How It Works

Every report follows one main path: Submitted → Triage → Sent to project → Project review → Accepted → Paid. Everything else branches off that spine. This page explains each stage, our service timelines, and how appeals work.

#The report lifecycle

1. Submitted. Your report enters the queue. Automated checks confirm the required fields are present, your submission is within rate limits, and the target asset is in scope. Missing required fields or out-of-scope targets are rejected at this stage.

2. Triage (manual review). A CertiK triager reads your report end to end, reproduces your proof of concept, sets the severity, and certifies whether it's a valid finding. Valid findings are sent to the project; invalid ones are rejected with a reason.

3. Sent to project. Your certified finding is relayed to the project. A response window begins.

4. Project review. The project confirms the finding, adjusts severity, or rejects it. CertiK rates severity independently of the project — the project's decision on validity and reward stands, subject to the appeals process below, but the independent assessment is on record.

5. Accepted → Paid. Accepted findings move toward payment. If the program requires KYC, you complete it before payout. The project pays you directly — CertiK never holds or disburses funds. The payment is confirmed on-chain and your report is marked Paid.

A report can also be Withdrawn by you at any time before it's terminal (permanent, no payment), or moved into Remediation for appeals and manual handling. Terminal outcomes are Paid, Rejected, and Withdrawn.

#Severity levels

Hunt uses three severity levels: Critical, High, and Medium. Low and Informational findings are deliberately excluded to keep the focus on real impact. The exact reward range for each level is set per program — check each program's page.

#Service timelines

We track two clocks and report against them transparently:

• First response (acknowledgment): a triager makes first contact within 48 hours of submission, counted in business days (Mon–Fri). Critical reports are acknowledged fastest — typically within 24–48 hours.
• Resolution (Accepted → Paid): our target from acceptance to payout is about three weeks.

These are independent of how quickly the project responds. If a project goes silent, the report doesn't disappear — see the backstop below.

#When a project goes silent

Projects have a defined window to respond after a finding is sent to them. If a report sits without a project response for an extended period, you have a recourse: it can be escalated for manual handling so CertiK can chase the project on your behalf. There is no automatic acceptance — but a stalled report won't be forgotten.

#Appeals

• Rejected by a triager: final.
• Rejected by a project: final, unless the project re-opens it.
• Automated rejections: can be appealed once into manual review.
• Issues after acceptance (for example, a payout problem) are handled through Remediation rather than the appeals path.

Disagreements about validity, severity, or reward are normal. Raise them professionally through the platform's review and appeals process — see Rules of Conduct.