NUVA bug bounty on Immunefi
NUVA pays up to $40,000 on Immunefi for smart contract and web bugs. The program went live on May 18, 2026 and was last updated on September 18, 2026.
NUVA runs a live bug bounty on Immunefi for its marketplace of tokenized real world assets. The program has been live since May 18, 2026 and was last updated on September 18, 2026. Maximum pay is $40,000. Rewards are denominated in USD and paid in USDC on Ethereum.
Critical smart contract findings pay 10 percent of funds at risk, with a minimum of $10,000 and a maximum of $40,000. High, medium and low smart contract findings pay less, down to a flat $1,000 for low. Critical website and application findings can pay up to $20,000 when they lead to a loss of funds without user action, or to leaked keys.
A proof of concept is required at every severity. Payouts need KYC. Known issues from the listed Sherlock and Halborn audits are out of scope. Testing on mainnet or public testnet is not allowed.
Submit reports through the NUVA program page on Immunefi.