deBridge bug bounty on Immunefi
deBridge pays a flat $200,000 for critical smart contract bugs, through Immunefi. Open on a rolling basis.
The deBridge bug bounty on Immunefi pays security researchers for bugs in deBridge smart contracts. deBridge is a cross chain protocol for moving data and assets between blockchains, including swaps and bridging. The program has been live since 21 January 2022 and was last updated on 7 October 2026.
Critical smart contract bugs pay a flat USD 200,000. deBridge treats a bug as critical when it can cause a loss of more than 5 percent of total value locked, or an unauthorized mint of deAssets that breaks the peg by more than 5 percent. High severity pays a flat USD 40,000, for losses of up to 5 percent of total value locked or a peg break of up to 5 percent. Medium severity pays a flat USD 5,000.
Rewards are denominated in US dollars and paid in USDC or USDT on Avalanche or Arbitrum. The team chooses the mix. KYC is not required. A proof of concept is required at every severity. Testing must stay on a local fork.
The program focuses on loss or theft of locked user funds, loss of governance funds, theft or permanent freezing of unclaimed assets, a contract that fails to deliver promised returns, and unauthorized minting that breaks a peg. Default bridging does not cover rebase assets, assets with an elastic supply, or tokens that charge a fee on transfer. Reports go through the Immunefi submission page.
Quick answers
What counts as a critical bug?
A loss of more than 5 percent of total value locked, or an unauthorized mint of deAssets that breaks the peg by more than 5 percent.
Which assets are out of scope?
Default bridging does not cover rebase assets, assets with an elastic supply, or tokens that charge a fee on transfer.