Audit Contest vs Private Audit: Cost, Coverage and Timing

By the Guardian team Updated November 2026 5 min read

Quick answer. Neither wins alone: a private audit gives a dedicated team accountable for your scope and fixes, while a contest adds many researchers paid for valid findings. For high-value code, run the private audit first, then a contest.

Watch: Audit Contest vs Private Audit: Cost, Coverage and Timing 1:37

Video transcript

Audit contest or private audit? Neither wins alone. For high-value code, run the private audit first, then a contest.

A private audit pays a selected team to cover your whole scope. A contest pays many researchers per valid finding, wherever they choose to look.

Sherlock, which offers both, says contest platforms put 100 to 500 researchers on the same scope. But no one is paid to confirm a module is safe.

A quiet contest is not proof of safety. Guardian's 175 thousand dollar Defender contest on GMX drew five submissions, none a valid Critical, and paid nothing.

Private audits are quoted on scope and time. Sherlock puts most DeFi protocol audits between 25 and 100 thousand dollars.

A contest costs its pool plus fees. If nothing is found, conditional pools are mostly refunded, floor pools pay a reduced amount, and Critical only pools pay nothing.

Contests also need judging and an appeal period. So run them in order: a private audit, fixes reviewed by the same team, a contest on the fixed commit, then a live bug bounty.

Guardian's Vanguard combines both. Two teams cross-check each other, one manual, one using Helix, Guardian's AI auditor. It adds a 100 thousand dollar Defender contest, a hosted bug bounty, and six months of updates.

Read the full article for costs and timing, or get a Vanguard quote at guardian.security.

Scoping a security review often starts with one choice: book a firm, or open the code to a contest.

The two models pay reviewers differently, and that shapes what each one covers.

Here is how they compare on coverage, cost and timing, and when to use both.

How Each Model Works

	Private audit	Audit contest
Who reviews	A team selected for your code	Many independent researchers
How they are paid	A quoted fee for the engagement	A share of a pool, per valid finding
Scope	The whole scope is the team's job	Researchers choose where to look
Output	A report on scope, findings and fixes	A judged, de-duplicated list of findings
Fix review	Included at some firms, billed at others	Often a separate mitigation round

Sherlock's Collaborative Audits show the private model. Sherlock picks the researchers whose experience best fits the code in scope.

The contest model works at a different scale. Sherlock, which offers both, says contest platforms put 100 to 500 researchers on the same scope at once.

Coverage and Finding Quality

Private audit: depth and accountability

A private team is paid to cover the whole scope, including the parts that turn out to be clean.

You can brief it on design intent and your threat model. Then hold it to a report that records what it reviewed.

Contest: breadth, with noise

Contest rewards follow findings, not coverage. No one is paid to confirm a module is safe.

Payouts also favor severe, unique bugs. Duplicates split a reward, and some pools pay only for Criticals.

Many reviewers means many submissions to judge. Some platforms now charge researchers to submit, or penalize invalid escalations, to cut the noise.

What a quiet contest tells you

A contest that finds nothing is not proof the code is safe. It shows only that those who looked found no valid issue in that scope and time.

Guardian's $175,000 Defender contest on GMX's V2.2 branch ran from July 28 to August 8, 2025. It drew five submissions, none was a valid Critical, and nothing was paid out.

Cost and Payout Structures

A private audit is quoted on scope and time.

Sherlock, which sells audits, puts most DeFi protocol audits between $25,000 and $100,000. Re-audit rounds add $5,000 to $20,000 per pass, by its estimate.

A contest costs its pool, plus any platform and judging fees. What comes back if nothing is found depends on the pool rule:

Conditional: most of the pool is refunded if no High or Medium is found (Code4rena, now winding down).
Floor: a reduced pool is still paid if nothing valid is found (Immunefi's Plether).
Critical only: nothing is paid without a confirmed Critical (Guardian Defender).

Each platform's terms are in the table below.

