Home › Opportunities › Immunefi bug bounties
Immunefi · Paid bounty platformImmunefi bug bounties
The highest ceiling on this page and the steepest climb. Immunefi is where protocols pay whitehats to find security flaws, and it has paid out over $110,000,000. Be honest with yourself about the bar: this rewards real smart-contract security skill, not enthusiasm, and most students should treat it as a goal to grow into rather than a first paid credential.
Dates & timeline
Rewards
- Over $110,000,000 paid out in bounties to date, per Immunefi's own headline figure
- Each protocol sets its own reward tiers by severity — there is no platform-wide band
- Rewards scale with the value at risk, which is why critical findings on large protocols pay the most
- Invalid or out-of-scope reports pay nothing, however much time they took
- 187 bounty programs listed at the time of writing
- 161 of the 187 are free to submit to; 26 charge a submission fee
- 107 of the 187 require KYC to claim a reward
- Open globally and fully remote
Why it's worth your time
Immunefi is a bug bounty marketplace for blockchain protocols. Projects publish a scope — which contracts are in play, what counts as a valid finding, and what each severity tier pays — and independent security researchers submit vulnerability reports against it. If your report is judged valid and in scope, the protocol pays the reward. The platform's own figure for total bounties paid is over $110,000,000, across the 187 bounty programs listed at the time of writing.
This one sits differently from the rest of the bounties section. Superteam Earn is scoped micro-work you can win in a weekend; Immunefi is adversarial security research against code that is holding real money, judged by people whose job is to reject invalid reports. The payouts are large precisely because the work is hard and most submissions fail. It belongs on this page because the ceiling is genuinely high and it is open to anyone globally — but if you have not already spent serious time on Solidity and smart-contract security, your realistic first paid line comes from somewhere else on this page.
Two practical frictions worth knowing before you start. 107 of the 187 listed programs require KYC, so you will need to identify yourself to claim a reward on most of them. And while the majority are free, 26 programs charge a fee to submit a report — a deliberate filter against spam submissions. Check both on the program page before you invest time.
How to apply
Be realistic first. If you have not written and audited Solidity before, spend your time on Superteam Earn or a competition instead and come back to this later.
Browse the bounty programs and filter to ones that are free to submit to before you read any code.
Read the scope literally. Rewards are only paid for vulnerability classes the program lists as in scope, on the exact contracts it names.
Check the KYC requirement on the program page — most programs need it, and finding out after you have a valid finding is a bad time to discover it.
Write the report as a reproducible proof of concept, not a description. Triagers reject reports they cannot reproduce.
Frequently asked questions
Is Immunefi realistic for a 2nd-year student?
Only if you already have real smart-contract security skill. This is adversarial security research judged against code holding live funds, and most submissions are rejected. It is on this page because the ceiling is high and it is open to anyone, but for a first paid credential the bounty and competition items are far better odds.
How much has Immunefi paid out?
Over $110,000,000 in bounties to date, according to Immunefi's own headline figure. Individual rewards are set by each protocol by severity tier rather than by the platform.
Is it free to take part?
Mostly. 161 of the 187 currently listed programs are free to submit to, but 26 charge a submission fee as a spam filter. Check the individual program page before you start work.
Do I need to give ID to get paid?
On most programs, yes. 107 of the 187 listed programs require KYC before a reward is released. Check this on the program page before investing time, not after you have a finding.
Can students in India take part?
Yes. Immunefi is open globally and the work is fully remote. Individual programs may have their own KYC and payout requirements.
Official links
US startups hiring on Tierones
Part-time, remote coding internships with funded US startups — quoted in USD per hour, open to verified 2nd- and 3rd-year students. Free for students, always.
Browse open roles