Code4rena Decentralized audit competitions
Defunct4 known investors
Code4rena was a platform that organized security audits and bug bounties for decentralized finance projects, connecting security researchers with blockchain development teams. The company is closing after five years of operation.
Also known as C4 Β· Code4rena
Investors Β· 4
Company profile
researched Aug 2026Code4rena operated a competitive (crowdsourced) smart contract auditing platform for Web3 and DeFi projects. Independent security researchers, referred to as "wardens," competed in time-boxed audit competitions and bug bounty programs to identify vulnerabilities in sponsor protocols' code, with prize pools distributed based on findings and a leaderboard ranking system. Alongside audit competitions, the platform ran mitigation reviews, in which fixes to previously reported issues were re-examined, and ongoing bug bounty programs.
Competitions covered multiple ecosystems and languages, including Solidity codebases on EVM chains and Hyperliquid, and Rust codebases on Stellar, Cosmos and THORChain. Publicly listed engagements included audits for Rujira (THORChain app layer, $40,000 prize pool), K2 (Stellar DeFi lending, $135,000), LayerZero's Stellar endpoint ($101,000), Monetrix (Hyperliquid yield layer, $22,000), and mitigation reviews for Intuition ($4,000) and Swafe ($12,000). According to reporting, the platform's work covered protocols including OpenSea, ENS and zkSync.
On 13 May 2026 the company announced it would wind down after five years of operation, stating that all active competitions, audits and bounties would be seen through to completion and that further timelines would be shared via its Discord community. Immunefi announced a parallel arrangement to migrate Code4rena's bounty programs, scopes, rules, reward structures and security researchers onto its own platform.
Business model
Code4rena intermediated between protocol teams (sponsors) that funded prize pools for audit competitions and bug bounties, and a community of independent security researchers who competed for those payouts. Listed competitions carried denominated prize pools paid in USDC, ranging in the sourced examples from $4,000 for a short mitigation review to $135,000 for a multi-week audit.
Sources describe sponsor-funded competition and bounty prize pools denominated in USDC but do not disclose Code4rena's own fee structure or revenue figures.
Traction
Cumulative figures published on the company's website report 512 audits completed, 26,898 unique findings, 1,607 unique high-severity vulnerabilities and more than 16,600 registered wardens. Press coverage cites an estimated $12 billion in potential exploits prevented across protocols including OpenSea, ENS and zkSync.
Latest developments
On 13 May 2026 Code4rena announced via X that, after careful consideration, it had decided to wind down the platform, and its website confirmed the closure after five years of operation. All open contests, audits and bounties were to be completed and active engagements "seen through to a full and proper close," with further timelines to be communicated through Discord. Immunefi announced a partnership to onboard Code4rena's bug bounty customers, offering migration support for bounty scopes, rules and reward structures, and to take on its security researchers.
βΈFull profile β market position, technology, go-to-market, geography, history, risks & controversies
Market position
Code4rena was described in press coverage as one of the crypto industry's most recognized competitive auditing communities and was best known for popularizing the "warden" competitive audit model. Immunefi, which absorbed its bug bounty customers, said Code4rena "played a huge role in shaping crypto security."
Its distinguishing feature was the competitive audit format, in which many independent researchers simultaneously reviewed the same codebase for a shared prize pool, combined with public leaderboards, rather than a fixed-fee engagement with a single audit firm.
Technology
A web platform for hosting time-boxed competitive audits, mitigation reviews and bug bounties, including submission handling, judging and leaderboard ranking of researchers. Audited codebases spanned Solidity and Rust across EVM, Stellar, Cosmos/THORChain and Hyperliquid environments.
Go-to-market
The platform published open competitions on its public website with defined scopes, dates and USDC prize pools, attracting a registered researcher community (reported at more than 16,600 wardens) and using leaderboard rankings and community channels such as Discord and X for engagement and announcements.
Blockchain and DeFi protocol development teams seeking pre-deployment security review and ongoing bug bounty coverage, across ecosystems including EVM chains, Stellar, Cosmos/THORChain and Hyperliquid; the supply side comprised independent security researchers ("wardens") and judges.
Geography
Not stated in the sources; the platform operated online with a distributed community of researchers.
History
The platform operated for approximately five years before its wind-down. In 2023 it raised $6 million from Paradigm to fund auditor incentives and platform expansion. In 2024 it was acquired by blockchain security firm Zellic, with both companies stating at the time that Code4rena would continue to operate independently. Less than two years later, on 13 May 2026, Code4rena announced it was winding down, with Immunefi taking on its bug bounty customers and researchers.
Risks & controversies
Reporting framed the shutdown against a difficult environment for DeFi and crypto security: DefiLlama recorded more than 20 crypto exploits in April 2026, described as the highest monthly count on record, JPMorgan analysts argued persistent DeFi exploits are limiting institutional participation, and total value locked across DeFi fell from roughly $160 billion in October to about $83 billion at the time of reporting. Commentators noted the closure came less than two years after the Zellic acquisition, which had been announced with assurances of continued independent operation.
Compiled by commissioned research from 6 cited public sources β announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed β not independently audited.
Competitors Β· 8
by search overlap
Companies competing with Code4rena Decentralized audit competitions for the same Google search keywords, organic and paid, via search-intersection analysis.
Timeline Β· 4
launches, deals, and filingsImmunefi announced a partnership to onboard Code4rena's bug bounty customers, supporting migration of bounty scopes, rules and reward structures, and to take on its security researchers.
Code4rena announced on X that it would wind down the platform after five years, stating all active competitions and bounties would be completed and existing engagements properly closed, with further timelines shared via Discord.
Blockchain security firm Zellic acquired Code4rena in 2024; at the time the companies said Code4rena would continue to operate independently.
Code4rena raised $6 million from Paradigm to fund auditor incentives and platform expansion.
$6M source β
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
βΈResearch sources Β· 6
primary sources listed
- Code4rena Decentralized audit competitionscode4rena.com Β· web
6 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does Code4rena Decentralized audit competitions do?
- Competitive smart contract auditing platform that ran crowdsourced audit contests and bug bounties; winding down in 2026.
- Who are Code4rena Decentralized audit competitions's investors?
- Code4rena Decentralized audit competitions's investors include 1k(x), 1kx, Nascent, Paradigm.