What is a bug bounty programme?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 4 min
In short
A bug bounty pays people who find vulnerabilities, so that reporting beats exploiting. A programme with published rewards, a clear scope and a record of actual payouts is evidence that a project is being tested continuously. For users, it sits alongside audits as a signal worth checking.
Key points
- Pays researchers so that reporting beats exploiting
- Look for a published scope and reward schedule
- A record of real payouts is what matters
- Audits are a snapshot; bounties are continuous
Definition
A programme under which outside researchers are paid for reporting vulnerabilities to the developers instead of exploiting them, with scope, severity tiers and a reporting process published in advance.
Anyone who finds a vulnerability faces a choice between exploiting it and reporting it. A bounty programme tilts that choice by making the reward for reporting explicit, and protocols holding more value generally post larger rewards.
A published programme states which contracts and code are in scope, how severities map to payouts, where to report, and what researchers must not do — typically forbidding tests against the live network and requiring reproduction in a test environment so that users are not caught up in it.
What matters when you evaluate one is not that it exists but that it works. Is there a public record of reports that were paid? How quickly did fixes follow disclosure? Is the maximum reward proportionate to the value at stake? A programme page with no payout history carries much less weight.
Watch out for
- · Check payout history and fix turnaround, not just that a programme exists
- · Compare the maximum reward with the value the protocol holds
- · If you research vulnerabilities yourself, never test against the live network — follow the published process