Bounties for developers
84 open bounties, each checked against the organizer's official page. 1 closes in the next 7 days and 77 take applications on a rolling basis.
A bounty pays for one defined result: a security bug found and reported, a feature built, an issue closed. Bug bounty programs on HackerOne, Immunefi, Sherlock and similar platforms pay by severity, and many run all year.
Gray Swan Arena: Indirect Prompt Injection Black challenge 2026
Gray Swan's Indirect Prompt Injection Black challenge pays from a $300,000 prize pool for successful attacks on AI agents. Wave 1 runs until 22 October 2026.
huntr Blind Trust AI hacking challenge 2026
huntr pays $15,000 in prizes to people who trick AI assistants into leaking secrets in its Blind Trust challenge. It ends October 30, 2026.
RP2350 Hacking Challenge 2
Raspberry Pi pays $20,000 to the first person who leaks AES key material from the RP2350 by side channel analysis. Entries close 31 October 2026.
Tari Ootle Security Bug Hunt
The Tari Council pays up to 1,000,000 XTM for security bugs in the pinned Ootle commit. The hunt ends at 00:00 UTC on 1 November 2026.
Revert v4lend competition on Cantina
Revert Finance offers a $50,000 USDC pool for bugs in v4lend, on Cantina. The competition ends 3 November 2026.
Rocket Pool Round 42 GMC bounties
Rocket Pool is taking Round 42 bounty proposals until 7 November 2026 at 23:59 UTC. Proposers set the reward they think the work is worth.
Folks Finance bug bounty on Immunefi
Folks Finance pays up to $200,000 in USDC for critical smart contract bugs, through Immunefi. The program expires on 31 December 2026.
Aero bug bounty on Sherlock: up to 500,000 USD
Dromos Labs pays up to 500,000 USD on Sherlock for critical bugs in Aero, its multichain liquidity protocol. Live since 21 October 2026.
Ethereum Bug Bounty Program 2026: up to $1,000,000, Glamsterdam in scope
The Ethereum Foundation pays up to $1,000,000 for critical bugs in Ethereum specs, clients and compilers. Glamsterdam is now in scope. No end date.
Paxos Labs bug bounty on Immunefi: up to $500,000
Paxos Labs pays up to $500,000 in USDG for smart contract bugs in Transit and PAXGy. The bounty went live on Immunefi on 20 October 2026.
1inch Aqua bug bounty on Immunefi: up to $100,000
1inch pays up to $100,000 in USDC for bugs in Aqua, its new protocol for custom liquidity positions, and in the Swap VM contracts. The bounty runs on Immunefi.
Starknet Web and Smart Contracts bug bounty on HackenProof: up to $250,000
Starknet pays up to $250,000 for critical bugs in the StarkGate bridge contracts and website. The bounty runs on HackenProof with no end date.
tinygrad bounties for open source GPU and compiler work
tinygrad pays cash bounties of $200 to $2,000 for merged work on its open source deep learning framework, from GPU emulators to new backends.
Kamino bug bounty on Sherlock: up to 1,000,000 USDC
Kamino pays up to 1,000,000 USDC on Sherlock for bugs in its Solana lending, liquidity and vault programs. Live since 16 October 2026.
OpenAI Safety Bug Bounty on Bugcrowd
OpenAI pays $250 to $7,500 per accepted report for safety and abuse flaws in its agentic products and platform. Public on Bugcrowd, open all year.
Apple Security Bounty: rewards up to $2 million for Apple platform flaws
Apple pays up to $2 million, and over $5 million with bonuses, for proven security flaws in iPhone, Mac, iCloud and other Apple platforms. Reports are accepted at any time.
ERC-4337 Account Abstraction bug bounty: up to $250,000
The Ethereum Foundation pays up to $250,000 for critical bugs in the ERC-4337 account abstraction contracts and protocol. The bounty runs on HackenProof.
Google Patch Rewards Program for open source security fixes
Google pays $100 to $15,000 for patches that improve security in open source projects such as those in OSS-Fuzz. Rolling, no deadline.
