Immunefi Bug Bounty

Report vulnerabilities in Immunefi’s own Vaults System, listed websites and application assets.

Key Details

Smart contracts: Critical $10,000–$50,000; High $5,000–$10,000; Medium $5,000; Low $1,000. Critical uses 10% of affected funds.
Web/app: Critical $5,000–$10,000; High $2,000–$5,000; Medium $2,000; Low $1,000. The $10,000 Critical award requires the specified no-user-action fund loss, sensitive server-secret retrieval or arbitrary command execution; other Critical cases receive $5,000.
Awards are USD-denominated and paid in USDC. Repeatability is limited by mitigability; the non-mitigable calculation discounts subsequent attacks by block delay. High temporary-freeze rewards scale with duration subject to the $10,000 cap.

Targets include Vault, Splitter, the listed Immunefi websites/dashboard and Iron Score. Accepted effects include stolen/inaccessible funds, malicious wallet transactions, unauthorized account actions, server compromise and confidential-data exposure.
Primacy of Impact covers the listed contract and web severity levels, subject to the accepted impacts. An asset’s presence in the table does not make an unlisted impact eligible.
Only explicitly listed web targets and their permitted pages are covered; other subdomains do not automatically qualify. Test/mock files and separate programs are not included by Primacy of Impact.

Known Gnosis Safe issues, unfixed published audit findings and previously disclosed bugs are excluded. Social-handle broken-link hijacking is downgraded to Informational, with only a discretionary goodwill payment.
The published exclusions cover unsupported theoretical web findings, self-XSS, non-impactful header/TLS issues, browser defects, privileged-key assumptions and ordinary economic/liquidity risks.

A runnable PoC is required. Country-of-residence information can be requested for any payout; Critical reports require government-ID verification. Publication requires approval and the program enables arbitration.
Cross-protocol attacks may be downgraded one severity level and must satisfy the program’s liquidity and ecosystem-impact conditions. Do not test live systems, third parties or service availability.
The separate Safe Harbor tab displays no eligible assets and no numeric reward at this snapshot. Its rescue process is not the standard bounty submission route.

Use the Immunefi bounty’s submission entry and demonstrate one of its accepted impacts. For an approved payout, invoice details can be requested inside the bug-report conversation.