Ethereum Bug Bounty Program 2026: up to $1,000,000, Glamsterdam in scope

The Ethereum Bug Bounty Program is run by the Ethereum Foundation. It pays for bugs in the Ethereum protocol, its clients and its smart contract compilers. The page says it is open for submissions and has no end date.

Rewards go up to 2,000 USD for low, 10,000 USD for medium, 50,000 USD for high and 1,000,000 USD for critical findings. Each level also gives leaderboard points. Rewards are paid in ETH or DAI, usually a few days after a report is validated.

The scope covers the consensus and execution layer specifications, the execution clients Besu, Erigon, Geth, Nethermind and Reth, and the consensus clients Grandine, Lighthouse, Lodestar, Nimbus, Prysm and Teku. The Solidity and Vyper compilers, the Beacon Chain deposit contract and two KZG libraries are also in scope. Web infrastructure, ERC20 contracts and ENS are out of scope.

The Glamsterdam upgrade is in scope with reward multipliers that depend on when you submit. Reports sent after the Sepolia upgrade and before the Hoodi upgrade get a 2.0 times multiplier. Reports sent from the Hoodi upgrade until one week before mainnet get 1.5 times. The Ethereum Foundation blog sets the Hoodi upgrade for October 26, 2026. Upgrade dates can change.

Every report needs a proof of concept. Duplicates, known issues and bugs already covered by an open issue or pull request do not qualify. Submit through the bug report form linked on the program page.

Quick answers

Is it a competition?

No. The page says it is not a competition. A panel at the Ethereum Foundation decides awards at its own discretion.

Can I report anonymously?

Yes, but anonymous or pseudonymous reports cannot receive ETH or DAI rewards. To be paid you must send your real name and ID.

Can I test on mainnet?

No. Testing must happen on local testnets.