Code4rena

Code4rena was founded in 2021 and became a leading competitive audit platform in Web3 security, discovering over 1,600 high-severity vulnerabilities through crowdsourced audits, with more than 16,000 registered researchers.

In August 2024, blockchain security audit firm Zellic announced the acquisition of Code4rena, integrating it into its portfolio to combine Zellic's consultative audits with Code4rena's competitive audits, launching the "Audits+" hybrid service. This acquisition marked Code4rena's transition from an independent platform to part of the Zellic ecosystem, while the platform continued to operate independently.

In May 2026, Code4rena announced it would gradually cease operations, with Web3 security company Immunefi taking over its clients and security researchers. All ongoing contests and bounty programs will be completed as usual, and existing partnerships will be properly concluded. This decision means Code4rena will exit the stage as an independent brand, but its community and audit model will be continued by Immunefi.

Platform shutdown: On May 13 Code4rena announced it would wind down, completing all ongoing contests and bounties without terminating programs early; on May 14 Immunefi said it would take over Code4rena's clients and whitehat community, keeping scopes, rules and rewards unchanged.

Background: Code4rena had raised $6 million and was acquired by Zellic in 2024; the closure came as April alone saw more than 20 DeFi exploits and consolidation across security auditing. No buyback, burn or migration plan was disclosed for the ARENA token.

Code4rena is the competitive smart contract audit platform founded in 2021. Protocols open a codebase for a time-boxed public contest, independent researchers known as wardens review in parallel and share a prize pool weighted by finding severity, followed by a mitigation review that verifies each fix. It pioneered the model and had more than 4,500 registered wardens by mid-2026, with prize pools ranging from $15,000 to over $1 million, plus a Zenith private track for engagements requiring NDAs or pre-launch confidentiality.

On coverage, contest reports for Optimism, Uniswap, Chainlink CCIP, Arbitrum, Aave, ENS, Lido, Base and Berachain are published in the code-423n4 GitHub organisation, one of the largest public collections of DeFi audit findings, and teams routinely cite those findings when scoping their own audits. Public prize pools between December 2025 and May 2026 included $135,000 for the K2 lending audit, $101,000 for the LayerZero Stellar endpoint, $40,000 for Rujira and $22,000 for Monetrix, with mitigation reviews as low as $4,000. Through 2026 it widened into L2-native and cross-chain protocol contests, adding Berachain as a supported chain.

Future strategy and roadmap: Code4rena trades breadth of open contests for coverage probability, uses the Zenith private track for high-assurance clients needing confidentiality and a defined deliverable, and treats its archive of findings as a research asset for the industry. The risk is not the model but its boundary: the March 2026 Venus Protocol loss of about $3.7 million came from a risk the contest had flagged and the team declined to remediate as an intentional design choice, showing that a reported finding is not a resolved risk. Coverage also depends on warden turnout and prize size, and judging quality varies by contest judge under high submission volumes.

Adam Avenir — Co-founder; serial entrepreneur who co-created the Node Security Project (later npm audit) at &yet and founded security consultancy ^Lift Security; sold Code4rena in summer 2024.

Sock — Co-developer; core contributor to platform development and operations.

Launched in 2021, acquired by Zellic in 2024, winding down from 2026.