Polygon Bug Bounty

Report vulnerabilities in Polygon’s listed production blockchain, bridge, staking and AggLayer-related assets.

Key Details

Both Blockchain/DLT and Smart Contract tables show Critical up to $250,000, High $10,000 and Medium $2,000. Critical is calculated as 10% of direct funds at risk.
The detailed reward text specifies a $50,000 Critical minimum, while the summary tables show $20,000. The detailed text is retained here; the source contains an unresolved discrepancy.
Payouts are USD-denominated and made in USDC or POL at Polygon Labs’ discretion. POL conversion uses the five-day time-weighted average price calculated from the payment date. An invoice is required.

The asset table includes Polygon PoS clients, PoS bridge/staking, POL and sPOL, plus listed AggLayer gateway, rollup-manager, bridge and exit-root contracts. This bounty’s asset list is broader than a single rollup.
Only production assets actively used by the project qualify. For repositories, review the latest published releases rather than assuming the default branch is in scope; contract code must be deployed and listed in the scope files.
Reports must prove present exploitability on the blockchain state at submission. Severity combines impact and probability, while report completeness and quality can affect the award.

Unmodified upstream defects in dependencies such as go-ethereum, Cosmos SDK or CometBFT are excluded unless caused by Polygon modifications. Already-known Ethereum/fork, Tendermint and Cosmos SDK vulnerabilities are excluded.
Broken links, third-party fund losses, unexploitable old-library issues, inactive/test/mock assets, basic economic/governance attacks, liquidity shortages, Sybil and centralization risks are excluded.

A runnable PoC is required for both blockchain and smart-contract reports. KYC after validation requires a wallet address, passport and residence information.
Participation excludes residents of the jurisdictions restricted by the stated OFAC/UNSC conditions. US participants may need tax information. Live-chain testing, third-party attacks, social engineering and disruptive traffic are prohibited.

Submit through Polygon’s Immunefi entry using the program’s report template. Include demonstrable loss or impact and check the latest releases and listed deployments.