ENS Bug Bounty
Report vulnerabilities affecting Ethereum Name Service smart contracts, name ownership, resolution, and its listed websites and applications.
Key Details
- Program launched: 2024-05-10.
- Reports are submitted through Immunefi.
Reward
Smart Contracts
- Critical: up to $250,000.
- High: $25,000–$100,000.
- Medium: $10,000.
- Low: $2,500.
Critical rewards are calculated as 10% of directly affected funds, subject to the following minimums:
- Above $1.5 million at risk: $150,000 minimum.
- $500,000–$1.5 million at risk: $75,000 minimum.
- Below $500,000, or losses that cannot be objectively calculated: $25,000 minimum.
If fewer than 50 assets or accounts are affected, the minimum may be reduced to $10,000.
Websites and Applications
- Critical: $25,000 for qualifying impacts; $10,000 for other Critical impacts.
- High: $5,000–$20,000.
- Medium: $2,500.
- Low: $1,000.
The $25,000 Critical tier covers fund loss without user action, unauthorized on-chain minting, or private-key leakage that gives access to funds.
Eligible Testnet Contracts
- Critical: up to $25,000.
- High: $25,000.
- Medium: $2,500.
- Low: from $1,000.
Payment and Adjustments
Payment is in USDC.
A conditional external-system failure may reduce the reward by up to 50%, with an explanation, unless ENS could mitigate the risk itself.
For upgradeable or pausable contracts, repeatable attacks are assessed within these mitigation windows:
- Security Council: 48 hours.
- DAO vote: two weeks.
Non-mitigable repeatable attacks may be assessed cumulatively, subject to the Critical reward cap.
Scope
- Two independent tracks cover smart contracts and web/app vulnerabilities. A report crossing both tracks is classified by its root cause. Targets include ENS contracts, the ENS app, landing page and metadata service, with their listed repositories.
- Mainnet eligibility requires the latest finalized release deployed on mainnet. A testnet contract must be at least as recent as the latest mainnet release and appear in a tagged release of an in-scope repository or in official ENS deployment documentation. V1 remains eligible during migration until explicitly removed.
- Assessment considers systemic, class-wide, conditional and narrow effects on names, plus applicable financial loss. Name ownership and resolution integrity matter even without direct theft. The scope page defines the accepted contract and web impacts, including name/NFT integrity, unauthorized transactions, data exposure and fund loss.
Out of Scope
- Unlisted DAO-funded or DAO-maintained products and archival broken-link takeovers are excluded; these exclusions override Primacy of Impact. ens.dev is excluded.
- Old or unrecognized testnet deployments and web/app staging or testnet deployments are excluded. Speculative future losses are not counted. Known issues, privileged-key attacks, social engineering, feature requests and unsupported theoretical web impacts remain subject to the listed exclusions.
Rules
- Only first disclosures qualify. ENS evaluates exploitability, affected systems, execution complexity, report quality and responsible novelty, subject to the applicable reward floors.
- KYC is generally unnecessary, but ENS can request identification when law, payment processing, sanctions compliance or risk review requires it. Publication requires approval.
- Use local forks for testing. Live-chain testing, third-party testing, social engineering, denial-of-service attacks and traffic-heavy automated testing are prohibited.
Submission Process
- Submit through the program’s Immunefi submission entry with a working PoC demonstrating an accepted impact. Check the latest asset list, release eligibility, audits and known issues before reporting.