Web3 bounties
42 open web3 bounties, each checked against the organizer's official page. 1 closes in the next 7 days and 39 take applications on a rolling basis.
A bounty pays for one defined result: a security bug found and reported, a feature built, an issue closed. Bug bounty programs on HackerOne, Immunefi, Sherlock and similar platforms pay by severity, and many run all year.
Money from blockchain foundations and protocols: ecosystem grants, hackathons with prize pools, retroactive funding and bug bounties for smart contracts.
Rocket Pool Round 41 GMC bounties
Rocket Pool is taking Round 41 bounty proposals on its governance forum until October 7, 2026 at 23:59 UTC. Proposers set the reward they think the work is worth.
Tari Ootle Security Bug Hunt
The Tari Council pays up to 1,000,000 XTM for security bugs in the pinned Ootle commit. The hunt ends at 00:00 UTC on 1 November 2026.
Folks Finance bug bounty on Immunefi
Folks Finance pays up to $200,000 in USDC for critical smart contract bugs, through Immunefi. The program expires on 31 December 2026.
Exactly bug bounty on Immunefi
Exactly pays up to $25,000 in USDC for critical smart contract bugs, through Immunefi. Open on a rolling basis.
Horizen bug bounty on Immunefi
Horizen pays up to $10,000 in USDC for bugs in its ZEN staking contracts and staking web app, through Immunefi. Open on a rolling basis.
XOXNO bug bounty on Immunefi
XOXNO pays up to $20,000 in USDC for critical bugs in its Stellar lending contracts, through Immunefi. Open on a rolling basis.
GMTrade bug bounty on Immunefi
GMTrade pays up to $100,000 in USDC for critical bugs in its Solana smart contracts, through Immunefi. Open on a rolling basis.
Intuition bug bounty on Immunefi
Intuition pays up to $100,000 in USDC for critical bugs in its knowledge graph smart contracts, through Immunefi. Open on a rolling basis.
Golem Network bug bounty on Sherlock: up to 10,000 USDC
Golem Network pays up to 10,000 USDC on Sherlock for bugs in three public repositories. The program has been live since 1 October 2026.
Proximity Prize: Ethereum Foundation research rewards for SNARK soundness proofs
The Ethereum Foundation Proximity Prize rewards solvers who raise machine checked security bounds for hash based SNARKs. Proofs are checked in Lean.
DAWN USD.infra Vault bug bounty
DAWN pays up to $50,000 in USDC for bugs in the USD.infra vault on Immunefi. Live since 12 July 2026.
sBTC bug bounty on Immunefi
The sBTC bug bounty on Immunefi pays up to $250,000 for bugs in the bridge. Live since 2 July 2026.
Cronos Ult app bug bounty on HackenProof: up to $20,000
Cronos pays up to $20,000 in USDC or USDT through HackenProof for security bugs in the Ult trading app and its backend API.
1inch Smart Contracts bug bounty on Immunefi
1inch pays up to $500,000 in USDC on Immunefi for bugs in its swap and limit order smart contracts. Live since June 11, 2026, rolling.
Puffer bug bounty on Sherlock: up to 100,000 USDC
Puffer pays up to 100,000 USDC for bugs in its Ethereum contracts. The Sherlock program has been live since 17 August 2026.
Tenbin Bug Bounty on Cantina
Tenbin pays up to $40,000 for critical bugs in its asset token contracts, from a $100,000 budget on Cantina. Live since 11 September 2026.
Alchemix bug bounty on Immunefi: up to $150,000
Alchemix pays up to $150,000 in USDC for a critical smart contract bug through Immunefi. The program has no closing date.
Cap bug bounty on Sherlock: up to 1,000,000 USDC
Cap runs a bug bounty on Sherlock for its core Ethereum contracts. Critical bugs pay up to 1,000,000 USDC. The program is live with no end date.
Arc bug bounty on HackerOne: up to $200,000
Circle pays up to $200,000 for critical bugs in the Arc network through a public HackerOne program that launched on September 16, 2026.
Aave V4 bug bounty on Sherlock: up to 2,500,000 USD
Aave DAO pays up to 2,500,000 USD for critical bugs in Aave V4 through Sherlock. The programme is live and takes reports at any time.
Babylon bug bounty on Sherlock: up to 500,000 USDC
Babylon Labs pays up to 500,000 USDC for critical bugs in its Bitcoin staking protocol through Sherlock. The programme went live on September 21, 2026.
NUVA bug bounty on Immunefi
NUVA pays up to $40,000 on Immunefi for smart contract and web bugs. The program went live on May 18, 2026 and was last updated on September 18, 2026.