Inverse Finance bug bounty on Sherlock
Inverse Finance pays up to 100,000 USD in DOLA on Sherlock for critical bugs in its FiRM lending and DOLA contracts. Live since 12 October 2026.
IOTA bug bounty on Sherlock
IOTA pays up to 25,000 USDC on Sherlock for critical bugs in its core network. Live since 14 October 2026.
Rujira bug bounty on Sherlock
Rujira pays up to 25,000 USDC on Sherlock for critical bugs in its THORChain app layer contracts. Live since 29 September 2026.
Android and Google Devices Security Reward Program
Google pays up to $1,500,000 for exploit chains against Pixel, Nest and Fitbit devices, and up to $25,000 for strong single bugs. Rolling, no deadline.
SP1 bug bounty on Immunefi
SP1 pays up to $100,000 in USDC for critical bugs in its zero knowledge virtual machine. Open on Immunefi.
Chainlink bug bounty on Immunefi: up to $3,000,000
Chainlink Labs pays up to $3,000,000 on Immunefi for critical bugs in Chainlink smart contracts, and up to $100,000 for critical web app bugs. Rolling.
Compound Finance bug bounty on Immunefi
Compound Finance pays up to $1,000,000 for critical smart contract bugs, through Immunefi. Rewards are paid in COMP.
deBridge bug bounty on Immunefi
deBridge pays a flat $200,000 for critical smart contract bugs, through Immunefi. Open on a rolling basis.
Enzyme Onyx bug bounty on Immunefi
Enzyme Onyx pays up to $200,000 in USDC for critical smart contract bugs, through Immunefi. Open on a rolling basis.
Gnosis Chain bug bounty on Immunefi: up to $2,000,000
Gnosis pays up to $2,000,000 on Immunefi for critical bugs in the bridges between Ethereum and Gnosis Chain. Rolling, updated October 2026.
Stargate bug bounty on Immunefi: up to $10,000,000
Stargate pays up to $10,000,000 on Immunefi for critical bugs in its cross chain bridge contracts. Rolling, live since September 2024.
LayerZero bug bounty on Immunefi: up to $15,000,000
LayerZero pays up to $15,000,000 on Immunefi for critical bugs in its cross chain smart contracts. Live since May 2023, updated October 2026.
Midas bug bounty on Sherlock: up to 500,000 USDC
Midas pays up to 500,000 USDC on Sherlock for bugs in its Ethereum and Solana contracts and web app. Live since August 21, 2026, with no end date.
OnRe bug bounty on Immunefi: up to $100,000
OnRe pays up to $100,000 in USDC on Immunefi for critical bugs in its Solana program. Live since May 2026 with no end date.
Google Open Source Software Vulnerability Reward Program
Google pays up to $31,337 for supply chain compromises in its open source projects. Product vulnerability reports are paused since October 1, 2026.
Silo Finance bug bounty on Immunefi
Silo Finance pays up to $100,000 in USDC for critical smart contract bugs, through Immunefi. Open on a rolling basis.
Twyne bug bounty on Immunefi
Twyne pays up to $50,000 in USDC for critical smart contract bugs, through Immunefi. Open on a rolling basis.
Exactly bug bounty on Immunefi
Exactly pays up to $25,000 in USDC for critical smart contract bugs, through Immunefi. Open on a rolling basis.
Horizen bug bounty on Immunefi
Horizen pays up to $10,000 in USDC for bugs in its ZEN staking contracts and staking web app, through Immunefi. Open on a rolling basis.
XOXNO bug bounty on Immunefi
XOXNO pays up to $20,000 in USDC for critical bugs in its Stellar lending contracts, through Immunefi. Open on a rolling basis.
GMTrade bug bounty on Immunefi
GMTrade pays up to $100,000 in USDC for critical bugs in its Solana smart contracts, through Immunefi. Open on a rolling basis.
Intuition bug bounty on Immunefi
Intuition pays up to $100,000 in USDC for critical bugs in its knowledge graph smart contracts, through Immunefi. Open on a rolling basis.
Golem Network bug bounty on Sherlock: up to 10,000 USDC
Golem Network pays up to 10,000 USDC on Sherlock for bugs in three public repositories. The program has been live since 1 October 2026.
