To those newbie Web3 devs/auditors going through dark times:
You can always find reasons to quit. You just need to find more reasons to keep going.
- possibility to work from anywhere
- be well paid
- making friends around the world
- constant challenges (it's not boring)
Step 1-2 takes 6-12 months if you're serious. Actually understand EVM internals, common vulnerabilities, and can read production codebases fluently. Most people quit here because it's harder than YouTube made it seem.
Step 3 is where 90% wash out. Contest leaderboards are dominated by the same names. You're competing against people who've found 100+ bugs. Your first few contests? You'll find nothing while watching others claim $50K bounties. The skill gap is brutal.
Step 4 assumes you survived Step 3 long enough to build reputation. Quality hackathon prizes and meaningful bounties go to known researchers.
Missing from this path:
1⃣ Networking (half the job is relationships).
2⃣ Building in public (nobody hires anonymous auditors).
3⃣ Learning DeFi primitives (can't audit what you don't understand).
4⃣ Handling the emotional toll of finding nothing for months.
Step 1-2: 12 months of intense learning.
Step 3-4: 12-24 months grinding for scraps while building rep.
Step 5: Maybe $20K+ if you're top 5% and didn't quit.
It's possible. Just way harder.