Quick Start
Welcome to Cyfrin CodeHawks! Here's a quick and easy guide to get you started as an auditor and submit your first vulnerabilities.
1. Create an account on CodeHawks
First, create a new account by visiting codehawks.cyfrin.io and clicking the "sign up" button in the top right corner:
2. Subscribe to your first CodeHawks competition
Navigate to the competitions page and look for "Live" or "Upcoming" contests:
Don't want to miss any of our competition announcements?
Clicking on a competition will open its details page, with important information such as:
Prize pool severity breakdowns
Start and end dates
nSLOC and scope
Scoring
Link to the GitHub repository (if the competition is live)
Every contest also comes with details that will help you understand:
The code base
Scope
compatibilities
How to get the code base up and running
New contests are announced almost every week. When you find a contest that fits your skills, click on the subscribe button to join it:
3. Submit your first finding vulnerability
Once you've found your first vulnerability, navigate to the competition page, and click on the submit "submit a vulnerability" button:
To submit your vulnerability, you'll be asked to insert:
Title - a <250 character descriptive title of your submission
Severity - a matrix of likelihood and impact characterizing your finding. Read How to Evaluate a Finding Severity for a full explanation.
Description - a detailed description of the vulnerability found and how to reproduce it.
5. Await for the judging results
After the auditing period ends, judges will evaluate each submission carefully to determine its validity, severity, and overall quality.
Every phase will be communicated on the platform and via announcements on Discord.
Learn more about the judging process.
6. Appeal to the judge's results
For 48 hours following judging, appeals will be accepted to contest judgments. This period will be clearly announced across all channels.
During the 48 hours, interactions will be enabled on your GitHub submissions. During this time, you may leave comments detailing your escalation for re-assessment.
7. Get rewarded
Once the final report is released, results will be announced, and payouts will be sent to the winners.
Rewards are paid out in USDC through the ZKsync chain. Crediting the reward won't be possible without a ZKsync wallet connected to the user profile.