Immutable Bug Bounty

Immunefi · up to $1,000,000

Bug bountyKYC required

Immutable pays up to $1,000,000 (in USDC) for valid security vulnerabilities through its bug bounty on Immunefi. In scope: smart contract. Payouts require KYC.

What is in scope

Smart Contract

Facts from Immunefi's public program data, program last updated Jan 29, 2026. The full scope, severity table and rules are on the official program page.

Risk warnings

Test only as the program's rules allow (usually local forks or testnets). Exploiting a live system is illegal and voids any reward.
Report privately through the official platform. Do not disclose the bug publicly before it is fixed and you are permitted to.
Reward amounts are maximums; the program decides the payout based on severity and impact.