Cantina

Cantina is an open security audit marketplace and AI-native platform founded in 2023 by Spearbit that connects Web3 protocols with vetted independent researchers through prize competitions, managed reviews, and guild-based engagements—serving both Solana and EVM ecosystems.

The Problem Cantina Was Built to Solve

Web3 security audits have historically suffered from fragmented supply, opaque pricing, weeks-long quote turnarounds, and a selection process that rewarded marketing budgets over demonstrated technical skill. Protocols often picked auditors based on name recognition rather than evidence of finding critical bugs. Cantina was designed as a direct counter: a merit-based marketplace where researcher reputation is built on public results, not promotional spend.

Core Service Tiers

Cantina operates three distinct engagement models:

Competitive Audits are open competitions where any verified researcher can submit findings against a fixed prize pool. Pool sizes range from tens of thousands of dollars to over $2 million. The Ethereum Foundation's Pectra hard fork review and Uniswap v4's competition—both exceeding $2M in prizes—are among the highest-profile examples. Researchers earn based on the severity and uniqueness of their findings.

Managed Reviews work more like traditional audit firms: Cantina curates a dedicated team from its vetted researcher network and matches it to the complexity of a protocol's codebase. Engagements typically complete in two to eight weeks.

Guild-Based Engagements allow security firms and specialist groups to host services on the platform under their own brand. At launch, OpenSecurity also offered Web2 security services through this model, extending coverage beyond smart contracts to broader application security.

A merit-based reputation system underlies all three tiers, prioritizing demonstrated skill over marketing reach.

AI-Native Security Layer

Since its marketplace launch, Cantina has expanded into agentic security tooling. Two AI products now sit alongside its human-review services:

Clarion is an agentic security platform that aggregates findings from 30+ integrated tools—GitHub, AWS, Okta, Datadog, and others—prioritizes them against real exposure, and autonomously executes remediation actions within configurable permission boundaries. It maintains a shared security memory layer and provides full audit logging of every verified action. Typical remediation time is two to five minutes for issues handled end-to-end by agents.

Apex is an offensive security agent that discovers exploitable vulnerabilities, generates fix recommendations, and feeds findings into Clarion for correlation. Together, the two tools target coverage equivalent to a security team ten times the size of any headcount expansion.

The Bug Bounty Platform complements these tools by deduplicating researcher submissions, validating impact claims, and surfacing high-confidence signals—filtering noise before findings reach security teams.

Researcher Network and Payouts

Cantina maintains a network of 200+ vetted researchers gated behind a three-tier Fellowship Program. As of 2026, the platform has paid out $46.7M+ to researchers across more than 200 protocol reviews. Individual competition earnings range from $10,000 to over $500,000 per engagement depending on findings severity and pool size.

Spearbit Connection

Cantina was created by Spearbit—one of Web3's most respected security firms—which runs parallel invite-only private audits for top-tier protocols. The two brands formally merged in May 2025 into a unified end-to-end security stack: Spearbit's elite researchers handle high-assurance private reviews while Cantina's open marketplace runs competitive engagements and live bug bounties. Protocols using Cantina access the same researcher graph Spearbit has cultivated since its founding.

Solana Ecosystem Coverage

Cantina explicitly supports Solana alongside Ethereum, Polygon, Arbitrum, Optimism, Base, and Cosmos. Its portfolio includes multiple direct engagements with the Solana Foundation: reviews of a token-acl-gate program, a subscriptions program, a Delivery vs. Payment (DvP) program, and a multi-delegator program—all conducted in 2025–2026. Additional Solana-native audits cover Sanctum (Sols), Multiliquid's Solana Swap Program, and Ondo's GM Solana product.

Notable Clients and Certifications

Cantina's portfolio spans many of the largest protocols in Web3: Coinbase, Uniswap, Aave, Morpho, Scroll, Optimism, Sky, and the Ethereum Foundation. The company holds SOC 2 Type II certification and carries a 4.6/5 star rating based on published reviews. Cantina has also partnered with Anthropic's Cyber Verification Program to enhance its AppSec agent capabilities.

Funding

Cantina launched with a $7 million seed round led by Framework Ventures, with participation from Nascent, 1kx, Volt Capital, Breed VC, and Robot Ventures. Total disclosed funding has since grown to $16.5 million.

Solana Ecosystem Fit

For Solana protocols, Cantina offers a large researcher pool with demonstrated Solana/Rust experience, open competitive audits accessible to teams at any budget level, and a growing AI-powered toolset for ongoing security monitoring. Cantina's marketplace model and active Solana Foundation relationship position it as one of the principal audit options for the network.