Bounty Operator

Every public bug bounty, on one board

1,406 programs on HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi, Cantina, Sherlock and Code4rena: what each one pays, what it costs to file there, and what changed this month.

Read 11 Nov 2026 from 8 platforms' public lists.

  • 1,406Programs open869 pay a bounty, 537 take reports without one
  • 54,186Assets in scope3,431 of them wildcards
  • 22Launched in 30 days1,694 assets added to scope in the same time
  • 144Charge to filea fee or a stake with every report
  • 125Ask for KYCan identity check to join or be paid
  • $16MHighest rewardUsual Labs

By platform

Web2 and web3 side by side. A line shows the last twelve months where the platform's history is known; green rose, ochre fell, grey moved less than 2%.

PlatformProgramsPayingAssets in scopeAdded to scope, 30 dLaunched, 30 dHighest rewardTo file there
HackerOneWeb2Programs452Paying220Assets in scope43,027Added to scope, 30 d+1,273Launched, 30 d2Highest reward$1MCrypto.comTo file there
  • First answer in 7 h, the median of 335
  • $11.4M paid in 90 days
  • 119,538 reports in 90 days
BugcrowdWeb2Programs515Paying291Assets in scope2,916Added to scope, 30 d+80Launched, 30 d9Highest reward$3MOpenSea Managed Bug Bounty ProgramTo file thereNothing published.
IntigritiWeb2Programs154Paying75Assets in scope1,812Added to scope, 30 d+122Launched, 30 d1Highest reward€51,337Capture Our FlagTo file thereNothing published.
YesWeHackWeb2Programs53Paying51Assets in scope654Added to scope, 30 d+78Launched, 30 d–Highest reward€230KSwiss Post - E-VotingTo file there
  • 51,483 reports to date
ImmunefiWeb3Programs147Paying147Assets in scope5,265Added to scope, 30 d+141Launched, 30 d2Highest reward$10MSkyTo file there
  • A fee on 64
  • KYC on 84
  • Proof of concept required on 139
CantinaWeb3Programs47Paying47Assets in scope512Added to scope, 30 d–Launched, 30 d1Highest reward$15.5MUniswapTo file there
  • A fee on 42, $5 to $100
  • KYC on 41
  • 22,638 findings filed to date
SherlockWeb3Programs38Paying38Assets in scope–Added to scope, 30 d–Launched, 30 d7Highest reward$16MUsual LabsTo file there
  • A stake on 38, $250
Code4renaWeb3Programs0Paying0Assets in scope–Added to scope, 30 d–Launched, 30 d–Highest reward–To file thereNo audit is open today.

A report that bounces now costs money

Some programs take a fee or a stake with every report, ask for an identity check, or close a report that has no proof of concept. The board reads each of these from what the platform publishes about the program.

Review my report Report templates

The review argues against your draft the way a triager would, before you pay to submit it. The copy-paste route is free and needs no account.

144

programs charge you to file a report

  • Immunefi 64the amount is shown when you submit
  • Cantina 42$5 to $100 fee
  • Sherlock 38$250 stake, returned for a valid report

125

ask for an identity check

  • Immunefi 84of 147
  • Cantina 41of 47

139

require a proof of concept

  • Immunefi 139of 147

New in the last 30 days

Programs that launched, and programs that added assets to their scope. Fresh scope has had the fewest eyes on it.

  1. 11 NovShopifyHackerOne+5 assets$200K
  2. 11 NovAllegionHackerOne+1 assetNo bounty
  3. 10 NovMetricImmunefiLaunched$500K
  4. 10 NovSkyImmunefi+3 assets$10M
  5. 10 NovZest Protocol V2Immunefi+7 assets$100K
  6. 10 NovWalt.ioHackerOne+1 asset$100K
  7. 10 NovBitpanda Ongoing Bug BountyBugcrowd+1 asset$15,000
  8. 10 NovFileZillaHackerOne+5 assets$5,000
  9. 10 NovBorgWarner Vulnerability Disclosure ProgramIntigriti+32 assetsNo bounty
  10. 10 NovFlywire Vulnerability Disclose ProgramIntigriti+32 assetsNo bounty
  11. 10 NovJohn DeereHackerOne+30 assetsNo bounty
  12. 10 NovCBREHackerOne+2 assetsNo bounty
  13. 10 NovCanada Post - Responsible Disclosure ProgramIntigriti+2 assetsNo bounty
  14. 10 NovMarsHackerOne+1 assetNo bounty

Audit contests open now

Public contests with an end date, soonest first.

