Starknet Web and Smart Contracts bug bounty on HackenProof: up to $250,000
Starknet pays up to $250,000 for critical bugs in the StarkGate bridge contracts and website. The bounty runs on HackenProof with no end date.
The Starknet Web and Smart Contracts bug bounty pays researchers for vulnerabilities in StarkGate, the bridge between Ethereum and Starknet. Starknet is a validity rollup on Ethereum based on zk STARK proofs. The program started on HackenProof on 1 July 2026, was last updated on 17 October 2026 and has no end date.
Critical smart contract bugs pay $15,000 to $250,000. These include direct theft of user funds, permanent freezing of funds and protocol insolvency. On the website, a critical bug that lets an attacker run arbitrary system commands pays $5,000 to $10,000, and high severity content injection pays $1,250 to $2,500.
The scope is the Solidity and Cairo contracts in the StarkGate contracts repository on GitHub and the StarkGate website at starkgate.starknet.io. Third party apps, denial of service, social engineering and reports from automated scanners are out of scope.
You need a HackenProof account with at least 150 reputation points, KYC and a proof of concept. Each report costs a $5 fee. Only the first reporter of a bug is paid, and a bug must be reported within 24 hours of discovery. All contact goes through HackenProof, and no details may be shared outside the program.
Starknet runs two sibling programs on HackenProof as well: Starknet Blockchain/DLT, which also pays up to $250,000, and Starknet Staking, which pays up to $100,000.
Quick answers
Can I report the same bug on another platform too?
No. Sending the same report to several platforms at once gets the researcher's account blocked.
Are AI written reports accepted?
Only with a proof of concept that runs. AI generated reports without one are not accepted.