Paradex bug bounty on Sherlock: up to 500,000 USDC
Paradex runs a bug bounty on Sherlock with a maximum reward of 500,000 USDC. The programme is live and takes reports at any time.
Tenor Labs bug bounty on Sherlock: up to 200,000 USDC
Tenor Labs runs a bug bounty on Sherlock with a maximum reward of 200,000 USDC. The programme went live on September 11, 2026 and takes reports at any time.
Extra Finance bug bounty on Immunefi
Extra Finance pays up to $100,000 for a critical smart contract bug on Immunefi. The program has no closing date and was last updated on 16 September 2026.
ENS bug bounty on Immunefi: up to $250,000
ENS pays security researchers up to $250,000 for critical smart contract bugs. The bounty runs on Immunefi with no closing date.
Ethena bug bounty on Immunefi: up to $3,000,000
Ethena pays up to $3,000,000 for a critical smart contract bug. The bounty runs on Immunefi and has no closing date.
Hedera bug bounty on Immunefi
Hedera pays up to $30,000 on Immunefi for bugs in its public network and services. The program was last updated 31 August 2026.
The Graph bug bounty on Immunefi
The Graph Foundation pays up to $50,000 on Immunefi for bugs in its indexing protocol. The program was last updated 27 August 2026.
Immunefi bug bounty program
Immunefi pays up to $50,000 for security bugs in its own smart contracts and web apps. The program is live and was last updated on September 9, 2026.
Stacks bug bounty on Immunefi
Stacks pays up to $250,000 on Immunefi for critical bugs in its Bitcoin layer and smart contracts. The program was last updated September 8, 2026.
USDT0 bug bounty on Immunefi
USDT0 pays up to $6,000,000 on Immunefi for critical bugs that break USDT redemptions. The program was last updated September 1, 2026.
Hotcoin Web and Mobile bug bounty on HackenProof
Hotcoin pays up to $1,000 through HackenProof for security bugs in its website and its Android and iOS apps.
StackingDAO bug bounty on Immunefi
StackingDAO pays up to $100,000 on Immunefi for critical bugs in its Stacks smart contracts. No KYC and applications are open all year.
Robinhood Chain bug bounty on Cantina
Robinhood pays up to $1,000,000 on Cantina for bugs in Robinhood Chain contracts, wallet spending, and related web surfaces. Live as of September 8, 2026.
Venus Bug Bounty Program with BNB Chain
Venus and BNB Chain pay up to $100,000 for bugs in Venus contracts on BNB Chain. Reports go only through bugbounty.bnbchain.org.
Starknet bug bounty on Immunefi
StarkNet pays up to $250,000 on Immunefi for critical bugs in its layer 2 network and smart contracts. The program is open with no deadline.
Hinkal Bug Bounty on HackenProof
Hinkal pays $5,000 to $10,000 for critical bugs in its privacy smart contracts and zero knowledge circuits. The program on HackenProof is open and rolling.
SSV Network bug bounty on Immunefi
SSV Network pays up to $250,000 for critical smart contract bugs in its distributed validator network, through a rolling program on Immunefi.
Cosmos Bug Bounty Program on Immunefi
Cosmos Labs pays up to $50,000 for critical vulnerabilities in the Cosmos Stack through Immunefi. The program is open on a rolling basis.
Lombard Finance bug bounty on Immunefi
Lombard Finance pays up to $250,000 for critical smart contract bugs through its Immunefi bounty. Open year round, terms updated September 10, 2026.
Solana Mobile Bug Bounty Program
Solana Mobile pays up to $75,000 in SKR for critical vulnerabilities in Seed Vault, the SKR onchain programs and the Seeker Genesis Token backend. Reports are accepted on a rolling basis.
Questions
How many web3 bounties are open right now?
42 as of 5 October 2026. 1 closes in the next 7 days and 39 take applications on a rolling basis.
Which web3 bounties close soonest?
Rocket Pool Round 41 GMC bounties from Rocket Pool closes on 7 October 2026. Tari Ootle Security Bug Hunt from Tari Council closes on 31 October 2026. Folks Finance bug bounty on Immunefi from Folks Finance closes on 31 December 2026.
Can I apply from any country?
All of them accept applicants worldwide. Some still set conditions on age, residence or sanctions, and each entry lists them.
How is this list checked?
Every entry is written from the organizer's official page and links to it. Programs with a rolling deadline are checked again for closure, and an entry moves to the archive on the day it closes.