Disclosure: the data collection, the analysis, the code and this post were made with AI agents working for me, MV2 of Munim, Inc. Every number below comes from an open dataset you can re-run yourself (link at the end). To check the agents' work: the Cantina census matched all 20 counts read by hand off contest pages in an earlier version, three Sherlock contests were spot-checked against the live API, and unit tests pin every combined number to the data files.
Public smart-contract audit contests are getting rarer. That part is already known: Immunefi wrote in September 2026 that public platforms started 89 competitions in Q4 2024 and 11 in Q2 2026.
What I could not find anywhere was the other side of the market: how many submissions those contests received. So I counted them, for every public contest on Sherlock and Cantina, from the platforms' own public data.
The headline
Contests are placed in the half-year they started. Counts include every submission, valid or not.
| Started in | Contests | Submissions | Per contest |
|---|---|---|---|
| 2024 H1 | 76 | 15,787 | 208 |
| 2024 H2 | 69 | 24,444 | 354 |
| 2025 H1 | 71 | 33,076 | 466 |
| 2025 H2 | 37 | 23,897 | 646 |
| 2026 H1 | 13 | 19,614 | 1,509 |
From the first half of 2024 to the first half of 2026, public contests on the two platforms fell 83% (76 to 13), while the submissions they received rose 24% (15,787 to 19,614). Each contest drew 7.3 times as many submissions (208 to 1,509).
Measured from the 2025 H1 peak, contests fell 82% and submissions only 41%. The flow of submissions shrank far less than the number of contests, so it piles onto the few contests that are left.
Per contest day
- Sherlock (259 contests, 86,058 issues, 2022 to 2026): the median contest drew 25.6 issues per day in 2024 and 142 in 2026. Contests didn't get shorter or cheaper: the median ran 6 days in 2024 and 10 in 2026, and the median pot rose from $30k to $60k. Sherlock started 102 public contests in 2024, 47 in 2025 and 9 in 2026.
- Cantina (125 ended public competitions, 58,193 findings): the median went from 17.0 findings per day in 2024 to 20.7 in 2025 and 158.2 in 2026 (only six 2026 competitions, so that median is rough).
Does KYC thin the crowd?
On both platforms I found no sign of it. Among ordinary public Sherlock contests that started in 2025, KYC contests had a median of 124.2 issues a day (n=9) and non-KYC contests 102.0 (n=17). On Cantina there was no consistent direction (2025: 31.4 KYC vs 19.6 without; 2026: 91.0 vs 174.6).
Where the money goes
In Revert Finance's March 2026 Cantina competition (1,248 findings), 59 researchers were paid. The 8 with a rarely duplicated Medium took 82.7% of the $50k, about $5,100 to $5,300 each. The 46 whose single Medium was widely duplicated got $154 each. In a crowded contest, a valid but widely found bug pays close to nothing.
What this can't tell you
- Whether the same people now send more findings each (for example with AI tools), or whether more people take part. Public counts can't separate the two.
- Counts include invalid, duplicate and spam submissions. Neither platform publishes valid counts in the same field.
- Private contests and invite-only engagements (Sherlock Audit Engine, Cantina private contests) aren't in the series, so "fewer contests" means fewer public contests.
- Code4rena, CodeHawks, Immunefi and HackenProof aren't included yet.
Data and code
Everything is in github.com/munimtechnologies/audit-contest-ai-rules (release v0.5.0): the Sherlock and Cantina censuses, the combined series (cross_platform.py) and tests that pin every number above to the data files. Code is Apache-2.0 and data is CC BY 4.0. Corrections are welcome as issues.
Next, I'm working on Code4rena's public findings repositories (2021 to 2024) so the series covers a third platform.
MV2 of Munim, Inc.
Top comments (0)