Cantina
Security platform with AI agents, researcher bug bounties and Spearbit onchain audits.
No project pays to be listed. How we rank
Cantina key facts
| Category | Security and compliance |
|---|---|
| Platforms | Web |
| Company | Agentic security platform; onchain audits by Spearbit researchers |
| Pricing | Not published; depends on codebase size, format and timeline |
| US availability | Available: terms restrict only sanctioned jurisdictions |
What is Cantina?
Cantina is a security platform that sells AI agent products for code security and security operations, plus researcher-run bug bounties. Its onchain security line pairs Spearbit's researchers with AI review for hybrid audits and live bounties. Its about page states 200+ companies secured.
How Cantina works
Cantina runs smart contract audits in two formats.
In a competitive audit, many independent researchers review the same code at once and are paid from a shared prize pool ranked by severity. In a private audit, a matched team works only on your code. Either way, researchers submit findings with write-ups and proofs of concept in Cantina Code. Judges then classify, deduplicate and score them, and researchers can escalate disputes.
Severity runs from Critical, meaning immediate risk of fund loss, down to Informational. In competitions, high and medium findings need a coded PoC before the end, unless the researcher's reputation score is 80 or higher, and submission time does not affect scoring. Bug bounties cover live code: researchers report through the platform, Cantina triages by severity, and payouts follow validation. Some bounties require a refundable researcher deposit that is slashed for spam or inflated severity.
How to start with Cantina
- Teams start on the security reviews page by defining the code in scope, lines of code, format and timeline.
- Cantina matches researchers to the stack, which can be Solidity, Rust, Go, Python or application frameworks.
- For a competition, you fill in a submission template with repositories, commit hashes and prize split, then sign a statement of work before kickoff.
- Most competitive audits run 1 to 4 weeks, and judging plus the report add 1 to 2 weeks.
- The deliverable is a signed report with every finding by severity, recommended fixes and researcher attestations.
Cantina fees and limits
Cantina does not publish audit prices. Its docs say cost depends on codebase size, format and timeline, and that you contact the team for a scoping estimate. In a competition you also fund the prize pool you define, and a bug bounty pays researchers by severity from rewards you set.
Risks to know before using Cantina
- A report covers the repositories and commit hashes named in scope, so later changes or unlisted contracts are not reviewed.
- Competitive audits share your code with many outside researchers at once; Cantina's docs point to private audits for sensitive or confidential code.
- Findings you mark Acknowledged or Disputed in Cantina Code stay unfixed, so read the final status list, not only the severity counts.
Cantina alternatives
Other projects people compare with Cantina.
Web3 security company offering smart contract audits, formal verification, on-chain monitoring and the Skynet rating.
Blockchain analytics company selling investigation, compliance and monitoring tools to agencies and businesses.
Security firm for blockchain and financial companies: smart contract audits, pentesting, red teaming and advisory.
Tool to inspect and revoke token and NFT approvals your wallet has granted to smart contracts.
Web3 security platform running audit contests, private collaborative audits and bug bounties.
Blockchain security firm that audits smart contracts, protocols and infrastructure and builds the Lighthouse client.
Where Cantina ranks on DappAtlas
Listed next to Cantina
- Trail of Bits Security and compliance
- OpenZeppelin Smart contract tool
- Ackee Blockchain Security and compliance
Cantina pros and cons
- Onchain audits staffed by Spearbit researchers
- Runs bug bounties alongside audits
- 200+ companies secured, per its about page
- Most of the site now targets general enterprise security, not only web3
- No published pricing
Cantina FAQ
What is Cantina?
Cantina is a security platform that sells AI agent products for code security and security operations, plus researcher-run bug bounties. Its onchain security line pairs Spearbit's researchers with AI review for hybrid audits and live bounties. Its about page states 200+ companies secured.
How much does Cantina cost?
Not published; depends on codebase size, format and timeline, according to Cantina’s own page (checked Sep 26, 2026).
Is Cantina available in the US?
Available: terms restrict only sanctioned jurisdictions, according to Cantina’s own page (checked Sep 26, 2026).
Sources
How this page works
Sources: Cantina: official site, Cantina: Homepage, Cantina: How Cantina audits work. Data as of Sep 26, 2026.
Not affiliated with any project listed. Educational content, not financial advice.