Chainlink bug bounty on Immunefi: up to $3,000,000
Chainlink Labs pays up to $3,000,000 on Immunefi for critical bugs in Chainlink smart contracts, and up to $100,000 for critical web app bugs. Rolling.
The Chainlink bug bounty on Immunefi is run by Chainlink Labs. It covers Chainlink smart contracts and its websites and applications. The program has been live since 11 May 2021 and was last updated on 30 September 2026.
Critical smart contract bugs pay from $100,000 to $3,000,000, at the sole discretion of Chainlink Labs. Other smart contract bugs pay up to $75,000 for high, $10,000 for medium and $5,000 for low severity.
Bugs in websites and applications pay up to $100,000 for critical, $10,000 for high, $2,000 for medium and $1,000 for low severity.
The program covers deployments on many chains, including Ethereum, Arbitrum, Base, Optimism, Polygon, Solana and Aptos. Rewards are paid in USDC on Ethereum after KYC or KYB checks.
Every report needs a proof of concept. Submit reports through the Submit a Bug button on the Immunefi program page.
Quick answers
How are rewards paid?
In USDC on Ethereum.
Can I test on mainnet?
No. Testing on mainnet or public testnets is not allowed. Use local forks.
Is a proof of concept needed?
Yes, for every report. Smart contract reports must also suggest a fix.