Add Code4rena, Sherlock and Immunefi audit platforms

[EazyHood]

Summary

Adds the three main competitive-audit and bug-bounty platforms, which the security category was missing entirely.

The category already covers audit firms (Certik, Halborn, Quantstamp, Trail of Bits…) and analysis tools (Slither, Medusa, Halmos, Aderyn…). Between those two sits a third model — crowdsourced review with judged findings — and it is how a large share of EVM protocols actually get reviewed today. None of the three were present.

security is listed as an under-covered expansion lane in this week's digest.

What is added

Providers

Slug	Name	Model	Docs	GitHub
code4rena	Code4rena	Time-boxed public contests	docs.code4rena.com	code-423n4
sherlock	Sherlock	Contests with structured judging	docs.sherlock.xyz	sherlock-protocol
immunefi	Immunefi	Continuous bug bounty	docs.immunefi.foundation	immunefi-team

Offers — one each: code4rena-audit, sherlock-audit, immunefi-bug-bounty.

The distinction is captured in toolType and coverage: contests are pre-deployment and time-boxed, the bounty program is post-deployment and continuous.

Listings: ethereum, arbitrum, optimism.

Validation

• Nine URLs resolved before submitting — website, docs, GitHub org and X handle for all three providers, all 200.
• All three logos are real PNGs, verified by magic bytes. Worth flagging: github.com/immunefi-team.png serves a JPEG despite the .png extension. The file in this PR comes from the immunefi org avatar instead, which is a genuine PNG. Anyone bulk-fetching provider logos from GitHub will hit that.
• Rows inserted in sorted position rather than appended and re-sorted, so the diff is 15 insertions, 0 deletions.
• Every touched CSV re-parsed: row widths match headers, slug order preserved, no duplicate slugs.
• Every !offer:<slug> in the new listings resolves.
• git diff --check clean.

Scope

5 files changed, 15 insertions(+), 0 deletions(-)
+ 3 provider logo PNGs

Companion to #2451 (Certora, Dedaub), which covers the formal-verification side of the same lane. The two touch the same files but different rows and should merge independently.

Rewards address: 0x06f44f4839fd5df4f4670036d028b29dec939363

[github-actions]

Summary

Status	Count
🔍 Total	21
🔗 Unique	15
✅ Successful	20
⏳ Timeouts	0
🔀 Redirected	2
👻 Excluded	0
❓ Unknown	0
🚫 Errors	1
⛔ Unsupported	0

Errors per input

Errors in ./references/providers/providers.csv

• [404] https://www.linkedin.com/company/sherlock-defi (at 15:1) | Rejected status code: 404 Not Found

Full Github Actions output

[USS-Supervisor]

Verdict: REQUEST_CHANGES
Risk: MEDIUM
Summary: Required validation is passing and the current reviewer-owned link-check succeeded, but two of the new provider logo assets violate the provider-logo background rule.
Findings:

• MEDIUM references/providers/images/code4rena.png and references/providers/images/immunefi.png: both submitted PNGs are RGB images without an alpha channel and render on solid square backgrounds. The provider logo README requires transparent-background logos and rejects solid-background images except rare intentional brand-container cases. Please replace these with transparent-background PNGs, or document why the square background is intentionally part of the official brand mark. sherlock.png already has transparent corners and does not need the same fix.
  Confidence: HIGH

CI/link-check:

• Required CI: Generate JSON and validate (isolated) = SUCCESS
• Current-cycle link-check: SUCCESS (started 2026-08-03T05:01:40Z, completed 2026-08-03T05:01:47Z)