Three out of four audit contest findings earn nothing.
I run a smart contract audit pipeline, and I keep a labeled record of what judges actually reward. I pulled the public judging results from 10 Sherlock contests, 1,032 findings from February to June 2024, and counted only the ones that carried a real Reward label. Here is what the numbers say about which bugs pay, which ones only feel valuable, and why being right is often not enough.
The headline
244 of 1,032 submitted findings got a reward. That is 23.6 percent. The other 788 were valid but known, duplicated, disputed, downgraded, or simply not paid.
Skill decides whether you find a bug. It does not decide whether that bug pays.
The bugs that feel high value pay the worst
Reward rate below means the share of submissions in that category that actually got paid. Only categories with at least 15 submissions are shown.
| Pattern | Paid rate | Paid / submitted |
|---|---|---|
| reentrancy | 53% | 27 / 51 |
| fee miscalculation | 29% | 32 / 109 |
| overflow | 29% | 13 / 45 |
| trusted actor | 23% | 70 / 311 |
| dos / griefing | 21% | 33 / 156 |
| staleness | 21% | 36 / 174 |
| mev / slippage | 19% | 17 / 89 |
| oracle manipulation | 19% | 25 / 131 |
| rounding | 17% | 11 / 63 |
| access control | 15% | 11 / 74 |
Reentrancy still sits at the top. Almost everything that sounds prestigious, oracle manipulation, access control, rounding, lands near the bottom.
The single biggest category is trusted actor, 311 submissions, nearly a third of the whole field. It pays 23 percent. Most of it is people arguing that the owner could misbehave. Judges mostly disagree. If the only attacker is an already-trusted role, it is usually not a finding.
Claiming High barely moves the needle
Findings submitted as High get paid 27 percent of the time. Findings submitted as Medium get paid 21 percent. A six point gap. The severity label you pick is not where the money is.
And the label rarely survives. Only 15 percent of findings submitted as High actually ended up rated High. The other 85 percent were downgraded or dropped. The market over-claims severity by a wide margin.
One more number that surprised me: of the findings the sponsor disputed, only 6 percent still got paid. Once the protocol team pushes back with a reason, the finding is almost always dead.
Even when you win, you usually split the pot
This is the part nobody prices in. 62 percent of the findings that got paid were duplicates. Not invalid. Real bugs. But someone else found the same thing, so the reward was shared across everyone who reported it. Only 93 of the 244 paid findings, 38 percent, were sole reports.
The rare skill is not finding a bug. It is finding one that pays, and that few others will also find.
Where you compete matters more than 10x
Across these ten contests the paid rate ran from 5 percent to 58 percent. Same researchers, same skill, wildly different outcomes depending on the codebase, the competition, and how strict the judging was. One contest paid more than half of all submissions. Another paid one in twenty.
What this is, and what it is not
The sample is 1,032 findings across 10 fully reconciled Sherlock contests, February to June 2024. It is a slice, not the whole market. It is one platform and one year.
I count a finding as paid only if it carries the Reward label in the public judging result. Confirmed but unrewarded, disputed, and duplicated away all count as not paid, because they did not put money in a pocket.
Each finding is tagged by bug class from its title and judge notes. Reasonable people would tag a few differently. The direction of the numbers is what matters, not the second decimal. Every reconciled contest in the set is included, the 5 percent ones and the 58 percent ones.
What I am building next
The one skill all of this rewards is judgment: telling a payout apart from a dup, a known issue, or an invalid, before you spend a week writing it up. I am building a drill that trains exactly that, on this labeled record of real verdicts.
If that would be useful to you, or you just want the full pattern breakdown, leave a comment or reach out. I read everything.
Top comments (0)