ZKsync Era Bug Bounty
Find vulnerabilities in ZKsync Era’s Ethereum scaling contracts, proof-system components and listed blockchain infrastructure.
Key Details
- Program launched: 2023-03-10.
- Reports are submitted through Immunefi.
Reward
- Smart contracts: Critical $100,000–$300,000; High $20,000–$50,000; Medium $5,000; Low $1,000. Critical rewards use 10% of direct funds at risk, with the stated minimum. High rewards consider exploitability, impact and probability and are capped by affected funds and the High maximum.
- The Blockchain/DLT table lists Critical as a flat $50,000 and High as $5,000, while a separate Critical calculation mentions 10% of affected funds capped at $50,000. These two Critical formulations should be checked with the program.
- Awards are USD-denominated and paid in USDC on ZKsync Era under the terms applicable at submission.
Scope
- Separate Blockchain/DLT and Smart Contract scopes list proof/VM components and contracts such as DiamondProxy, Bridgehub and protocol-upgrade components. Eligible impacts include fund theft, irreversible freezes, insolvency, priority-queue interruption, fee theft and the specified circuit/implementation discrepancy.
- Primacy of Impact is used for report validity. The resources page invites Critical/High findings outside the explicit asset list through its designated exception placeholder.
- Repositories and development resources cover zksync-era, era-contracts, circuits, opcode definitions, assembly and test tooling. Review the exact deployed targets and restrictions rather than treating every repository file as covered.
Out of Scope
- Findings requiring Gateway to be enabled as a settlement layer are excluded while all chains settle to L1; reachable code for an L1-settling chain remains eligible. Broken-link hijacking and attacks requiring a verifier-key change are excluded.
- Previously known findings do not qualify. The program also documents fee-model differences, fluctuating gas-per-pubdata values and operator-compensation limitations. Generic economic, privileged-access, liquidity and test/mock exclusions apply.
Rules
- Provide a runnable PoC and observe the exact asset, subdomain and port boundaries. Government identification is required for payout KYC.
- Publication requires approval. Spam, incomplete or misrepresented findings can forfeit eligibility. Test on local forks, without live-system disruption, third-party testing or social engineering.
Submission Process
- Use the ZKsync Era Immunefi submission entry, follow its report template and demonstrate the accepted impact with a reproducible PoC.