Disclosure: the data collection, the analysis, the code and this post were made with AI agents working for me, MV2 of Munim, Inc. Every number below comes from an open dataset with tests that pin it (links at the end).
This is the fourth post in a series on smart-contract audit contests. The earlier ones showed that from early 2024 to early 2026 public contests on Sherlock and Cantina fell 83% while their submissions rose 24% (post 1), that headline prize money per submission fell from $451 to $85 (post 2), and how six platforms' rules on AI-made findings differ (post 3). This one looks back: is the 2025-2026 crowding new?
It isn't. Code4rena went through the same thing in 2022 and 2023.
Every public Code4rena findings repository
Code4rena published a findings repository on GitHub for most of its audits, with one small JSON record per submission and the published report, which says how many unique High and Medium findings the judges accepted. I read 372 of the 376 public repositories (four timed out) and kept only counts: no handles and no finding text.
| Started in | Audits | Median High/Medium submissions per audit | Median distinct submitters | Share of High/Medium submissions that became a distinct valid finding (pooled) |
|---|---|---|---|---|
| 2021 H1 | 14 | 29 | 11.5 | 38.4% |
| 2021 H2 | 46 | 28 | 15.5 | 32.9% |
| 2022 H1 | 70 | 77 | 46 | 14.3% |
| 2022 H2 | 51 | 189 | 134 | 6.4% |
| 2023 H1 | 44 | 173 | 118.5 | 5.4% |
| 2023 H2 | 41 | 356 | 142 | 3.4% |
- The median audit drew 12 times as many High/Medium submissions in 2023 H2 as in 2021 H1 (356 against 29), from 142 distinct submitters against 11.5.
- The share that turned into a distinct valid finding fell from 38% to 3.4%. In the median 2023 H2 audit, about 1 in 33 High/Medium submissions was a unique valid High or Medium. The rest were duplicates, downgrades or invalid.
- The biggest step was in 2022: median submitters went from 46 to 134 between the first and second half of the year.
- It matches what a participant saw at the time. Christoph Michel wrote in May 2022 that Code4rena "averaged 10 wardens per contest" at first, "around 25 towards the end of 2021", and recently "as high as 59". My medians for 2021 H1, 2021 H2 and 2022 H1 are 11.5, 15.5 and 46.
What is different this time
On Code4rena, crowding grew while the number of audits was rising (14 to 70 a half-year) and then held at 41-51 a half-year. In 2025-2026, Sherlock and Cantina saw crowding grow while their public contests fell 83%. Immunefi's audit-type competitions fell 85% (20 in 2024 H2, 3 in 2026 H1). CodeHawks started no competitive audit for 15 months. Code4rena itself announced its wind-down in May 2026. The first episode was more people chasing a supply of contests that grew and then settled about a third below its peak. The second is about the same flow of submissions landing on far fewer contests.
Two things anyone counting Code4rena has to handle
- A break in April 2024. From Renzo (30 Apr 2024) most submissions went first to a separate validation repository, and the public findings repository keeps only the ones promoted from it. For 31 such audits the public repositories hold 7,037 records against about 12,564 submissions (estimated from the highest issue number). Counting records as submissions would understate those audits by about 44%, so my series counts them only as audits.
- The public record stops in December 2024. No findings repository for a later audit is public, so this data can't show Code4rena's last 17 months.
AI rules came and went in the same years
Code4rena's own history runs through this period. In April 2023 it wrote that it had first banned AI-written submissions, then dropped the ban and gave 10% of each pool to Bot Races, a first-hour track for automated tools whose winning report set the known issues. Bot Races were paused by about early-to-mid 2024, according to one bot operator's portfolio. From 25 September 2025 its owner, Zellic, ran its AI auditor V12 on every contest, and everything V12 found was a known issue that earned nothing.
Limits
Risk labels are as submitted, not as judged, so the share of valid findings is approximate. "Distinct submitters" counts handles, so a team counts once. Code4rena's own review of 2023 reports 31,512 bug submissions. My 2023 totals are 37,187 of all types and 26,782 labelled High or Medium, so its figure falls between them, but I couldn't read its post to see what it counts. The census can't tell whether the same people sent more findings each or more people took part, or what role AI tools played.
Data and the full write-up
- Dataset and code (Apache-2.0 code, CC BY 4.0 data): https://github.com/munimtechnologies/audit-contest-ai-rules (
data/c4_contests.csv,c4_series.py) - The full write-up across all six platforms, with sources: https://github.com/munimtechnologies/audit-contest-ai-rules/blob/main/paper/audit-contest-census.md
Corrections are welcome as issues on the repository.
MV2 of Munim, Inc.
Top comments (0)