Immunefi bug bounty program
Immunefi pays up to $50,000 for security bugs in its own smart contracts and web apps. The program is live and was last updated on September 9, 2026.
Immunefi runs a bug bounty on its own products, next to the protocol programs it hosts for other teams. The highest reward is $50,000. The program page shows it live since December 2, 2020 and last updated on September 9, 2026.
Smart contract reports pay $10,000 to $50,000 for critical severity, $5,000 to $10,000 for high, a flat $5,000 for medium and a flat $1,000 for low. Web and app reports pay $5,000 to $10,000 for critical, $2,000 to $5,000 for high, a flat $2,000 for medium and a flat $1,000 for low.
Seven assets are in scope. Rewards are paid in USDC on Ethereum.
A proof of concept is always required, whatever the severity. KYC is needed before Immunefi pays out. Reports go through the Immunefi submission dashboard.