Blast, an upcoming optimistic Ethereum roll-up, is set to collaborate with Spearbit, a leading firm in Web3 security research, to offer a security review competition with a bounty pool of $1.2 million. The competition will use Cantina, Spearbit’s open marketplace for security auditors, to facilitate and manage the challenge.
This will be one of the largest reward bounties to be offered in a security review competition designed to attract solo security auditors. The previous largest bounty pool saw $1.1 million distributed to participants, where one competitor won over $500,000 in rewards.
Harikrishnan Mulackal, co-founder of Spearbit Labs and former Compiler Engineer at the Ethereum Foundation, told Blockworks in an interview that anyone in the world can “get a share of the pie” by participating in this competition through reading the code and submitting bugs.
Mulackal notes that security itself is an extremely layered process, and every layer tries to catch a certain class of bugs.
“These competitions are one of the last layers in this security review process before things launch on mainnet,” Mulackal said.
Prior to security review competitions, companies relied heavily on centralized cybersecurity firms to audit their code and systems, and conflicting opinions have emerged on which solutions are better for reviewing smart contracts, Alex Beregszaszi, co-founder of Spearbit Labs and research lead at the Ethereum Foundation’s Ipsilon team told Blockworks.
“A number of platforms running competitions believe it’s the best way to get coverage for finding bugs, because it can attract so many different people, and you are likely going to find every [bug],” Beregszaszi said. “On the other end, there is a thesis from so-called traditional auditing companies, where they think the best way to audit code is to have trained people who review on a weekly basis with different clients.”
Web3 security firm Halborn’s Chief Operating Officer David Schwed believes that both these approaches have their merits, and are recommended in a comprehensive review strategy.
He notes that when security auditing firms are engaged to audit smart contracts, the process often involves dedicated engineers who spend extensive time analyzing the code and developing test cases to uncover potential unknown issues.
“The major advantage of this method is the depth of the analysis, which is thorough and systematic. However, this approach limits the review to a point in time and specific codebase,” Schwed said.
On the contrary, bug bounties can offer a different perspective, often being able to reach highly skilled individuals that a dedicated team may overlook.
“One significant advantage is the potential for many eyes on the project, increasing the chances of finding varied types of vulnerabilities. However, a notable drawback is the lack of guarantee that individuals are actively searching for vulnerabilities or the assurance that all potential vulnerabilities will be identified,” he said.
Schwed adds that there is also an additional risk where participants may exploit found vulnerabilities for personal gain instead of reporting them.
Spencer Macdonald, co-founder of Spearbit and advisor for the Foundation for American Innovation, emphasized the importance of robust security in the blockchain industry. He noted that, like traditional finance, the Web3 space demands a comprehensive defense strategy for effective oversight of smart contracts and protocols.
“You can’t just get one audit and call it a day, you have to continuously monitor your protocol. Then, as you iterate, you have to continually try to get better and harden your attack surface,” Macdonald said.
Mulackal agrees with this sentiment, adding that “We’re not maximalists who believe doing one of them is enough…there is this perpetual cycle of novel bugs getting discovered and protocols getting safer over time.”
