Submitting to Immunefi, CodeHawks & Sherlock (2026 Workflow)
To submit Immunefi bug report work (and contest findings) in 2026 you need the right lane: ongoing bounty vs beginner contest vs stake-gated bounty vs curated competition — then follow that platform’s rules. This Andrax tutorial — by Syed Zada Abrar — covers ~60% theory, ~40% checklist.
Prerequisites: How to Write an Immunefi Bug Report That Gets Taken Seriously; How to Start Web3 Bug Hunting; Hub; Foundry + Slither.
Ethics fence: create accounts and read rules. Do not submit spam, placeholder, or AI-spray reports. Do not test mainnet / public-testnet in-scope code. Optional: join a CodeHawks First Flight if one is live — for learning XP, not noise. Immunefi rules and each contest’s rules still apply.
2026 platform map (beginner-usable)
| Platform | Best for | Beginner note | Cite |
|---|---|---|---|
| Immunefi | Ongoing Web3 bug bounties | Impact-first IVS; runnable local PoC; KYC per payout | immunefi.com · rules · report guide |
| CodeHawks First Flights | Learning contests after CTFs | Smaller codebases; XP, not monetary prize pools (per docs) | First Flights docs |
| Sherlock (bounties) | Post-launch / stake-gated signal | Collateral with submissions; check each program for stake size | Sherlock bug bounties · validity criteria |
| Cantina | Competitions + curated bounties | High/Medium often need compiling PoC (rep < 80) | Competition severity / PoC rule |
| Code4rena | Historical report corpus | Wound down ~May 2026 per industry reporting — not a primary 2026 submit target | Verify status before treating as a submit target |
| Hats Finance | — | Ceased centralized ops (2025) — do not recommend as primary | Historical note |
No invented payout, salary, or ranking numbers in this tutorial. Program pages own reward tables.
Immunefi — submit workflow
- Create / sign in to an Immunefi whitehat account.
- Open a live program page. Read: in-scope assets, impacts, out-of-scope, PoC requirements, KYC, responsible disclosure.
- Hunt only under those rules. PoC on local fork / local deploy — never mainnet or public testnet of in-scope code (rules).
- Write the report in Immunefi section order (title → brief → details → impact → risk → recommendation → references → runnable PoC). See How to Write an Immunefi Bug Report That Gets Taken Seriously.
- Submit once through the Immunefi dashboard for that program. Do not email the project around the platform.
- Wait for triage. Use dashboard threads for questions; mediation exists for SLA / payout disputes (described in Immunefi’s public guide) — do not harass or “beg bounty.”
Quality bar: Immunefi warns or bans for AI spray, repeated low-quality reports, OOS spam, and severity misrepresentation (report guide · rules).
CodeHawks First Flight — beginner contest lane
From CodeHawks First Flights docs:
- First Flights are auditing challenges with smaller codebases and different rewards than standard competitions.
- They do not offer monetary prize pools; participants earn XP for findings.
- Join like a competition: account on CodeHawks → subscribe → when live, scope/codebase publishes → review → write PoC → submit via the portal → judging / appeals → XP.
Lab intent: practice real submission UX without treating First Flight as a place to dump speculative Low noise. Read that Flight’s guidelines. One careful finding beats ten empty forms.
Optional: Cyfrin Updraft for prep (linked from First Flights docs) — free curriculum; not required for this Andrax tutorial.
Sherlock — stake-gated bounties (read before you stake)
Sherlock’s public bounty positioning: stake-gated submissions (researchers post collateral with reports), lead-auditor triage, and continuity with prior audit context (Sherlock bug bounties).
Important accuracy fence: stake amounts are program-specific. Do not assume a global “always $250” figure from a blog. Read the live bounty page. (Public governance posts for individual programs have proposed High/Critical stake sizes — those are that program’s terms, not a universal Sherlock constant.)
Before submitting:
- Read criteria for bug bounty reports validity (one issue per report; admin trust defaults; sequencer downtime often invalid; weird tokens often invalid unless listed; etc.).
- Confirm stake / refund / forfeit rules on that program.
- Do not publicly disclose before resolution (platform rules family — follow the live docs tree).
Contests on Sherlock (separate from post-launch bounties) have their own join and judging flows — read the contest brief.
Cantina — audit competition beginner notes
Cantina competitions use impact × likelihood style severity and, by default, a mandatory PoC rule: High and Medium need a coded PoC that compiles and shows impact before the competition ends, for researchers with reputation below 80 (exceptions on the competition page; Dedicated Researchers differ) — competition finding severity.
Also: some competitions require lifetime-win history beyond KYC — check the competition page (Cantina support article on join eligibility). AI-generated findings without validation can lead to disqualification or bans (severity docs).
Beginner path: start with open competitions / bounties that list low barriers; treat Cantina as “quality + PoC,” not spray.
Lab — accounts + First Flight rules (no spam)
Goal: complete the process checklist. Stop before any low-quality submit.
- Immunefi: create account (if needed). Open one educational public program page. Fill a private notes table: assets / impacts / OOS / PoC / KYC. Do not submit anything unless you have a real, complete, in-scope report with local PoC (not today’s mock).
- CodeHawks: create account. Open First Flights docs. If a First Flight is live, subscribe and read that Flight’s guidelines. Optional: participate with a real finding. If none is live, write five sentences on how join → submit → judge → XP works.
- Sherlock: open the bug-bounties overview + validity criteria. Note whether any program you view shows a stake requirement — quote the program page, not memory.
- Cantina: skim competition severity / PoC rule. Note reputation-80 exception. Do not invent prize pools.
ILLUSTRATIVE lab log (keep offline):
Date (IST):
Immunefi program studied (name + URL):
In-scope impact I would need for Critical:
CodeHawks: account Y/N · First Flight live Y/N · docs read Y/N
Sherlock: stake mentioned on page? (quote / N/A)
Cantina: PoC mandatory for High/Med if rep < 80? (Y per docs)
Submitted anything today? NO (expected)
Platform comparison checklist
| Question | Immunefi | CodeHawks FF | Sherlock bounty | Cantina competition |
|---|---|---|---|---|
| Primary reward shape | Program bounty table | XP (docs) | Program bounty + stake rules | Prize pool / scoring (per contest) |
| PoC expectation | Runnable; local/fork | PoC with findings | Per program + validity docs | High/Med coded PoC (default) |
| Beginner on-ramp | Read scope hard | Yes — designed for learners | Stake may gate High/Critical | Watch eligibility + rep |
| Spam tolerance | Low — bans | Judged; don’t spam | Stake + triage filter | Ban risk for AI spray |
Common traps
| Trap | Better habit |
|---|---|
| Submitting Day 15’s mock vault to a real program | Mock is ILLUSTRATIVE only |
| First Flight as money farm | Docs: XP, not monetary prize pools |
| Inventing Sherlock’s global stake | Quote the program page |
| Ignoring Cantina PoC deadline | PoC before competition ends |
| Still aiming primary submits at wound-down venues | Prefer live Immunefi / CodeHawks / Sherlock / Cantina |
Next steps
- Prev (live): How to Write an Immunefi Bug Report That Gets Taken Seriously ܷ DeFi-Specific Patterns: Governance, Bridges & L2 Risks (Hunter View)
- Live: How to Start Web3 Bug Hunting in 2026 · Hub ܷ Foundry + Slither
- Next (live): Your First Real Target: Public-Scope Workflow (Fork-Only Testing)
Educational content by Syed Zada Abrar for Andrax (andraxpentester.in). Authorized research only. Lab teaches account/process setup — do not submit spam.