Web3 Audit Contest Aggregator — Code4rena, Sherlock, CodeHawks & Cantina

Security researchers pick their next audit contest by opening four sites, four sort orders and four vocabularies — every week, because the boards rot fast: contests launch, close and hit judging on a weekly cycle.

One run of this Actor returns every audit contest from Code4rena, Sherlock, CodeHawks and Cantina in a single normalized schema: prize pool converted to USD, start and end dates with days-remaining, public / private / invite-only access, KYC flags where the platform publishes them, and a 0-100 opportunity score you can sort by.

No login, no API key, no browser, no residential proxy. HTTP-only, so runs finish in seconds.

Who is this for?

• Security researchers & audit contest hunters — stop tab-hopping. One table: what is live, what it pays in USD, how many days you have left, and whether you can actually join (public vs invite-only, KYC or not).
• Researchers planning their month — statuses: ["upcoming"], sorted by startingSoon, is your calendar.
• Security firms & protocols — benchmark prize pools across all four platforms before booking your own contest.
• Analysts & builders — the competitive-audit market as one dataset: ~540 contests of history across four platforms for prize-inflation and platform-share analysis.
• AI agents (MCP) — pay-per-event Actors are callable as tools. "Which live audit contest pays the most and doesn't require KYC?" becomes one tool call.

What one row looks like

Field	Example	Notes
platform / source	Code4rena / code4rena	also Sherlock, CodeHawks, Cantina
title, organizer	K2, Starknet	anonymized private contests keep title: null — never fabricated
status	live	canonical, derived from the clock: upcoming / live / judging / ended. The platform's own label stays in statusRaw
prizePoolUsd	135000	stablecoin pools convert 1:1; a 7.25 ETH pool without a published rate stays null rather than a made-up number (prizeRaw keeps the original string)
startsAt, endsAt, daysUntilEnd, daysUntilStart, durationDays		deadline math done for you
accessType	public	private and invite-only contests are flagged, filter with publicOnly
kycRequired	false	published by CodeHawks and Cantina; null where a platform doesn't say
tags	["Stellar", "Audit"]	chains, languages, platform labels
nsloc	1250	scope size, CodeHawks only
opportunityScore	72.4	see below
url	direct link	jump straight to the contest

Any field a platform does not publish comes back null — never a fabricated zero.

How the opportunity score works

Deliberately simple, documented, reproducible — so you can argue with it:

• 55% prize size — log-scaled from $1k to $1M, because contest pools span three orders of magnitude and a linear scale would flatten everything under $100k.
• 30% timing — a live contest with 3+ days left scores full marks; one draining tonight scores low; far-future contests score lower than ones starting this week.
• 15% access — public > invite-only > private.

Ended and judging contests score null (nothing left to compete for). Unknown prize = null score, not a flattering guess.

Input examples

The actionable board (default): everything live or upcoming, best first —

{ "statuses": ["live", "upcoming"], "sortBy": "opportunity" }

The no-KYC, joinable-today board:

{ "statuses": ["live"], "publicOnly": true, "excludeKyc": true, "sortBy": "endingSoon" }

Full market history for analysis (~540 rows):

{ "statuses": ["all"], "sortBy": "newest", "maxItems": 1000 }

Solana/Rust hunter:

{ "searchText": "solana", "statuses": ["live", "upcoming"] }

How to schedule this Actor (recommended setup)

Contests launch and close on a weekly rhythm, and the good ones fill up with hunters from day one. A scheduled run is how you hear about a contest on launch day instead of day four.

1. Run the Actor once with your input and check the results.
2. On the Actor page open the … menu and choose Schedule Actor (or go to Schedules and click Create new).
3. Set the cron expression:
   • 0 8 * * * — every morning. The natural cadence for contest boards.
   • 0 8 * * 1,4 — Monday and Thursday. Enough if you only take one contest at a time.
   • 0 */6 * * * — every 6 hours, when you're racing for a seat in contests that cap participants.
4. Attach your saved input. The default board is small (tens of rows), so every scheduled run costs about a cent.
5. Add an integration so the board comes to you: Integrations → Slack / Discord webhook / Google Sheets / Zapier / Make, triggered on Run succeeded.

Catching launches: schedule { "statuses": ["upcoming"], "sortBy": "startingSoon" } daily. Anything new at the top is a contest that was just announced — before the crowd commits their calendar.

Coverage, honestly

• Sherlock — full history via their public API (~300 contests).
• Cantina — full history via their public API (~145 competitions, including anonymized private ones).
• CodeHawks — all competitive audits (~45; First Flights are tagged first-flight).
• Code4rena — the ~50 most recent audits: the complete active board plus recent history. Their archive beyond that is not server-rendered, and we would rather tell you that than pretend.

Why this Actor

• Four platforms, one schema, one run — no other Actor on the Store covers the competitive-audit boards at all (checked Aug 2026).
• HTTP-only — seconds per run, no proxy costs baked into the price.
• Defensive parsing — each platform is fetched independently; one platform having a bad day degrades the run instead of killing it, and the run summary tells you exactly which source failed.
• Pay per event — a tiny start fee plus a per-contest fee. The default actionable board costs about a cent per run; the full 540-row history about $0.66.
• No free-plan cap — free-plan users get the same board as everyone else.

Hunting bug bounties rather than contests? The same treatment for the Immunefi board — max bounty, KYC/PoC/fee friction, opportunity score across 240+ programs — is here: Immunefi Bug Bounty & Audit Competition Scraper.

FAQ

Is this legal? The Actor reads only public contest directories — the same pages and public APIs anyone sees without logging in. No login, no private data, no bypassing access controls. Review each platform's terms for your use case.

Why is prizePoolUsd null on some contests? The pool is denominated in a volatile token (ETH, OP…) and the platform published no USD rate. The original amount is always in prizeRaw / prizeAmount / prizeCurrency. We don't invent exchange rates.

Why does status sometimes disagree with the platform's badge? status is computed from start/end timestamps against the current clock, so it means the same thing across all four platforms. The platform's own label is preserved in statusRaw.

A contest has title: null? Cantina anonymizes private contests in its public API. The row is real (pot, dates, findings count are published); the name genuinely is not public.

Found a bug, or want another platform (Hats, Codarena forks, …)? Open a ticket on the Issues tab.

Changelog

• 0.1 — Initial release: Code4rena + Sherlock + CodeHawks + Cantina, normalized schema, USD conversion for stablecoin pools, clock-derived status, opportunity score, pay-per-event.

Was this Actor useful?

If it replaced your weekly four-tab contest crawl, a short review on the Store page helps other researchers decide whether to try it. Reviews are the only signal buyers have before they spend anything.

If something is wrong instead, please open a ticket on the Issues tab rather than leaving it broken — parser drift and field requests get fixed.