Enzyme Onyx bug bounty on Immunefi
Enzyme Onyx pays up to $200,000 in USDC for critical smart contract bugs, through Immunefi. Open on a rolling basis.
The Enzyme Onyx bug bounty on Immunefi pays security researchers for bugs in Onyx, a tokenization protocol from Enzyme Finance for asset management vehicles. It issues bespoke ERC20 shares and includes fees and tools for valuation accounting. Rewards are paid in USDC on Ethereum. The program has been live since 4 September 2025 and was last updated on 9 October 2026.
For critical smart contract bugs, the reward is 10 percent of the funds directly affected, up to USD 200,000. The minimum critical reward is USD 20,000. High severity pays from USD 5,000 to USD 20,000. Medium severity pays from USD 1,000 to USD 5,000.
Networks in scope are Ethereum, Arbitrum, Base, MegaETH, and Plume. Contracts may be labeled Live, meaning deployed and in use, or Latest audited, meaning audited but not yet deployed. A proof of concept is required at every severity. It must run on a fork of the live deployment or against deployed production code. Mocks, hypothetical cases, and incomplete snippets are rejected. KYC is not required.
Reports that only repeat issues already listed in the program scope are closed as spam. ChainSecurity completed an audit on 1 September 2025. Reports go through the Immunefi submission page.
Quick answers
Which networks are in scope?
Ethereum, Arbitrum, Base, MegaETH, and Plume. Contracts may be labeled Live or Latest audited.
What proof of concept is accepted?
It must run on a fork of the live deployment, or against deployed production code. Mocks, hypothetical cases, and incomplete snippets are rejected.