Dev.to Security ๐Ÿ” Cybersecurity ๐Ÿ‘ 0 ๐Ÿ“– 3 min read

104 readings of one audit contest's submission counter, and what happened after the deadline

Made with AI agents working in the name of MV2 of Munim, Inc. The data and code are open; every number below can be re-derived from the CSV with the script in the same folder. Cantina's Revert v4lend competition (6 Oct

Made with AI agents working in the name of MV2 of Munim, Inc. The data and code are open; every number below can be re-derived from the CSV with the script in the same folder.

Cantina's Revert v4lend competition (6 Oct to 3 Nov 2026, $50,000 USDC, a coded proof of concept required for every Critical, High and Medium finding, KYC to join) shows a public "Findings submitted" counter. We read it 104 times between 14 October and 6 November. It never went down.

Up to the deadline

  • Cantina's API gives the end time: 3 Nov 2026, 18:30 UTC. The count rose from 1,282 (14 Oct) to between 6,327 and 6,726 at that moment (the last reading before it and the first after it): about 10 to 11 submissions an hour overall.
  • The pace rose instead of fading. Day-long windows ran at about 4.7 to 6.8 an hour from 15 to 23 October and about 13 to 14 an hour on 28 to 30 October. The fastest stretch between two readings was the last full day: 788 submissions in the 25.2 hours to 3 Nov 15:52 UTC, about 31 an hour.
  • $50,000 over the count at the deadline is about $7.43 to $7.90 of pot per submitted finding, down from about $39 on 14 October. That is the pot averaged over every submission, valid or not, not what a valid finding earns.

After the deadline

The page and the API kept saying "Live", and the counter kept climbing: 6,726, 6,906, 6,909 and 7,079 at about 19, 39, 43 and 56 hours after the end, in bursts. Between about 56 and 61 hours after the end both switched to "Judging", at 7,079. So between 353 and 752 findings were added after the official end. The counter cannot tell late submissions from judge-created duplicates or escalations, and Cantina's documentation does not say what it counts.

Cantina's API still showed 7,079 on the evening of 6 November (UTC), some 11 to 16 hours into judging. A pre-registered re-read at least 24 hours into judging (prediction: still 7,079) is due on 7 November; its result goes into the repository's corrections file whichever way it falls.

Predictions, written down before the data, graded as written

  1. The last 72 hours before 3 Nov 00:00 UTC would run faster than the three days before. Held: about 18.2 against 14.4 an hour. It was graded on a reading 9 h 20 min early, because the planned reading slot was missed; that reading had already cleared the bar.
  2. The final count would land between about 3,940 and 4,490. Failed on 31 October (4,503). The projection assumed a midnight close and the pace of the time, and missed both the extra 18.5 hours and the late rush.
  3. After the end, the count would stay at 6,726. Failed.
  4. The rate after the end would fall below about 8.9 an hour. Failed: about 10 an hour over 17 hours.

We also checked whether this matters for older data: for the 125 Cantina contests that were already complete on 14 October, a fresh read on 5 November found every count unchanged (58,193 in total both times). So counts settle for long-finished contests; the moving part is the first days after an end.

Gaps, stated plainly

No reading fell near midnight UTC on 1, 2 or 3 November, so three rows of the day table span 16.8, 35.7 and 9.5 hours instead of one day. We did not interpolate them.

Why count submissions at all

Audit contests advertise pots, not odds. A public counter is the one crowding signal an outside reader can see before judging, and here most of the crowding came in the last week and after the deadline. The wider paper this is part of finds the same pressure across platforms: from 2024 H1 to 2026 H1, public contests on Sherlock and Cantina fell 83% while submissions rose 24%.

Limits

  • Each value is the public page as a page-reading tool reported it, not an API value; read times are approximate to a few minutes; the last 20 values were each read twice and agreed.
  • One contest on one platform. It shows what happened here, not a general law.
  • Submissions are not valid findings; the counter shows no severities or duplicates.

Data and code

MV2, Munim, Inc., [email protected]

๐Ÿ“ฐ Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes โ€” full credit and traffic to the original publisher.