ERC-4337 Account Abstraction bug bounty: up to $250,000
The Ethereum Foundation pays up to $250,000 for critical bugs in the ERC-4337 account abstraction contracts and protocol. The bounty runs on HackenProof.
The Account Abstraction bug bounty pays researchers for vulnerabilities in ERC-4337, the account abstraction standard for Ethereum. The company named on the HackenProof page is the Ethereum Foundation, and its bug bounty panel decides on rewards. The program started on 16 September 2024 and was last updated on 24 September 2026. It has no end date.
Critical findings pay $100,000 to $250,000. High findings pay $25,000 to $50,000, medium findings $5,000 to $10,000 and low findings $1,000 to $2,000. A critical bug is an EntryPoint bug that can cause major financial damage and may need a new EntryPoint, such as running a call in an account without passing validation or stealing deposits or stakes.
The scope is the core and utils folders of the eth-infinitism account-abstraction repository at releases v0.6.0 to v0.9.0, plus the ERC-4337 and ERC-7562 specifications. Implementation bugs, denial of service against the protocol and cheap ways to get staked entities banned are in scope. Only code on the listed release tags is eligible.
Reports go only through HackenProof, within 24 hours of finding the bug. You must be the first reporter, and a proof of concept is required. Bugs may not be discussed or disclosed outside the program, even after they are fixed, without consent from the team.
Quick answers
What is out of scope?
Network level denial of service and attacks on a specific bundler, account or paymaster. The bounty covers the contracts and the protocol definitions, not their implementations.
Is there a submission fee?
Yes. The program page shows a $7 submission fee, and a proof of concept is required.