  • PletherImmunefi

    $80,000 pool

    2 Nov to 16 Nov, 5 days left

    Fee to filePoC required

No public audit contest is open on Cantina, Sherlock or Code4rena today.

Every program

Only

Showing 40 of 1,406 programs.

ProgramHighest rewardScopeTo fileActivitySince
Usual LabsSherlockHighest reward$16MScope–To file$250 stakeActivity–Launched8 Apr 2025
UniswapCantinaHighest reward$15.5MScope20 assets14 smart contract, 6 otherTo file$50 feeKYCActivity1,141 findings filedLaunched26 Nov 2024
Reserve Protocol Bug BountyCantinaHighest reward$10MScope–To file$100 feeKYCActivity240 findings filedLaunched26 Mar
SkyImmunefi+3 assetsHighest reward$10MScope258 assets4 web, 254 smart contractTo fileFee to filePoC requiredActivity–Launched10 Feb 2022
Usual - Fira UZR (Usual Zero Rate) moduleSherlockHighest reward$7.5MScope–To file$250 stakeActivity–Launched16 Jan
USDT0ImmunefiHighest reward$6MScope47 assets47 smart contractTo fileKYCPoC requiredActivity–Launched30 Jan 2025
CoinbaseCantinaHighest reward$5MScope21 assets21 otherTo fileKYCActivity1,920 findings filedLaunched8 Jul 2025
GMXImmunefiHighest reward$5MScope250 assets2 web, 248 smart contractTo fileFee to filePoC requiredActivity–Launched20 Oct 2021
PolymarketCantinaHighest reward$5MScope49 assets48 smart contract, 1 otherTo file$5 feeKYCActivity1,063 findings filedLaunched12 Apr
SparkImmunefiHighest reward$5MScope385 assets4 web, 381 smart contractTo fileFee to filePoC requiredActivity–Launched1 Nov 2023
LayerZeroImmunefi+3 assetsHighest reward$3.5MScope10 assets10 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched17 May 2023
StargateImmunefi+4 assetsHighest reward$3.5MScope5 assets5 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched24 Sep 2024
OlympusImmunefiHighest reward$3.3MScope72 assets1 web, 71 smart contractTo filePoC requiredActivity–Launched6 Jan 2022
ChainlinkImmunefiHighest reward$3MScope24 assets14 web, 10 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched11 May 2021
EthenaImmunefiHighest reward$3MScope27 assets4 web, 23 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched4 Apr 2024
OpenSea Managed Bug Bounty ProgramBugcrowdHighest reward$3MScope11 assets3 web, 2 mobile, 6 otherTo file–Activity–Launched–
Aave V4SherlockHighest reward$2.5MScope–To file$250 stakeActivity–Launched29 Sep
HyperlaneImmunefiHighest reward$2.5MScope218 assets2 web, 216 smart contractTo fileKYCPoC requiredActivity–Launched10 Jan 2023
MorphoCantinaHighest reward$2.5MScope12 assets12 otherTo file$30 feeActivity1,707 findings filedLaunched27 Mar 2024
OptimismImmunefiHighest reward$2MScope35 assets13 web, 18 smart contract, 4 blockchainTo fileFee to fileKYCPoC requiredActivity–Launched14 Jan 2022
ArbitrumImmunefiHighest reward$2MScope170 assets170 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched31 Aug 2021
Gnosis ChainImmunefiHighest reward$2MScope4 assets4 smart contractTo filePoC requiredActivity–Launched11 Feb 2022
LidoImmunefiHighest reward$2MScope29 assets10 web, 19 smart contractTo filePoC requiredActivity–Launched22 May 2021
Pendle BountyCantinaHighest reward$2MScope–To file$100 feeActivity105 findings filedLaunched14 Jun 2024
Rhino.fiImmunefiHighest reward$2MScope9 assets9 smart contractTo filePoC requiredActivity–Launched30 Jun 2023
Euler-BountyCantinaHighest reward$1.5MScope–To file$20 feeKYCActivity634 findings filedLaunched21 Aug 2024
Ondo PerpsCantinaHighest reward$1.5MScope3 assets3 otherTo file$20 feeKYCActivity120 findings filedLaunched2 Jun
0xImmunefiHighest reward$1MScope6 assets4 web, 2 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched30 Jul 2024
AAVEImmunefiHighest reward$1MScope83 assets83 smart contractTo fileKYCPoC requiredActivity–Launched18 Oct 2023
CapSherlockHighest reward$1MScope–To file$250 stakeActivity–Launched18 Aug
CapyFiImmunefiHighest reward$1MScope11 assets1 web, 10 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched19 Nov 2025
Compound FinanceImmunefiHighest reward$1MScope146 assets146 smart contractTo fileFee to fileKYCPoC requiredActivity–Launched11 Dec 2024
CoW ProtocolImmunefi+8 assetsHighest reward$1MScope27 assets8 web, 19 smart contractTo fileKYCPoC requiredActivity–Launched15 Jun 2021
Crypto.comHackerOneHighest reward$1MScope24 assets18 web, 2 api, 2 mobileTo file–Activity1,427 reports in 90 d · $15,505 paid in 90 d · first answer in 14 hLaunched2 May 2018
dYdX Bug BountyCantinaHighest reward$1MScope11 assets11 otherTo file$30 feeKYCActivity1,223 findings filedLaunched8 May
Flying TulipSherlockHighest reward$1MScope–To file$250 stakeActivity–Launched18 Jun
ImmutableImmunefiHighest reward$1MScope10 assets10 smart contractTo fileKYCPoC requiredActivity–Launched10 Jun 2025
KaminoSherlockNewHighest reward$1MScope–To file$250 stakeActivity–Launched16 Oct
Kiln V1 BountyCantinaHighest reward$1MScope–To file$30 feeKYCActivity466 findings filedLaunched9 Sep 2024
kinetiq-contractsCantinaHighest reward$1MScope–To file$20 feeKYCActivity433 findings filedLaunched15 Sep 2025

