What Code4rena does

Code4rena, operated by ZC Security Holdings, LLC (a Delaware LLC domiciled in New York), was a competitive audit and bounty platform for smart contract security in the DeFi ecosystem from its founding around 2020 through a wind-down announced in 2026. The platform matched sponsoring Web3 projects — DeFi protocols, L1/L2 blockchains, and infrastructure providers — with a global community of 16,600+ registered security researchers (wardens) who competed in time-bound audit contests funded by sponsor prize pools ranging from approximately $4,000 to $500,000 USDC per engagement. Over five years the platform completed 512+ audits, surfaced 26,898 unique findings including 1,607 unique high-severity vulnerabilities, and operated across EVM, Stellar, Solana, THORChain/Cosmos, Starknet, Sui, Hyperliquid, Initia, Avalanche, and Monad codebases.

Core offerings comprised Competitive Audit Contests, ongoing Bounties, and post-fix Mitigation Reviews, supported by proprietary platform features including Signal Metrics (a warden accuracy score governing submission limits), a Ranked Curve Awarding Model that algorithmically distributed prize pools, Safe Harbor Testing Authorization defining legal boundaries for security research, a Judge Application System, a Scout Program for pre-audit scoping, an identity verification (KYC) system, and a public Leaderboard. The platform also integrated Zellic's V12 autonomous AI auditing tool as a known-issue baseline in every competition.

Revenue was generated through a transaction-fee model in which sponsors funded prize pools and the platform retained a portion as a fee; an additional $500 USDC flat Scout fee was charged per competition for pre-audit scoping. Go-to-market was community-led and self-serve, with sponsors and wardens transacting directly through code4rena.com without channel intermediaries. Marketing relied on organic social (Twitter/X, Discord), public audit reports, and a comprehensive GitBook documentation portal.

Name

Code4rena

Legal name

ZC Security Holdings, LLC

Website

https://code4rena.com

Company type

Private

Founded year

2020

Operating status

Closed

Headcount range

11–50 employees

Short description

Code4rena was a competitive audit and bounty platform that matched DeFi and Web3 sponsors with 16,600+ security researchers (wardens) for time-bound smart contract audits funded by sponsor prize pools, completing 512+ audits over five years before announcing wind-down in 2026.

Ownership category

akta.pro rank

Product category

Smart Contract Security Audits

NAICS

Security Guards and Patrol Services (561612)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Smart Contract Auditing & Formal Verification (FSAPAJAA)

akta.pro secondary industry

Bug Bounty, Vulnerability Disclosure & Security Services (FSAPAJAL)

Keywords

• Smart contract audits
• Bug bounty platform
• Blockchain security
• Vulnerability discovery
• Competitive auditing

Headquarters

HQ city

Liberty Hill

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Audit Competition Fees: Sponsors pay to host audit competitions on the platform. The sponsor determines the prize pool amount, which is distributed to wardens who submit valid findings ranked by severity and quality. C4 facilitates the process and takes a portion as platform fee.
2. Prize Pool Distribution: Awards are distributed based on judging outcomes. Sponsors fund prize pools ranging from thousands to hundreds of thousands of USDC per competition. Distribution includes High/Medium/QA categories with ranked allocations.

Pricing tiers

Go-to-market motion2 records

Distribution channels1 record

Marketing channels4 records

Core offering

Code4rena operates a competitive audit and bounty platform where security researchers (Wardens) compete to find vulnerabilities in sponsoring projects' smart contracts and codebases. Sponsors create prize pools (typically USDC) to attract Wardens, who submit findings reviewed by appointed judges; awards are distributed by severity and quality. The platform also runs ongoing bounties and mitigation reviews to verify post-fix security of audited code.

