# Introducing The Contest Academy 26 November 2025 Announcements ยท [The Contest Academy](https://0xsimao.com/the-contest-academy) ยท 0xSimao --- Since 2022 I have gone from an anonymous contestant to top-2 on Sherlock and on the Code4rena 90-day leaderboard, finished in the top 3 of an audit contest 28 times, and been rewarded 54 times for my findings, earning over \$600k in public contest rewards. Today I am launching The Contest Academy: a place where the next generation of auditors can learn how the best in the field think, find, and report critical bugs. **Who Am I** I am 0xSimao, an aerospace engineer who got fed up with corporate life and dived into Web3 security in mid-October 2022, three years ago, after only four months at a software company as a full-stack engineer. I was lucky to hear about Web3 security early; if you are reading this, the same probably applies to you. The meritocracy of this industry shows time and again that those who put in consistent effort and dedicate themselves fully to Web3 security claim the rewards. I went from hundreds a month to hundreds an hour, purely by trying to be as good as possible and to find the bugs everyone else misses. I joined a firm from mid October 2022, [ThreeSigma](https://threesigma.xyz/), in an internship program, and went through Mastering Bitcoin, Mastering Ethereum, Damn Vulnerable Defi CTFs, and then started shadowing and helping in whatever auditing or dev task was needed. In my opinion, joining a firm early is the best decision you can make: it is far easier to get started with experienced people around you. I started competing in December 2022, around Christmas time, and earning my first rewards in January 2023, 498 USD. This was the [GoGoPool](https://code4rena.com/audits/2022-12-gogopool-contest) contest on Code4rena, in which I submitted 3 issues, and placed #36. My handle at the time was 0x73696d616f, which is "Simao" in ASCII. Looking back it was a terrible decision โ€” nobody could remember it, not even me ๐Ÿ˜ข After that win, just two months in, I was convinced I had found gold. I turned 95% of my energy towards auditing and spent all my waking hours on it, either on firm audits or on contests. For a long time I never ranked especially high, for two reasons: I was not experienced enough, and my full-time firm duties left me less time than I wanted. Still, I got some good results, earning hundreds and then thousands of dollars over the following months, while being essentially fully booked at Three Sigma.\ My first major win came exactly when I took August 2023 off: the Tapioca DAO [contest](https://code4rena.com/audits/2023-07-tapioca-dao), which earned around \$14k ([details](https://x.com/0xSimao/status/1992935739240366482)). That was the moment I realised I could reach the top of the leaderboards regularly.\ Since then, you can check out my profile [here](https://audits.sherlock.xyz/watson/0x73696d616f), but I have been top-2 in the Sherlock leaderboard for almost all of 2025, having been winning contests since the Summer of 2024 (again, vacation from my full time audit job) and reached top 2 in the Code4rena 90 days leaderboard at some point as well. **Code4rena** Notice that my initial results were all on [Code4rena](https://code4rena.com/), which was the pioneer of audits contests. Back then, legends like cmichel had already made \$1M in earnings, and it was by far the place to be for audit contests. The experience was not that different from today. The dashboard was less polished and issues were submitted through a simple form, but all judging happened on GitHub. There was little to no AI spam, yet auditors were still making three to low four figures from mostly automated tooling โ€” simple tools like Slither, largely condition-based. A single judge went through every finding; helper roles came later. The OpenSea [contest](https://code4rena.com/audits/2023-07-tapioca-dao) is probably the most famous Code4rena contest: even Spearbit entered as a team, and won it, netting \$300k. I have earned a total of \$60k on Code4rena, and am currently placed #81. **Sherlock** [Sherlock](https://sherlock.xyz/) came a little after Code4rena, and many people disliked its much stricter rules. I think that opinion has since changed: a common set of rules that applies regardless of the contest makes for a fairer competition. Their most successful move, to my mind, was the Lead Senior Watson model: an auditor is picked to lead the contest, commits to it, and earns fixed pay โ€” at the time \$25k per week. It has since been reduced to a maximum of \$12.5k per week, still generous given that the lead also draws from the common pool, which in my experience brings it close to the old \$25k rate. I have earned a total of \$442k on Sherlock, and I am ranked #2 on the leaderboard. **Cantina** [Cantina](https://cantina.xyz) appeared later, around 2023/2024, and brought audit contests with it. They built their own platform covering everything to do with an audit, a one-stop shop they claim is faster than working through GitHub. I have not used it extensively, but a customisable dashboard for everything audit-related is genuinely helpful โ€” GitHub can be a pain to bend to the task. Cantina has run some very successful contests, such as the Blast contest I took part in, where plenty of people made five figures and some made six.