Omarchy bug bounty on HackerOne: up to $1,500
Omarchy pays up to $1,500 on HackerOne for bugs in its Linux distribution repository. The public program launched on 1 October 2026.
Proximity Prize: Ethereum Foundation research rewards for SNARK soundness proofs
The Ethereum Foundation Proximity Prize rewards solvers who raise machine checked security bounds for hash based SNARKs. Proofs are checked in Lean.
DAWN USD.infra Vault bug bounty
DAWN pays up to $50,000 in USDC for bugs in the USD.infra vault on Immunefi. Live since 12 July 2026.
sBTC bug bounty on Immunefi
The sBTC bug bounty on Immunefi pays up to $250,000 for bugs in the bridge. Live since 2 July 2026.
Tenstorrent Bounty Program for open source contributors
Tenstorrent pays bounties for merged pull requests on GitHub issues tagged bounty. Tiers run from $1 to $3,000, and one open issue lists $35,000.
Cronos Ult app bug bounty on HackenProof: up to $20,000
Cronos pays up to $20,000 in USDC or USDT through HackenProof for security bugs in the Ult trading app and its backend API.
1inch Smart Contracts bug bounty on Immunefi
1inch pays up to $500,000 in USDC on Immunefi for bugs in its swap and limit order smart contracts. Live since June 11, 2026, rolling.
Adobe bug bounty program on Intigriti
Adobe moved its bug bounty to Intigriti on 1 September 2026. Rewards go up to $15,000, with a bonus tier for Adobe AI features.
Live Nation bug bounty on HackerOne: up to $10,000
Live Nation pays up to $10,000 for security bugs in its Ticketmaster sites and apps. The HackerOne program opened on 24 September 2026.
Puffer bug bounty on Sherlock: up to 100,000 USDC
Puffer pays up to 100,000 USDC for bugs in its Ethereum contracts. The Sherlock program has been live since 17 August 2026.
Tenbin Bug Bounty on Cantina
Tenbin pays up to $40,000 for critical bugs in its asset token contracts, from a $100,000 budget on Cantina. Live since 11 September 2026.
Alchemix bug bounty on Immunefi: up to $150,000
Alchemix pays up to $150,000 in USDC for a critical smart contract bug through Immunefi. The program has no closing date.
German EUDI Wallet bug bounty on HackerOne: up to $40,000
Common Codes pays up to $40,000 for security bugs in the d-you app and backend of Germany's EUDI Wallet. The HackerOne program opened September 16, 2026.
Vercel public bug bounty
Vercel pays up to $10,000 for critical reports in its public bug bounty, including open source projects. No deadline.
Cap bug bounty on Sherlock: up to 1,000,000 USDC
Cap runs a bug bounty on Sherlock for its core Ethereum contracts. Critical bugs pay up to 1,000,000 USDC. The program is live with no end date.
Arc bug bounty on HackerOne: up to $200,000
Circle pays up to $200,000 for critical bugs in the Arc network through a public HackerOne program that launched on September 16, 2026.
Kiteworks public bug bounty on YesWeHack
Kiteworks pays up to $50,000 for a critical bug in its content platform. Reports go through YesWeHack at any time.
Aave V4 bug bounty on Sherlock: up to 2,500,000 USD
Aave DAO pays up to 2,500,000 USD for critical bugs in Aave V4 through Sherlock. The programme is live and takes reports at any time.
Babylon bug bounty on Sherlock: up to 500,000 USDC
Babylon Labs pays up to 500,000 USDC for critical bugs in its Bitcoin staking protocol through Sherlock. The programme went live on September 21, 2026.
NUVA bug bounty on Immunefi
NUVA pays up to $40,000 on Immunefi for smart contract and web bugs. The program went live on May 18, 2026 and was last updated on September 18, 2026.
Paradex bug bounty on Sherlock: up to 500,000 USDC
Paradex runs a bug bounty on Sherlock with a maximum reward of 500,000 USDC. The programme is live and takes reports at any time.
