Hats.V2 Review 2026: Onchain Bug Bounties and Audit Contests

Hats.V2 is the second version of Hats Finance, a decentralized marketplace for bug bounties and audit competitions. It aims to steer part of the value lost to hacks each year toward rewards for researchers who disclose flaws responsibly.

The homepage calls the platform permissionless and scalable, and says anyone can provide liquidity. DefiLlama lists it as a Bug Bounty protocol on Ethereum, Arbitrum, Polygon, BNB Chain and Optimism, live since June 2023.

Total value locked is about $155,000, down roughly 4.5% over the past week. That is small, which matters because the size of a bounty influences how much attention researchers give a target. No audits are listed and no token is shown in the DefiLlama data.

Hats runs bug bounties onchain. A project sets up a vault with funds earmarked as a reward for anyone who finds and responsibly reports a vulnerability. The idea is that a legitimate payout becomes more attractive than exploiting the bug, which the protocol's description frames against billions of dollars lost to theft each year.

Liquidity providers can add funds to these vaults, so the reward pool does not rely only on the project's own money. In return, they take on the risk that part of the pool is paid out if a valid vulnerability is confirmed. Specific reward rates, payout rules and review procedures are defined per vault and are not given in the material reviewed.

Hats also describes a marketplace for audit competitions, where researchers compete to find issues in a codebase. The protocol is deployed on Ethereum, Arbitrum, Polygon, BNB Chain and Optimism.

Fees are not published in the material reviewed, and the DefiLlama listing carries no fee data. Users should check each bounty vault's terms on the platform before depositing or submitting.

There is also no protocol token listed, so any fee or reward structure would be specified per vault or in the official documentation. Network gas fees on the chosen blockchain also apply to transactions.

No audits are listed for Hats.V2 in the DefiLlama data, and the project's materials reviewed here do not describe a licence, insurance or custody arrangement. As with any smart-contract protocol, bugs in the contracts or in how bounty payouts are decided could lead to losses for liquidity providers.

Liquidity providers also carry a built-in risk: their deposits back the bounties, so a valid finding can reduce the pool. Check the specific vault terms, and read the official documentation and any published audit reports before committing funds.

Hats.V2 is for smart-contract developers who want to fund a bounty program, security researchers looking for paid disclosure channels, and experienced DeFi users willing to supply liquidity while accepting payout risk. It is not suited to anyone seeking a simple, low-risk yield product.