SP1 bug bounty on Immunefi

The SP1 bug bounty on Immunefi pays security researchers for bugs in SP1, a RISC V zero knowledge virtual machine that proves the execution of Rust and other LLVM compiled programs. The maximum bounty is $100,000. Rewards are paid in USDC on Ethereum. The program has been live since 21 September 2026 and was last updated on 13 October 2026.

Critical blockchain bugs pay from $15,000 to $100,000. The reward is 10 percent of the funds directly affected, capped at $100,000, with a $15,000 minimum. High severity pays from $2,000 to $15,000. Medium severity pays from $1,000 to $2,000. Critical, high, and medium impacts use primacy of impact, so a bug can qualify by its effect even when the specific asset is not listed, within the limits on the program page.

A proof of concept is required at every severity. KYC is not required. Reports that only repeat issues already listed in the audits, security advisories, or known issues are not eligible. Testing must stay on local forks. Reports go through the Immunefi submission page.

Quick answers

Is KYC required for a payout?

No. The program page says KYC is not required for payout processing.

How is a critical reward calculated?

It is 10 percent of the funds directly affected, with a minimum of $15,000 and a cap of $100,000.

Where is testing allowed?

On local forks only. Testing on mainnet or a public testnet is not allowed.