index at github.com/spearbit/portfolio
Open-source tooling	None specific to Spearbit found in this pass
Published pricing	Not published

What they do

Cantina's Web3 security page (formerly the Spearbit solution page, which now redirects there) describes hybrid smart contract audits that pair independent researchers with AI-assisted review. It also describes bug-bounty management with expert triage and ongoing post-launch security. The published flow is: scope the code, researcher review with AI analysis, validate findings for real impact, then optionally launch a managed bug bounty. The page names SOC 2 Type II compliance.

Cantina's homepage groups Spearbit under "Onchain Security". It sits alongside Apex (code security and penetration testing), Clarion (security operations) and Bounties.

The directory team size is 100+. The Cantina portfolio describes the Spearbit Guild as a network providing reviews "with team sizes of typically 4 - 5 security researchers" (the portfolio's figure for a single review, not the firm headcount). TechCrunch reported in 2023 that Spearbit had raised $7M led by Framework Ventures to launch Cantina as an open audit marketplace. It also reported that three of the five founders came from the Ethereum Foundation.

Specialties and ecosystem coverage

Evidence from the Spearbit portfolio repo:

• DeFi: Evidenced. Entries include Morpho (repeatedly, 2022–2026), Maple Finance (October 2022), Connext (2022), OpenSea Seaport (2022) and UniswapX (June 2024).
• L2 / rollups: Evidenced. OP Labs/Optimism entries run from 2022 to 2025, and the Cantina portfolio lists OP Labs in August 2026.
• ZK: Evidenced by Polygon zkEVM (March 2023, covering protocol, bridge and cryptography reports) and zkSync (October 2023).
• Bridges: Evidenced by Connext and the Polygon zkEVM bridge.
• Solana: A directory chain, but not evidenced as a Spearbit-labelled report. Solana Foundation appears as a client in the Cantina portfolio without a Spearbit label.
• Directory chains: Ethereum, Optimism and Polygon are confirmed. Base and Arbitrum were not specifically confirmed in this pass.

Recent public work

From the Cantina portfolio and the Spearbit portfolio repo, read on 2026-09-24. The Cantina portfolio does not label which recent entries were Spearbit guild reviews and which were other Cantina formats.

1. Morpho (September 2026) (Spearbit portfolio)
2. Coinbase (7–8 September 2026) (Cantina portfolio)
3. Sky, a series of reviews (8–23 August 2026) (Cantina portfolio)
4. OP Labs (6–12 August 2026) (Cantina portfolio)
5. Morpho (July 2026) (Spearbit portfolio)
6. Optimism/OP Labs (September 2025) (Spearbit portfolio)
7. Uniswap (May 2025) (Spearbit portfolio)
8. Coinbase (December 2024) (Spearbit portfolio)

Research, tooling and methodology

• Methodology: The Web3 security page describes a hybrid human and AI review, followed by validation of findings for real impact.
• Platform figures: The same page cites $100B+ onchain value secured, 200+ protocols, 4,474 vulnerabilities uncovered and a 9,000+ researcher network. These cover the combined Cantina platform and are self-reported.
• Tooling: No open-source security tooling specific to Spearbit was found in this pass.
• Publication: The portfolio repo says it publishes engagements with client consent, so unpublished engagements are expected.

Track record and incidents

• Cork Protocol (May 2025): Cork lost about $12M in its wstETH:weETH market on 28 May 2025. rekt.news (July 2025) reported a dispute over whether pre-exploit reviews by Cantina and Spearbit should have caught the issue. The critique cited by rekt came from the CEO of Sherlock, a competing audit firm, and alleged unclear scope documentation (private repositories and missing commit hashes). rekt also quotes Cantina/Spearbit CEO Hari Mulackal disputing it: "I can confirm that the article by Jack is incorrect and is a gross misrepresentation of facts." He added that confidentiality agreements prevented further detail. Whether the exploited Cork Hook was in Spearbit's review scope was not independently confirmed in this pass, and Cork's own post-mortem could not be loaded (HTTP 403). An exploit after an audit does not by itself show that a finding was missed.

Who should consider them — and who might look elsewhere

The public evidence is strongest for EVM DeFi lending and exchange protocols, OP Stack and L2 infrastructure, and ZK rollup systems. Spearbit fits teams that want several researchers on one review and may want a bounty or contest from the same platform afterwards. Teams that want a stand-alone firm with its own tooling, or a report index that clearly separates guild reviews from other Cantina formats, may find the merged Cantina structure less clear. Solana teams should ask for Spearbit-specific Solana examples.

How to engage

spearbit.com redirects to Cantina (spearbit.com). Requests go through Cantina's demo and request form, linked from the Cantina homepage and the Web3 security page. Given the Cork scope dispute, ask for the exact repository, commit hash and in-scope file list to be written into the engagement letter and the final report.

Cantina also runs a public referral program. It pays referrers 5% of net revenue, capped at $50,000, to eligible US-based participants.

Gaps and unverified claims

• Spearbit no longer has a stand-alone site: spearbit.com shows "Spearbit now lives on Cantina" and redirects.
• Cantina's May 2025 post announcing the Spearbit–Cantina merger returned 404 at its current URL.
• The Cantina portfolio does not label recent entries as Spearbit guild reviews, so recent Spearbit-specific output is hard to isolate.
• Of the directory's notable audits, OpenSea, Morpho, Connext and Maple Finance are confirmed in the portfolio repo. Blast was not found.
• The directory team size is 100+. TechCrunch reported "over 100" researchers in 2023 (TechCrunch's figure). Cantina cites 9,000+ across its whole network (Cantina's figure), which is not a Spearbit-only headcount.
• Pricing and turnaround are not published.
• No Spearbit-labelled Solana report was confirmed.
• The scope of the Cork review is disputed, and Cork's post-mortem was not reachable (HTTP 403).

Sources

1. spearbit.com (redirect notice), accessed 2026-09-24
2. Cantina — Portfolio, accessed 2026-09-24
3. spearbit/portfolio (GitHub), accessed 2026-09-24
4. Cantina — Homepage, accessed 2026-09-24
5. Cantina — Web3 security page (the former /solutions/spearbit URL redirects here), accessed 2026-09-24
6. Cantina — Referral program, accessed 2026-09-24
7. TechCrunch — Spearbit raises $7M (2023), accessed 2026-09-24
8. rekt.news — After the Post-Mortem, accessed 2026-09-24