IMMUNEFI BUG BOUNTY

Last updated: June 19, 2025, 18:42 | Written by: Michael Saylor

In the rapidly evolving landscape of Web3, security vulnerabilities pose a significant threat to projects and users alike.Imagine a world where malicious actors could exploit flaws in smart contracts or blockchain infrastructure, leading to massive financial losses and erosion of trust. Instead, check if those other projects have a bug bounty program on Immunefi. If the project has any testnet and/or mock files, those will not be covered under Primacy of Impact.This is the reality that the Web3 community faces, and it necessitates a proactive approach to security. See full list on immunefisupport.zendesk.comEnter the Immunefi bug bounty program, a revolutionary platform that connects blockchain projects with ethical hackers to identify and resolve vulnerabilities before they can be exploited. Secure your project, sleep well at night, and show you take security seriously. Launch your bug bounty program with Immunefi.Immunefi stands as the leading bug bounty platform for Web3, actively safeguarding over $60 billion in assets and preventing an estimated $25 billion in potential damages. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default statesThis article delves into the intricacies of Immunefi, exploring how it works, its benefits, and how you can leverage it to secure your project or become a successful bug bounty hunter in the decentralized web.

What is Immunefi and How Does it Work?

Immunefi operates as a crucial bridge between Web3 projects and a community of over 45,000 skilled on-chain security researchers (whitehat hackers). The Moonbeam Foundation requires KYC to be done for all bug bounty hunters submitting a report and wanting a reward. The information needed is an ID scan along with a selfie to verify identity. Payouts are handled by the Moonbeam Foundation team directly and are denominated in USD.It provides a structured forum where ethical hackers can responsibly disclose vulnerabilities in exchange for rewards, commonly known as bounties.This approach allows projects to proactively identify and fix security flaws before they can be exploited by malicious actors, thus mitigating potential risks and protecting user funds.

The platform facilitates the entire bug bounty process, from initial vulnerability reporting to final bounty payment. The payout for critical and high severity bugs is calculated as the minimum of 10% of economic damage from the exploit and the maximum payout for the exploit s severity level; however there is a minimum reward of USD 5 000 for valid critical bug reports, and a minimum reward of USD 1 000 for valid high severity bug reports.Projects can leverage Immunefi's expertise to design and implement effective bug bounty programs tailored to their specific needs. Although many Bug Bounty programs have standard terms and conditions, each also has their own unique details that are critical to your success. Prior to submitting a report please review the Immunefi Bug Report Template and Best Practices.This includes defining the scope of the program, setting severity levels for vulnerabilities, and establishing appropriate reward tiers.Immunefi's proven program-drafting expertise, built over the experience of launching 400 programs, ensures projects create the most effective vulnerability disclosure plans based on their unique needs.

Key Features and Benefits of Using Immunefi

Access to a Large Pool of Talent: Immunefi boasts the largest community of Web3 security researchers, providing projects with access to a diverse range of skills and expertise.
Proven Track Record: Immunefi has prevented billions of dollars in potential damages and paid out over $100 million in bounty rewards, demonstrating its effectiveness in securing Web3 projects.
Customizable Programs: Immunefi allows projects to tailor their bug bounty programs to their specific needs, including defining scope, severity levels, and reward structures.
Efficient Vulnerability Reporting: The platform provides a streamlined process for submitting and managing bug reports, ensuring efficient communication and resolution.
Mediation and Dispute Resolution: Immunefi offers mediation services to resolve disputes between projects and hackers, ensuring fair and transparent outcomes. By launching an Aave bug bounty program with Immunefi, we ensure we have the most efficient infrastructure with a successful track record to help us make our code more secure.For example, if a security researcher and a project disagree on the appropriate bounty amount within a specific impact range, Immunefi will mediate to determine the payout.
Comprehensive Security Solutions: Beyond bug bounties, Immunefi offers on-chain monitoring, threat detection, and on-chain firewalls, providing a comprehensive suite of security solutions for Web3 projects.
Protection of Funds: Immunefi actively protects $60 billion of funds, securing valuable assets for projects and users.
Legendary Response Times and Top-Notch Support: Immunefi prides itself on providing quick responses and excellent support to its hackers, ensuring smooth communications.