\ They pioneered the conditional contest, where the reward unlocks according to what is found: if at least a medium is found the pot is \$100k, if at least a high is found it is \$500k. It was controversial at the time and still is, mostly because balancing the demands of auditors and sponsors across severities is hard, as is structuring the pots well. Every contest platform now offers conditional pots. I have earned \$45k on Cantina and am ranked #72. **Immunefi** [Immunefi](https://immunefi.com/) joined the audit contest scene slightly after Cantina and has hosted many competitions. The auditors on Code4rena, Sherlock and Cantina seem to be a different crowd from those on Immunefi, which I would guess comes from Immunefi having its own talent pool through its bug bounty platform. Where Code4rena and Sherlock focus on DeFi, Immunefi and to some extent Cantina host more general contests โ€” infrastructure, L1s, L2s and the like. These are enormous, upwards of 100k lines of code, with rewards to match. Top performers routinely earn \$100k or more from them. I do not have much experience there, since I tend to do DeFi audits, though I did take two 4th places in two Sway audits on Immunefi. The Fuel Attackathon is one example of an Immunefi audit competition. I took part and earned \$500.\ **CodeHawks** [CodeHawks](https://codehawks.cyfrin.io/contests) is another audit contest platform that appeared around the same time as Cantina. I have only entered one of their contests, and the dashboard experience was smooth. They are probably best known for hosting the ZKsync [competition](https://codehawks.cyfrin.io/c/2024-10-zksync/results), which was huge: \$500k in rewards, with first place earning \$236k. They also have a programme called Eagles, whose members earn fixed rewards and work on Cyfrin private audits. They pay out on the ZKsync network, or at least they did โ€” worth checking whether that is still the case. Honorable mentions [HackenProof](https://hackenproof.com/) is also an audit contest platform, but isn't as well known in the SR community and I have never personally participated. There are also other platforms coming up, so just make sure to follow the Contest Academy on news. **Private Audits** From 2022 to 2024 inclusive I was doing full time audits at Three Sigma. Since 2025, I began doing collaborative audits at Sherlock and [Blackthorn](https://www.blackthorn.xyz/), a top tier auditing firm, along with some of the best of the industry. Essentially, there is a low chance you will be doing contests full time, which can become quite draining with escalations, and you will want to join forces with other firms on some audits or do solo audits. It can be argued that later on contests become less effective for earnings, but it depends a lot on your skill, personally I am still earning top rates on Sherlock as Lead Senior Watson (\$12.5k / week + contest pot), and some other people are still making big bucks ([Zigtur](https://x.com/zigtur)).\ [Portfolio](/private-audits) **What is The Contest Academy?** **Bug Deep Dives** I will post the best-paying bugs from contests as often as I can, along with the context needed to find them. **Contest Mastery Series** An in-depth breakdown of every active contest platform: rules, payout structures, senior auditor handles, timeline quirks and the communication style expected. **Methodology and Workflows** I will share my current methodology at some point, and how it has evolved, including the tools I use and the ones others are using. **Interviews With The Best** Reaching out to the current top-10 auditors across platforms, and to newer auditors doing well, to learn about their methodology, their findings and themselves. **Knowledge Sharing** Reach out to me on X, Discord or anywhere else with topics you would like covered in The Contest Academy. I will take notes and see what I can do. **Who This is For?** From absolute beginners to top auditors, everyone benefits from knowing the best-paying bugs in contests, the current state of the industry, and how other top auditors think and work. **Why Now?** The bear market is coming and I need something to do.\ More seriously: I am arguably top-10 in this industry, and there is still no resource built specifically for audit contests. It just makes sense. --- Newer: [Introducing The Bug Deep Dive Series](https://0xsimao.com/the-contest-academy/introducing-the-bug-deep-dive-series)