Tenor Labs bug bounty on Sherlock: up to 200,000 USDC
Tenor Labs runs a bug bounty on Sherlock with a maximum reward of 200,000 USDC. The programme went live on September 11, 2026 and takes reports at any time.
Extra Finance bug bounty on Immunefi
Extra Finance pays up to $100,000 for a critical smart contract bug on Immunefi. The program has no closing date and was last updated on 16 September 2026.
ENS bug bounty on Immunefi: up to $250,000
ENS pays security researchers up to $250,000 for critical smart contract bugs. The bounty runs on Immunefi with no closing date.
Ethena bug bounty on Immunefi: up to $3,000,000
Ethena pays up to $3,000,000 for a critical smart contract bug. The bounty runs on Immunefi and has no closing date.
Hedera bug bounty on Immunefi
Hedera pays up to $30,000 on Immunefi for bugs in its public network and services. The program was last updated 31 August 2026.
The Graph bug bounty on Immunefi
The Graph Foundation pays up to $50,000 on Immunefi for bugs in its indexing protocol. The program was last updated 27 August 2026.
Immunefi bug bounty program
Immunefi pays up to $50,000 for security bugs in its own smart contracts and web apps. The program is live and was last updated on September 9, 2026.
Stacks bug bounty on Immunefi
Stacks pays up to $250,000 on Immunefi for critical bugs in its Bitcoin layer and smart contracts. The program was last updated September 8, 2026.
USDT0 bug bounty on Immunefi
USDT0 pays up to $6,000,000 on Immunefi for critical bugs that break USDT redemptions. The program was last updated September 1, 2026.
Hotcoin Web and Mobile bug bounty on HackenProof
Hotcoin pays up to $1,000 through HackenProof for security bugs in its website and its Android and iOS apps.
StackingDAO bug bounty on Immunefi
StackingDAO pays up to $100,000 on Immunefi for critical bugs in its Stacks smart contracts. No KYC and applications are open all year.
Robinhood Chain bug bounty on Cantina
Robinhood pays up to $1,000,000 on Cantina for bugs in Robinhood Chain contracts, wallet spending, and related web surfaces. Live as of September 8, 2026.
Venus Bug Bounty Program with BNB Chain
Venus and BNB Chain pay up to $100,000 for bugs in Venus contracts on BNB Chain. Reports go only through bugbounty.bnbchain.org.
Starknet bug bounty on Immunefi
StarkNet pays up to $250,000 on Immunefi for critical bugs in its layer 2 network and smart contracts. The program is open with no deadline.
Hinkal Bug Bounty on HackenProof
Hinkal pays $5,000 to $10,000 for critical bugs in its privacy smart contracts and zero knowledge circuits. The program on HackenProof is open and rolling.
SSV Network bug bounty on Immunefi
SSV Network pays up to $250,000 for critical smart contract bugs in its distributed validator network, through a rolling program on Immunefi.
Cosmos Bug Bounty Program on Immunefi
Cosmos Labs pays up to $50,000 for critical vulnerabilities in the Cosmos Stack through Immunefi. The program is open on a rolling basis.
Lombard Finance bug bounty on Immunefi
Lombard Finance pays up to $250,000 for critical smart contract bugs through its Immunefi bounty. Open year round, terms updated September 10, 2026.
Solana Mobile Bug Bounty Program
Solana Mobile pays up to $75,000 in SKR for critical vulnerabilities in Seed Vault, the SKR onchain programs and the Seeker Genesis Token backend. Reports are accepted on a rolling basis.
Google AI Vulnerability Reward Program
Rolling bug bounty from Google for security flaws in its AI products, with one set of rules and reward tables. Content safety issues are out of scope.
GitHub Bug Bounty Program
GitHub pays $250 to $10,000 per valid report in its public bug bounty and $30,000 or more for critical findings in the invite only VIP tier. Open year round on HackerOne.
Microsoft Open Source Bounty Program
Microsoft pays $750 to $15,000 USD for qualifying security vulnerabilities in open source projects such as Visual Studio Code, TypeScript, PowerShell 7 and the Azure SDKs. Submissions are accepted on a rolling basis.