Where the figures come from

Once a day the board reads each platform's own public list. It needs no account anywhere, and it shows a program only while the platform lists it as open to the public.

  • HackerOne. HackerOne’s public program directory, with scope from the open bounty-targets-data set.
  • Bugcrowd. The open bounty-targets-data set, read from Bugcrowd’s public engagements.
  • Intigriti. The open bounty-targets-data set, read from Intigriti’s public programs.
  • YesWeHack. The open bounty-targets-data set, read from YesWeHack’s public programs.
  • Immunefi. Immunefi’s public bounty list.
  • Cantina. Cantina’s public opportunities list.
  • Sherlock. Sherlock’s public bug bounty and contest lists.
  • Code4rena. Code4rena’s public audit list.

Every figure is the platform's own. A reward is shown in the currency the platform publishes it in, and ordering by reward compares the figures as published, without converting. Where a platform does not publish something, the cell is empty; nothing is estimated.

New. A launch date is the platform's where it publishes one. Where it does not, the board uses the day it first saw the program, and says "first listed". An asset counts as added to scope on the day the board first saw it, or on the platform's own date where it gives one. The history of the four web2 platforms comes from the commit log of the open bounty-targets-data set (MIT licence): one day a month back to December 2025, one a week from August 2026 and every day from 20 October 2026, so a first-listed date before then is the end of its week or month.

Cost to file. Immunefi marks a program "Pay to Submit" and shows the amount when you submit. Cantina publishes a submission fee per bounty. Sherlock takes a stake with a report and returns it when the report is valid. HackerOne's response time is the latest figure in its own directory and can differ from the one on the program page.

The program page is the authority. Read it before you rely on anything here.

Found something on one of them?

Run the draft through a review before you file. It checks every claim against the code you add and ends in one verdict: submit, rewrite, prove first, hold as a duplicate, or drop.

Review my reportReport templates

Free in ChatGPT or Claude with no account, or once a day on your own AI key with a free account.