Gnosis Chain bug bounty on Immunefi: up to $2,000,000
Gnosis pays up to $2,000,000 on Immunefi for critical bugs in the bridges between Ethereum and Gnosis Chain. Rolling, updated October 2026.
Gnosis runs a bug bounty on Immunefi for the bridge smart contracts that move assets between Ethereum mainnet and Gnosis Chain. These are the xDai bridge and the OmniBridge, with four assets in scope.
Critical smart contract bugs pay $50,000 to $2,000,000. High severity bugs pay $10,000 to $50,000 and medium bugs $1,000 to $10,000. Critical and high rewards are capped at 10% of the economic damage. Rewards are paid in USDC or xDAI.
Security researchers report through the Immunefi page. Every report needs a proof of concept that shows an effect on an asset in scope. Testing must be done on local forks, not on mainnet or public testnets. Testing oracles or third party contracts, denial of service, phishing and social engineering are not allowed.
The program has been live since February 2022 and was last updated on 9 October 2026.
Quick answers
Is KYC needed for payout?
No. The program says no KYC information is required for payout processing.
How are rewards paid?
In USDC or xDAI.