Decentralizing cybersecurity: Public audits benefit web3 industry | Opinion

Security audits are vital—but their results usually go unchallenged, while a single review can’t always spot all vulnerabilities. Public audits, pushing white hat hackers to double-check the audit’s results through DeFi incentives, could boost the security of the entire web3—as they would make bug bounties affordable to even small-scale projects.

Why usual audits aren’t always enough 

According to the Q3 Security Report by Hacken, the web3 industry lost a staggering $1.8 billion in 2024 alone. Nearly 40% of these losses were caused by preventable issues like smart contract vulnerabilities and reentrancy attacks. Alarmingly, 90% of hacked projects had never undergone any audit, highlighting a critical oversight in security.

Traditional security audits are essential—they offer in-depth, expert-led reviews at critical points in a project’s lifecycle, ensuring the safety of user funds. However, due to the centralized nature of these audits, there’s usually no opportunity to challenge their findings—unless a project invests in a second audit, which is a rare occurrence. Expecting a single review to catch everything is unrealistic, as even the most diligent auditors are prone to human errors.

The solution to this problem lies in the decentralization ethos of web3. Crypto projects could engage a wider white-hat hacker community for public audits, thus providing decentralized, continuous, and community-driven security reviews.

Decentralized security audits: Principles & perks 

The number one issue in designing decentralized audits is giving strong incentives to independent auditors while ensuring they don’t come at extra costs for the projects. Let me chart one possible way to strike this balance through DeFi tools. 

Imagine the security platform launching a dedicated smart contract-based reward pool whenever it has a new client requesting an audit. The company fills this pool with a share of the audit cost while its token holders add more by staking the platform’s tokens. After the platform completes its own audit, independent security researchers join the game—and double-check the client’s code. When the community audit is complete, independent auditors and stakers collect rewards from the pool.

This is how DualDefense Flash Pools work in Hacken. Every client paying for a private audit receives an additional public audit, creating a dual-layered security model. And in the true spirit of DeFi, community participation is incentivized with staking rewards.

This approach has far-reaching benefits: the community gains a high real-yield APY instrument, auditors welcome peer testing of their findings, and white-hat hackers earn rewards for valid bug discoveries—even for finding clean code. For сrypto projects, it means an increased assurance of their code’s safety. For the entire web3 industry, it offers a feasible approach to increase security and combat cybercrime.

Decentralized audits democratize access to security for web3 projects, especially nascent ones. Many crypto startups have great MVPs but often lack the resources for traditional bug bounties, which can be costly—no one can predict how many bugs ethical hackers might uncover. The model we propose tackles this with a fixed, community-funded reward pool, making security accessible and predictable from the outset.

Implementing this model poses quite a tangible risk for auditor companies: it puts the platform’s reputation on the line by allowing external auditors to verify its work. This way, however, the company gets an extra incentive to approach every audit even more carefully, knowing how public the results of its work will be—ultimately, this would benefit the entire industry. Smart contract auditors shouldn’t walk away after an audit—it’s time to be bold and take responsibility.

Finally, the public audit pools introduce something DeFi lacks—rewards backed by real-world money. This model guarantees that users’ returns aren’t driven by inflationary token emissions, often resulting in unsustainable growth and value declining over time. Instead, users gain from real market activity, making a step toward more sustainable financial models in DeFi.

Combining traditional audits with open community-backed audits paves the way for a resilient security model that suits projects of all scales. Public audits, supported by DeFi-driven incentives, mark a transformative step toward an accessible, robust, and proactive security culture in web3.

Dyma Budorin

Dyma Budorin is a co-founder and CEO of Hacken, the leading blockchain security auditor, co-chair of EEA DRAMA (a DeFi Risk Assessment Management and Accounting group), and co-author of crypto industry standards. After over eight years of auditing experience at Deloitte, he served as an audit counselor at Ukrspetsexport and deputy CEO of strategy and development at Ukrinmash (both Ukrainian state agencies). Being a crypto enthusiast and cybersecurity expert, Dyma has had his insights featured by BBC, Wired, Cointelegraph, Coindesk, and other reputable media outlets. He is also a Vice President of the Blockchain Association of Ukraine.