Quick Start

Cyfrin CodeHawks Quick Start Guide for Auditors

Welcome to Cyfrin CodeHawks! Here's a quick and easy guide to get you started as an auditor and submit your first vulnerabilities.

1. Create an account on CodeHawks

First, create a new account by visiting codehawks.cyfrin.io and clicking the "sign up" button in the top right corner:

2. Subscribe to your first CodeHawks competition

Navigate to the competitions page and look for "Live" or "Upcoming" contests:

Don't want to miss any of our competition announcements?

Make sure to follow us on Twitter and join our Discord server!

Clicking on a competition will open its details page, with important information such as:

• Prize pool severity breakdowns
• Start and end dates

• nSLOC and scope
• Scoring

• Link to the GitHub repository (if the competition is live)

Every contest also comes with details that will help you understand:

• The codebase

• Scope

• compatibilities

• How to get the codebase up and running

New contests are announced almost every week. When you find a contest that fits your skills, click on the subscribe button to join it:

3. Submit your first finding vulnerability

Once you've found your first vulnerability, navigate to the competition page, and click on the submit "submit a vulnerability" button:

To submit your vulnerability, you'll be asked to insert:

• Title - a <250 character descriptive title of your submission

• Severity - a matrix of likelihood and impact characterizing your finding. Read How to Evaluate a Finding Severityfor a full explanation.

• Description - a detailed description of the vulnerability found and how to reproduce it.

Learn more on How to Present Your Findingson the dedicated guide.

5. Await for the judging results

After the auditing period ends, judges will evaluate each submission carefully to determine its validity, severity, and overall quality.

Judging is done in two steps:

• Community Judging - a period where all eligible community judges can evaluate others' submissions
• Lead judging - a period where the lead judge confirms or not the community judges' decisions and issue the final pre-appeal judgments.

Every phase will be communicated on the platform and via announcements on Discord.

Learn more about the judging process.

6. Appeal to the judge's results

For 48 hours following judging, appeals will be accepted to contest judgments. This period will be clearly announced across all channels.

During the 48 hours, interactions will be enabled on your GitHub submissions. During this time, you may leave comments detailing your escalation for re-assessment.

7. Get rewarded

Once the final report is released, results will be announced, and payouts will be sent to the winners.

Rewards are paid out in USDC through the ZKsync chain. Crediting the reward won't be possible without a ZKsync wallet connected to the user profile.