How to Launch Your Bug Bounty Program on Immunefi

Launching a bug bounty program on Immunefi is a straightforward process that can significantly enhance the security posture of your Web3 project. Whitehat Leaderboard. The whitehat score is a measure of a whitehat's effectiveness relative to other whitehats. It takes into account 1) the number and severity of paid reports and, 2) earnings received by all whitehats.Here's a step-by-step guide:

Define Your Program Scope: Clearly define the assets and systems that are within the scope of your bug bounty program. Instead, check if those other projects have a bug bounty program on Immunefi. All other severity levels not listed here are considered under the Primacy of Rules, which means that they are bound by the terms of the bug bounty program. Immunefi Standard BadgeThis could include smart contracts, blockchain infrastructure, websites, and applications.
Determine Severity Levels: Establish a clear classification system for vulnerability severity, based on the potential impact of an exploit. We began with Bug Bounty Programs, enabling security researchers to responsibly disclose onchain vulnerabilities before they could be exploited. This approach proved critical, and Immunefi became the market leader for onchain BBPs, preventing billions in hacks, and paying out some of the largest bounties in the history of web3.Immunefi provides a standardized Vulnerability Severity Classification System V2.2, which projects can use as a starting point.
Set Bounty Rewards: Determine the bounty rewards for each severity level, considering the potential economic damage and the value of the assets at risk. Bug reports covering previously-discovered bugs are not eligible for any reward through the bug bounty program. If a bug report covers a known issue, it may be rejected together with proof of the issue being known before escalation of the bug report via Immunefi. Previous audits and known issues can be found at:Immunefi has facilitated some of the world's largest bug bounty payouts, including $10 million, $6 million, and $2.2 million, reflecting the high value of securing Web3 assets.
Draft Program Rules: Clearly outline the rules and guidelines for your bug bounty program, including eligibility criteria, reporting requirements, and dispute resolution mechanisms.Adhering to the ""Primacy of Rules"" ensures fair and transparent operation.
Launch Your Program: Submit your program details to Immunefi, and their team will assist you in launching your bug bounty program on the platform.
Manage Submissions and Payouts: Regularly review bug reports submitted through the Immunefi platform and coordinate with your team to assess and fix verified vulnerabilities.Process the bounty payouts according to the agreed-upon terms.

Becoming a Successful Bug Bounty Hunter on Immunefi

If you're a security researcher looking to make a positive impact and earn rewards, Immunefi provides an excellent platform for participating in bug bounty programs.Here are some tips for becoming a successful bug bounty hunter:

Develop Your Skills: Continuously improve your knowledge and skills in Web3 security, including smart contract auditing, blockchain security, and cryptography.
Familiarize Yourself with the Platform: Learn how to navigate the Immunefi platform, submit bug reports, and communicate with project teams.The Immunefi Standard Badge can help you learn the ropes.
Understand Program Rules: Carefully review the rules and scope of each bug bounty program before submitting a report. A new comprehensive bug bounty program is now live on Flare, powered by Immunefi, web3 s largest bug bounty platform. To date, Immunefi actively protects $60 billion of funds, has prevented $25 billion in potential damages from hacks, and has paid $100 million in bounty rewards.Pay attention to the defined severity levels and reward structures.
Write Clear and Concise Reports: When submitting a bug report, provide a clear and concise description of the vulnerability, its potential impact, and steps to reproduce the issue.Following the Immunefi Bug Report Template and Best Practices is highly recommended.
Provide Proof of Concept (PoC): Include a Proof of Concept (PoC) that demonstrates the exploitability of the vulnerability.Ensure that your PoC complies with Immunefi's PoC Guidelines and Rules.
Respect Disclosure Policies: Adhere to responsible disclosure policies and avoid publicly disclosing vulnerabilities before they have been fixed by the project team.
Strive to Improve Your Whitehat Score: Earn more, submit high-impact reports and be among the best.