Two questions decide what a contest really costs:

What do you pay if nothing valid is found?
Are judging and fix review inside the price?

For published audit prices, see Audit Firm Pricing Compared.

Timing and Fix Reviews

Both models start from a frozen commit. Sherlock asks for it three days before a Collaborative Audit, and CodeHawks at least two days before a contest.

Contest length scales with code size. Sherlock's published guidelines put about 500 nSLOC at a 3-day contest window, and 6,000 nSLOC at 38 days.

Judging comes after. On CodeHawks, it takes longer the more issues are submitted, and an appeal period follows.

Faster formats exist. Sherlock says its Audit Engine can run an AI-only pass in as little as two days.

Then the fixes need their own review:

Private audit: Sherlock requires High findings fixed and signed off before the audit is complete.
Contest: CodeHawks offers a Mitigation Review Contest once fixes are in.
Later changes: see when you need a re-audit.

When to Use Both

A private audit alone can fit small changes and tight deadlines.

Add a contest when:

The code will hold significant value from day one.
It is new, complex or forked in unusual ways.
You want independent pressure after your auditor signs off.
You can wait for judging and a fix review before launch.

Run them in order:

Private audit on a frozen commit.
Fixes, reviewed by the same team.
A contest on the fixed commit.
A live bug bounty after launch.

Where to Run a Contest Now

Pool, fee and judging terms differ by platform. Here is what each one publishes:

Platform	Pool	Fees	Judging
Guardian Defender (Guardian audit clients, by invitation)	$100,000 Critical pot, funded and held by Guardian	Comes with Vanguard	A Guardian judge and a protocol judge must agree in writing
Cantina	Set per competition	Not stated in its docs	Cantina's decision is final; invalid escalations cost researchers $100
Immunefi	Plether: $80,000 if any valid bug, 15% if none	Researchers pay a submission fee per report	Immunefi has final say on validity, duplicates and severity
Sherlock Audit Engine	Quoted per engagement		AI judge with Lead Judge review, normally in 24 to 48 hours
CodeHawks (Cyfrin)	Severity-weighted: a High counts five times a Medium	Quoted on audit length and complexity	Expert judging after the contest, then an appeal period
HackenProof	40% Critical, 30% High, 15% Medium, 5% gas and best practices	10% operational and judging fee	HackenProof validates reports, covered by that fee

Sherlock's docs mark its audit contests as deprecated and replaced by Audit Engine.

Terms can change per contest, so confirm the pool and fees in your agreement.

Vanguard: Both in One Audit

Vanguard combines the two models in one engagement.

Two teams: Team A uses manual review and invariant fuzzing; Team B uses Helix, Guardian's AI auditor.
Defender contest: a $100,000 Critical pot funded by Guardian, non-blocking for deployment.
Bug bounty: hosted by Guardian, with $50,000 in Critical matching.
Updates: six months of post-launch review, up to 2,500 onchain SLOC.

Each team cross-checks the other, and only human-verified findings enter the final result.

Frequently Asked Questions

Is an audit contest cheaper than a private audit?

Not always. A contest costs its pool plus platform and judging fees, and some pools are partly refunded if nothing valid is found. Compare the total, including fix review, against a private quote for the same scope.

Can an audit contest replace a private audit?

For high-value code, we would not rely on it alone. Contest rewards follow findings, so no one is paid to cover the whole scope. Run the contest after a private audit and its fix review.

When should an audit contest run?

After the private audit's fixes are merged, on a frozen commit. Leave time for judging, an appeal period and a fix review before launch.

What happens if an audit contest finds nothing?

It depends on the pool rule. Some pools are mostly refunded, some still pay a reduced amount, and Guardian's Defender pot pays only for a valid Critical. A quiet contest is evidence, not proof, that the code is safe.

Sources

Get a private audit and a contest in one

Vanguard pairs two independent audit teams with a $100,000 Guardian-funded Defender contest on the same scope.

Get a quote Explore Vanguard