{
  "type": "option",
  "name": "Audit contests",
  "slug": "audit-contests",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/audit-contests/",
  "markdown": "https://zkpick.com/md/audit/audit-contests.md",
  "category": "Crowdsourced review",
  "summary": "Audit contests: Crowdsourced review. Layer: Whole scope. Characteristic finds: The long tail after targeted review; findings quick to demonstrate. Blind to: Deep cryptographic soundness work, which is under-rewarded relative to its cost. Coverage claim: None; no accountable party. Cost profile: Fixed pool, pay-for-results. Choose it when: A complement after at least one targeted review and after internal tooling is clean. Weak substitute for a cryptography review of a novel proof system.",
  "description": "A fixed prize pool distributed among independent researchers reviewing a pinned scope over a bounded window, weighted by severity and duplicate-adjusted. Public zkVM and circuit scopes have run in this format, with pool rules varying on whether low-severity findings are paid at all.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Wide reviewer diversity, uncorrelated with any single firm's blind spots",
    "Pay-for-results rather than pay-for-time",
    "Effective at the long tail once targeted review has covered the core",
    "Public scope and public results improve transparency for integrators"
  ],
  "tradeoffs": [
    "Depth is uneven: incentives favour findings quick to demonstrate, under-rewarding deep soundness work",
    "The pool who can read constraint systems is far smaller than the general Solidity pool, so real coverage can be thin despite many participants",
    "Duplicate mechanics and severity floors distort effort allocation",
    "Substantial triage load on the sponsoring team",
    "No accountable party, no methodology statement, no coverage claim"
  ],
  "bestFit": "A complement after at least one targeted review and after internal tooling is clean. Weak substitute for a cryptography review of a novel proof system.",
  "maintainers": null,
  "maturity": "Production-used for ZK scopes",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://cantina.xyz/competitions/c486d600-bed0-4fc6-aed1-de759fd29fa2",
  "facts": [
    {
      "table": "What each assurance technique can and cannot find",
      "url": "https://zkpick.com/audit/#audit-matrix-audit-contest",
      "tech": "Audit contest",
      "layer": "Whole scope",
      "catches": "The long tail after targeted review; findings quick to demonstrate",
      "blind": "Deep cryptographic soundness work, which is under-rewarded relative to its cost",
      "coverage": "None; no accountable party",
      "cost": "Fixed pool, pay-for-results"
    }
  ],
  "relatedFailureModes": [
    {
      "name": "Trusting the library's defaults",
      "url": "https://zkpick.com/audit/failure-modes/trusting-the-library-s-defaults/"
    },
    {
      "name": "Unconstrained hints not re-checked by the caller",
      "url": "https://zkpick.com/audit/failure-modes/unconstrained-hints-not-re-checked-by-the-caller/"
    },
    {
      "name": "Circuit and verifier version drift",
      "url": "https://zkpick.com/audit/failure-modes/circuit-and-verifier-version-drift/"
    },
    {
      "name": "Auditing the circuit but not the protocol",
      "url": "https://zkpick.com/audit/failure-modes/auditing-the-circuit-but-not-the-protocol/"
    }
  ],
  "sources": [
    {
      "title": "zkSecurity — ZK security audits and cryptographic engineering",
      "url": "https://zksecurity.xyz/",
      "kind": "provider"
    },
    {
      "title": "zkSecurity — public audit reports",
      "url": "https://zksecurity.xyz/reports/",
      "kind": "audit reports"
    },
    {
      "title": "Veridise — zero-knowledge audit services",
      "url": "https://veridise.com/audits/zk/",
      "kind": "provider"
    },
    {
      "title": "zkEVM security overview — multiproof redundancy, testing, audits, formal verification",
      "url": "https://zkevm.ethereum.foundation/blog/zkevm-security-overview",
      "kind": "reference"
    },
    {
      "title": "ZK audit checklist — concrete per-category audit checks",
      "url": "https://github.com/PositiveSecurity/zk-audit-guide",
      "kind": "reference"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/audit-contests/",
  "authors": [
    "MarketComp"
  ]
}