A crypto bug bounty program is a set of public rules that lets security researchers report eligible vulnerabilities in specified blockchain, smart-contract, or application assets, sometimes in return for a reward. It is permission to test only the assets and methods the program explicitly authorizes—not a general license to probe a company’s systems.
How a program works
- Read the rules: identify in-scope contracts, deployments, repositories, test networks, excluded findings, safe-harbor language, disclosure limits, and whether each asset is eligible for a bounty.
- Test only within authorization: use the permitted environment and methods. Stop if a test could affect real users, move funds, expose private data, or disrupt a service.
- Report privately: provide a clear description, impact, affected asset and version, and the evidence requested by the program. A minimal proof can help triage, but do not publish exploit details or access other people’s funds.
- Triage and resolve: the project or platform checks scope, reproducibility, severity, prior reports, and eligibility. The team may request clarification, fix the issue, decline the report, or offer a reward under its published terms.
Why crypto scope needs care
A program may cover a specific smart contract but exclude its website, a third-party wallet, a test deployment, or another contract in the same protocol. Blockchain code can also control assets or governance, so unauthorized live testing can create irreversible effects. A page that advertises a maximum reward does not authorize every related target or guarantee that any report will qualify for that amount.
Some programs request a proof of concept, identity checks, or specific disclosure steps; others use different rules. Read each live program’s asset list, exclusions, submission requirements, severity criteria, reward currency, and payout conditions before doing any work. A bug bounty, vulnerability-disclosure policy with no payment, and private security contact are not necessarily the same arrangement.
Bug bounty versus security audit
An audit is usually a defined review performed for a client over a particular codebase and period. A public bounty invites eligible researchers to keep looking at listed assets under ongoing program rules. Neither process proves that a system is free of bugs; the bounty also does not replace an incident-response plan when an exploit is already happening.
Limits and risks
Reports can be marked out of scope, duplicate, not reproducible, or below the program’s reward threshold. Published maximums are ceilings, not promises; reward amounts and timelines depend on the specific terms and assessment. Researchers should retain a copy of the rules that applied when they submitted, avoid tests beyond written authorization, and use the designated private channel. Project teams should publish clear scope, exclusions, disclosure expectations, reward logic, and status updates so researchers can understand what participation means.
History
- 2015: The Ethereum Foundation says it launched a bounty program for the Ethereum network and related software before the network’s public launch.
- December 2020: Immunefi says it launched with a focus on Web3 bug-bounty programs, reflecting the growth of dedicated crypto security programs.
Common Misconceptions
“The advertised maximum is the amount a researcher will receive.”
A maximum is a ceiling. Eligibility, impact, severity, duplicates, proof requirements, and the program’s payout rules determine whether a report qualifies and what reward, if any, is offered.
“A bug-bounty page authorizes testing the whole project.”
Authorization is limited to the listed assets and allowed methods. A related website, deployment, wallet, or third-party service may be outside scope.
Criticisms
- Reward and triage uncertainty: researchers and programs can disagree about scope, impact, duplication, or reward level. Unclear rules and slow communication can make this frustrating; the severity and frequency vary by program, so read the current policy rather than assuming one platform’s dispute is typical.
Social Media Sentiment
- r/bugbounty discussion about a delayed Immunefi payout — In a July 2026 thread, one researcher described a seven-month review and a token-denominated award whose market value had fallen by payout; replies included sympathy and criticism, but others argued the program followed its stated conversion rule. These are unverified individual accounts about one case, not evidence of typical platform performance.
Last updated: 2026-10
Related Terms
See Also
- Why Smart Contract Audits Fail
- Crypto Bridge Hacks and Security
- The Drift Protocol Hack and North Korea
- Swap crypto with ChangeNOW
Sources
- OWASP — Vulnerability Disclosure Cheat Sheet — Explains private and coordinated reporting, authorization, communication, and safe handling of vulnerability reports.
- HackerOne — Defining Scope — Describes how programs identify assets and distinguish submission eligibility from bounty eligibility.
- HackerOne — Good Guidelines — Recommends clear scope, exclusions, disclosure policy, reward structure, and expectations for updates.
- Immunefi — Cosmos Bug Bounty Program — Provides a current example of program-specific assets, proof-of-concept, KYC, severity, and reward requirements.
- Ethereum Foundation — Bug Bounty Program — States that the Foundation’s Ethereum bug-bounty program launched in 2015 and describes its network-security scope.
- Immunefi — About — Gives the platform’s own account of its 2020 founding and initial focus on Web3 bug-bounty programs.
- OWASP Smart Contract Security — Incident Response Playbooks — Provides response guidance for smart-contract and protocol incidents, a separate process from advance bug-bounty submissions.