OpenZeppelin Bug Bounty
Report vulnerabilities in the OpenZeppelin Contracts library and the additional contract assets explicitly listed in its bounty scope.
Key Details
- Program launched: 2021-11-15.
- Reports are submitted through Immunefi.
Reward
- Critical rewards range from $5,000 to $25,000; High from $2,500 to $5,000; Medium pays $2,500 and Low $1,000. The Critical calculation references 10% of affected funds.
- A vulnerability introduced by a release candidate earns a 50% bonus when reported during that release’s announced review period. Library rewards may be additive to bounties from affected downstream projects.
- Awards use an impact/likelihood matrix and assess an affected contract instance. Payments are USD-denominated, with ETH or USDC specified in the detailed payment terms.
Scope
- Contracts-library coverage includes code under contracts, except contracts/mocks and contracts/vendor. The current asset table also lists Confidential Contracts v0.5.3 at commit 4a4f6c71f58b75e391899b57e42e3b73d288dfe3 and Axelar Gateway Adapter / ERC7786OpenBridge at commit 0361935dc5edd233adbb9fbae5871ccbb8c739d8.
- Accepted impacts include principal theft, bypassed access control, manipulated governance, inaccessible funds, denial of contract operation, yield loss and gas-related disruption. Primacy of Rules applies: observe the exact asset and version restrictions.
- Exploit likelihood accounts for whether the defect arises in the supplied library or requires a custom implementation, and how common that implementation pattern is.
Out of Scope
- Mock, vendor and specifically excluded example code is not covered. Existing unfixed audit findings and previous security advisories are ineligible.
- ERC-required behavior and best-practice critiques are excluded. Generic governance, liquidity, centralization, Sybil, privileged-access and unsupported test/configuration impacts are also excluded by the program rules.
Rules
- The detailed PoC clause expressly requires compliant demonstrations for Critical and High smart-contract reports. The page also displays a broader all-severities PoC statement; check that discrepancy before submitting a lower-severity report.
- Payment requires an invoice and KYC screening, including legal name, email, mailing address and an Ethereum-mainnet wallet. OpenZeppelin may publish a GHSA/CVE and offer researcher credit.
- Publication is labeled Category 1, Transparent. Testing restrictions still prohibit live-chain tests, third-party attacks, social engineering and disruptive automated traffic.
Submission Process
- Submit through Immunefi with the affected version, impact and reproducible evidence. Check the Contracts Security Center, advisories and current asset table first.