Immunefi
The dominant web3 bug bounty platform - DeFi, smart contracts, bridges, and protocols, with the largest single payouts in the industry.
Tags: web3, smart-contract, high-payout, poc
- Program model
- Web3 / smart-contract bounty
- Regions
- Global
- Payout
- USD / crypto; critical bounties commonly reach six-seven figures (often scaled to funds-at-risk)
Specialties: smart-contracts, solidity, defi, blockchain
How to approach it
Severity is impact-driven: for Critical you typically must show a working PoC of funds actually at risk (often on a forked mainnet), not just a theoretical bug.
- Requires real Solidity/EVM (or the target chain's) skill - this is not web-app hunting.
- PoC on a mainnet fork (Foundry/Hardhat) is the expected proof; 'could' arguments get downgraded.
- Read each project's severity classification - % of funds at risk maps directly to the reward.