Paxos Labs bug bounty on Immunefi: up to $500,000
Paxos Labs pays up to $500,000 in USDG for smart contract bugs in Transit and PAXGy. The bounty went live on Immunefi on 20 October 2026.
The Paxos Labs bug bounty on Immunefi pays researchers for vulnerabilities in two protocols built by Paxos Labs. The program went live on 20 October 2026.
Transit is a stablecoin conversion protocol. It settles swaps between pegged tokens on the same chain or across chains, and a protocol signer sets the swap price when the order is submitted. PAXGy is tokenized gold. It takes in PAXG from users, lends the underlying gold to vetted institutional borrowers and passes the interest to holders through updates to its exchange rate.
Critical smart contract bugs pay 10% of the funds directly affected, from $10,000 up to $500,000. High severity bugs pay $5,000 to $10,000, and medium bugs pay a flat $1,000. Rewards are paid in USDG on Ethereum.
The scope covers 14 contract addresses listed on the program page. Every report needs a proof of concept that reproduces the impact against these contracts in a local or forked environment. KYC is required before payment.
Bugs that are already listed in the published audits or in the Transit and PAXGy known issues document are not eligible. Testing on mainnet or public testnets, testing with pricing oracles or third party contracts, phishing and denial of service attacks are not allowed. Paxos Labs runs the program under Primacy of Rules, so only the terms on the program page count.
Quick answers
How is a critical reward calculated?
It is 10% of the funds directly affected, with a minimum of $10,000 and a maximum of $500,000.
Can I test on mainnet?
No. All testing must be done on local forks of mainnet or a public testnet.