CodeHawks primary sources — 2026-05-15

Scope

Primary-source notes for a new CodeHawks mechanism page focused on competitive-audit marketplace structure, judging, and payout logic.

Primary sources reviewed

• https://codehawks.cyfrin.io/
• https://docs.codehawks.com/
• https://docs.codehawks.com/hawks-auditors/what-is-an-auditing-competition
• https://docs.codehawks.com/judging/the-judging-process
• https://docs.codehawks.com/hawks-auditors/payouts
• https://docs.cyfrin.io/codehawks/overview
• https://github.com/Cyfrin
• https://github.com/Cyfrin/codehawks-docs

Key source notes

• CodeHawks is presented as Cyfrin’s competitive audit platform, not just a generic audit agency landing page.
• The docs explicitly define three operating roles: sponsors, Hawks (auditors), and judges.
• Competition flow is productized into announcement, kickoff, auditing, community judging, lead judging, appeals, and rewards.
• Community judging and lead judging are distinct phases, with portal-mediated assessment before final review.
• Reward allocation is formulaic rather than purely discretionary: high findings receive 5x the base share of medium findings, and duplicate density reduces each finding’s payout share through a 0.9^(findingCount - 1) / findingCount style decay.
• Duplicate handling is rooted in shared cause rather than raw issue wording or claimed severity.
• Payouts are paid in USDC on ZKsync according to the docs, which makes payout rail choice part of the platform surface.
• The Cyfrin overview positions First Flights as a beginner-friendly funnel, suggesting auditor education and supply growth are part of the platform model.
• The Cyfrin GitHub org shows CodeHawks inside a wider security ecosystem that includes audit reports, education, and tooling, which matters when comparing platform power against more standalone marketplaces.

Why this cleared the bar

CodeHawks is not just another smart-contract audit brand. The reusable mechanism is the combination of contest lifecycle control, dual-layer judging, duplicate-sensitive payout formulas, severity encoding, and a training funnel that manufactures future participants. That makes it a better comparison point for security-marketplace infrastructure than a flat audit firm label would.