Track 9 · What now · lesson 2

Audit contests as practice

15 min

The Breach Lab was practice. Audit contests are the real thing, with real money for real findings — and they will take you as you are, today.

On Code4rena, Sherlock, Cantina and similar platforms, protocols post their code before launch and pay a prize pool to whoever finds vulnerabilities. Anyone can enter. No permission, no credentials, no interview — you submit findings, and valid ones are rewarded.

It is the most direct path from "I finished a course" to "I found a real bug in real code", and it is open to you now.

Why enter even if you win nothing

Most people find nothing in their first several contests. Enter anyway, because the process itself is the best training available:

You read a lot of unfamiliar production code, fast — the skill from the last lesson, under pressure.
When results publish, you see every valid finding, with explanations. That is a stream of real vulnerabilities in real code, curated for you.
You calibrate. You learn what actually counts as a bug versus what you thought was one.

Predict

You enter three contests and find nothing valid. Was it a waste?

No — the published findings afterward are a curriculum you can't get anywhere elseYes — no payout means no valueOnly if you read the winning submissions

What a finding looks like

A submission is structured, and it looks a lot like the Breach Lab in words:

Severity — high, medium, low, by impact and likelihood.
Description — the flaw, precisely.
Impact — what an attacker gains, concretely.
Proof of concept — often a Foundry test that demonstrates it. Exactly what you wrote in track 6.
Recommendation — the fix.

You have done every part of this already. The Breach Lab exploits were proofs of concept; the patches were recommendations. This is that, on code nobody has solved for you.

Check

What's the main reason to enter audit contests as a beginner?

The reading practice and the published findings afterward are unmatched trainingThey're an easy way to make money quicklyThey require a security certification

Worth remembering

Audit contests (Code4rena, Sherlock, Cantina) pay for vulnerabilities and are open to anyone.
Expect to find nothing at first — enter for the training, not the payout.
Published findings after each contest are a curated stream of real bugs with explanations.
A finding is severity + description + impact + proof-of-concept + fix.
You already practised every part of that in the Breach Lab.