Common Mistakes to Avoid in Immunefi Bug Bounty Programs

Both projects and bug bounty hunters can make mistakes that hinder the effectiveness of bug bounty programs.Here are some common pitfalls to avoid:

For Projects:

Poorly Defined Scope: Failing to clearly define the scope of the program can lead to confusion and disputes over eligibility for rewards.
Unrealistic Reward Structures: Setting low bounty rewards can discourage talented security researchers from participating in your program.
Slow Response Times: Delaying responses to bug reports can frustrate researchers and potentially delay critical security fixes. Immunefi is the leading bug bounty platform for web3 with the world s largest bug bounties. We offer legendary response times and top-notch support for our hackers. We re able to offer the world s largest bounties because the web3 assets we protect blockchains, NFT projects, smart contracts are the world s most valuable assets.Immunefi offers legendary response times, which projects should aim to emulate.
Ignoring Valid Vulnerabilities: Dismissing valid vulnerabilities without proper investigation can expose your project to significant risks.

For Bug Bounty Hunters:

Reporting Out-of-Scope Issues: Submitting reports for issues that are not within the defined scope of the program wastes time and effort. Learn to become a bug bounty hunter on Immunefi, from Web3 security introductions to how Immunefi s platform works. This section will take you from a complete beginner to a Web3 bug bounty hunter, making you ready to hunt for your first bounty.Always check if other programs of the project are a better fit.
Failing to Provide Sufficient Information: Submitting incomplete or unclear bug reports can make it difficult for project teams to understand and reproduce the vulnerability.
Duplicate Reports: Checking previous reports before submitting to avoid duplicates is essential.Reports covering previously-discovered bugs are not eligible for rewards.
Violating Disclosure Policies: Publicly disclosing vulnerabilities before they have been fixed can harm the project and potentially expose users to risk.

Understanding Immunefi's Primacy of Rules and Impact

Immunefi emphasizes two important concepts in its bug bounty programs: the Primacy of Rules and the Primacy of Impact.Understanding these principles is crucial for both projects and bug bounty hunters.

Primacy of Rules

The Primacy of Rules dictates that the terms and conditions outlined in the bug bounty program documentation are binding. Bug bounty and Safe Harbor programs Onchain monitoring and threat detection Onchain firewalls. And more to come.All severity levels and payouts must follow this guide. Instead, check if those other projects have a bug bounty program on Immunefi. All other severity levels not listed here are considered under the Primacy of Rules, which means that they are bound by the terms of the bug bounty program.This means that all aspects of the bug bounty program are strictly governed by the terms and conditions defined on the specific program page.Both projects and hunters must adhere to these rules to ensure fairness and transparency.

Primacy of Impact

The Primacy of Impact refers to the potential consequences of a vulnerability if exploited.When submitting a report, researchers must select the ""Primacy of Impact"" asset placeholder. Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2.This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.While there may be instances where the team has programs on multiple assets, the Primacy of Impact only pertains to the asset in the particular bounty and does not cover any other programs the team might have. When submitting a report on Immunefi s dashboard, the security researcher should select the Primacy of Impact asset placeholder. If the team behind this project has multiple programs, those other programs are not covered under Primacy of Impact for this program. Instead, check if those other projects have a bug bounty program on Immunefi.Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2.Mitigating factors should not be used to downgrade a bug's severity, but it's important to adhere to feasibility limitation standards outlined by Immunefi.

Case Studies: Real-World Examples of Immunefi's Impact

Immunefi has been instrumental in preventing numerous high-profile hacks and protecting billions of dollars in assets.Here are a few notable examples:

Preventing a Major Exploit on Aave: Aave, a leading DeFi protocol, launched a bug bounty program with Immunefi to enhance the security of its code. Review and prevent vulnerabilities in the decentralised web. Check our latest web 3.0 bug bounties and start hunting bugs while getting rewarded.This allowed them to review and prevent vulnerabilities.
Securing The Graph Ecosystem: The Graph Foundation utilizes Immunefi to manage a bug bounty program focused on preventing negative impacts to the entire ecosystem, such as loss of user funds from protocol smart contracts.
Vaults System Beta Release Security: Immunefi is interested in securing their beta release Vaults System and website to strengthen overall platform security.

These case studies demonstrate the effectiveness of Immunefi in identifying and resolving critical vulnerabilities before they can be exploited by malicious actors.

