What actually gets paid in smart contract audit contests
Three out of four audit contest findings earn nothing. I run a smart contract audit pipeline, and I keep a labeled record of what judges actually reward. I pulled the public judging results from 10 Sherlock contests, 1,032 findings from February to June 2024, and counted only the ones that carried a real Reward label. Here is what the numbers say about which bugs pay, which ones only feel…
In smart contract audit contests, only 23.6 percent of submitted findings earn a reward, leaving 76.4 percent of submissions without payment. Three out of four findings do not pay, with various reasons like being valid but known, duplicated, disputed, downgraded, or simply not rewarded. Skill in finding bugs does not guarantee payment, as the category of bug does not determine if it will be rewarded.
The category with the highest reward rate is "trusted actor," with 23 percent of submissions getting paid, with the majority of these being due to arguments about the owner's potential misbehavior. However, only 15 percent of findings submitted as "High" actually end up rated "High," with the remaining 85 percent being downgraded or dropped.
The severity label chosen for a finding has little impact on payment, as the market overstates severity. Additionally, only 6 percent of findings disputed by the sponsor still get paid. If a researcher wins, they often split the pot, as 62 percent of paid findings were duplicates. Only 93 out of 244 paid findings were sole reports, indicating that finding a bug that no one else finds is a rare skill.
The paid rate across 10 Sherlock contests ranged from 5 percent to 58 percent, depending on the codebase, competition, and judging strictness.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
