Stacks bug bounty on Immunefi
Stacks pays up to $250,000 on Immunefi for critical bugs in its Bitcoin layer and smart contracts. The program was last updated September 8, 2026.
The Stacks bug bounty on Immunefi pays for bugs in the Stacks Bitcoin layer and its smart contracts. Immunefi shows the program as live since 31 March 2022 and last updated on 8 September 2026. The maximum bounty is $250,000.
Critical blockchain and smart contract reports pay a maximum of $250,000 and a minimum of $15,000. The critical reward is 10 percent of the funds directly affected, capped at that maximum. High reports pay $5,000 to $15,000. Medium reports pay $2,500 to $5,000. Low reports pay $1,000 to $2,500. Payouts are handled by the Stacks Endowment team, denominated in USD, and paid in STX.
The program focuses on theft of funds, permanent freezing of funds, network shutdown, chain split or deep fork vectors, invalid transactions confirming, consensus failures, and remotely exploitable weaknesses through standard Stacks RPC and P2P ports. KYC is required. Testing on mainnet or public testnets is forbidden. A proof of concept is required for every severity.
Submit reports on the Immunefi program page using the required template. The page lists acknowledgement targets of two weeks for critical and high reports and four weeks for medium and low reports.