Frequently Asked Questions About Immunefi Bug Bounties

What types of vulnerabilities are eligible for a bounty?

The types of vulnerabilities eligible for a bounty depend on the specific bug bounty program. The bug bounty program, managed and funded by The Graph Foundation, is focused on the prevention of negative impacts to the whole ecosystem, such as: Loss of user funds from the protocol smart contractsHowever, common examples include:

Smart contract vulnerabilities (e.g., reentrancy attacks, integer overflows)
Blockchain infrastructure vulnerabilities (e.g., consensus bugs, network vulnerabilities)
Website and application vulnerabilities (e.g., cross-site scripting, SQL injection)

How are bounty rewards determined?

Bounty rewards are typically determined based on the severity of the vulnerability and the potential impact of an exploit.Immunefi uses a standardized Vulnerability Severity Classification System V2.2 to classify vulnerabilities and determine appropriate reward tiers.Often the payout for critical and high severity bugs is calculated as the minimum of 10% of economic damage from the exploit and the maximum payout for the exploit s severity level.Minimum reward thresholds also apply.

What if I disagree with the project's assessment of my bug report?

If you disagree with the project's assessment of your bug report, you can request mediation from Immunefi. Immunefi hosts bug bounties for blockchain projects across all chains and networks by providing a forum bringing builders and hackers together, enabling hackers to report bugs privately and responsibly for projects to fix vulnerabilities securely.Immunefi will review the report and make a final determination on the validity of the vulnerability and the appropriate bounty reward. Since Optimism uses a fork of Geth, issues which are responsibly disclosed to upstream cannot be replayed against Optimism s bug bounty program if the vulnerability has already been made public. If the vulnerability is disclosed to Optimism at the same time as upstream Geth, the vulnerability is eligible for the bug bounty program.Immunefi's decision is final and non-appealable.

Is KYC required to participate in Immunefi bug bounty programs?

KYC (Know Your Customer) requirements vary depending on the specific bug bounty program and the project involved.Some projects, like Moonbeam Foundation, require KYC for all bug bounty hunters submitting a report and wanting a reward.

The Future of Web3 Security with Immunefi

Immunefi is at the forefront of securing the Web3 ecosystem. The vulnerability, shared with Immunefi, was intended to secure a bounty payment for the identification of a high-risk bug. Immunefi, which mediates between ethical hackers and blockchain projects, concluded that the reported bug fell out of scope, rendering it ineligible for a full bounty.As the Web3 space continues to evolve and mature, the importance of bug bounty programs and ethical hacking will only increase.With its comprehensive platform, experienced team, and vast community of security researchers, Immunefi is well-positioned to play a leading role in shaping the future of Web3 security.By connecting builders and hackers together in a forum that enables hackers to report bugs privately and responsibly, projects can fix vulnerabilities in a secure environment.

Conclusion

The Immunefi bug bounty program represents a paradigm shift in Web3 security. If the submitting party disputes the PCM s determination what the appropriate bounty/reward should be within a specific Impact range, Immunefi will mediate, and shall determine, in its sole and absolute discretion, which is non-appealable, the amount of such bug bounty/reward in the relevant Impact category; however, Immunefi may not modifyBy incentivizing ethical hackers to identify and report vulnerabilities, Immunefi empowers projects to proactively mitigate risks and protect user funds. All non-critical rewards for the project bug bounty program are scaled based on an internally established team criteria, taking into account the exploitability of the bug, the impact it causes, and the likelihood of the vulnerability presenting itself, which is especially factored in with bug reports requiring multiple conditions to be met thatWhether you're a Web3 project looking to enhance your security posture or a security researcher seeking to make a positive impact, Immunefi offers a valuable platform for collaboration and innovation.Secure your project, sleep well at night, and show you take security seriously - launch your bug bounty program with Immunefi today. Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program. Considering MCD_ETH - The asset steward is aware that the balance of the contract may be different than the total amount that is deposited if users send ETH directly to the contract.As the Web3 landscape continues to evolve, Immunefi remains a crucial ally in safeguarding the decentralized future.Consider exploring their comprehensive suite of security solutions, including on-chain monitoring and threat detection, to holistically protect your project.