Product overview

Code4rena is a competitive audit and bounty platform structured as a platform with integrated modules. The core offering consists of Competitive Audit Contests, Bounties, and Mitigation Reviews, which operate through a unified platform where Sponsors create prize pools to attract Wardens (security researchers) who compete to find vulnerabilities. Supporting this core are platform features including the Leaderboard for tracking researcher performance, Signal Metrics for measuring accuracy and determining submission limits, the Scout Program for pre-audit scoping, the Judge Application System for selecting competition judges, and Identity Certification for KYC verification. The platform generates Audit Reports from completed competitions and operates an Awarding System that distributes prizes using a ranked curve algorithm. Documentation is provided via a GitBook-based portal, and the platform integrates V12 (Zellic's AI auditing tool) for automated vulnerability detection.

Differentiator

Problem solved

Functional benefit

Products and services

• Competitive Audit Contests Time-bound security audit competitions where sponsoring projects offer prize pools to attract security researchers (Wardens) who review, audit, and analyze codebases for vulnerabilities in exchange for monetary awards.
• Bounties Bug bounty programs offered through the Code4rena platform where security researchers can submit vulnerability findings for ongoing projects outside of competitive contest timeframes.
• Mitigation Reviews Post-audit review process where previously identified vulnerabilities are re-evaluated after projects implement fixes to verify remediation effectiveness.
• Scout Program Pre-audit scoping and intel service where hand-picked Scouts assess library dependencies, external calls, timelocks, and SLoC to help determine optimal audit parameters, with compensation of $500 USDC per competition.

Quantifiable outcome

• 1,607 unique high-severity vulnerabilities discovered
• +2 more outcomes

Named customers10 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature3 records

Partnerships

Two partnerships are on record, tiered minor.

• SherlockminorOthersCompetitor platform in the smart contract security auditing space, mentioned alongside Code4rena as alternative audit options for projects seeking security review. Both platforms serve similar market need but are distinct competing services.
• CantinaminorOthersCompetitor audit platform that maintains its own leaderboard. Top-50 ranked researchers on Cantina may request bypass of Code4rena's null signal submission limits, indicating cross-platform recognition of researcher quality.

Scale indicators5 records

Recent moves7 records

Expansion highlights4 records

Direct peers

• Zellic: Smart contract security firm whose V12 AI auditing tool is integrated into all Code4rena competitions; offers traditional audits plus AI-driven vulnerability detection across the same multi-chain stacks Code4rena covers.
• Spearbit: Curated network of independent smart contract security researchers offering traditional audit engagements that compete directly with Code4rena's contest model for sponsor wallet share.
• ChainSecurity: Smart contract auditing firm with deep DeFi protocol coverage, competing for the same enterprise sponsor customers (L1s, DeFi primitives) that Code4rena serves through its contest format.
• Sherlock: Competitive audit and bug bounty platform for smart contracts, explicitly listed as an industry peer alongside Code4rena and offering the same contest-based model with sponsor-funded prize pools and merit-based awarding.
• Certora: Formal verification platform for smart contracts that competes on the same high-assurance security buyer segment, offering automated proof-based audits as an alternative to crowdsourced contest reviews.
• Cantina: Competitive smart contract audit platform with its own leaderboard that cross-recognizes top-50 researchers with Code4rena submission-limit bypass privileges — a direct competitor for the same warden pool and sponsor pipeline.

Broad incumbents

• Trail of Bits: Established cybersecurity firm with a substantial smart contract security practice; serves the same enterprise crypto sponsor base with traditional audit engagements rather than crowdsourced contests.
• OpenZeppelin: Smart contract security audits plus tooling and libraries; competes for sponsor budgets at the protocol design and pre-deployment stages where Code4rena contests also run.
• Quantstamp: Smart contract auditing firm with a security-focused product portfolio including automated scanning; targets the same enterprise L1/L2 and DeFi sponsor segment that funds Code4rena contests.
• Hacken: Crypto security firm offering smart contract audits and bug bounties; overlaps with Code4rena's bounties product and competes for sponsor budget allocated to Web3 security review.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/code4rena
• LinkedInlinkedin.com/company/code4rena

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Code4rena