SmartContract Chainlink Ltd bug bounty programs
chain.link Updated
SmartContract Chainlink Ltd runs three public programs: an Immunefi bug bounty paying up to $3,000,000, a Sorona bug bounty paying up to $101,000 and a HackerOne bug bounty paying up to $100,000.
- Top reward
- $3,000,000
- Immunefi
- Programs
- 3
- 3 pay cash
- Targets in scope
- 34
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Chainlink
Immunefi · Pays the most of the 3 programs: up to $3,000,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Chainlink
Immunefi · Bug bounty |
$3M (highest) | $75k (highest) | $10k (highest) | $5,000 (highest) | $3,000,000 | – | Required | – | Open |
|
Chainlink node
Sorona · Bug bounty |
$101k | $11k | $2,500 | $125 | $101,000 | Partial | Not required | 12 days promised | Open |
|
Chainlink
HackerOne · Bug bounty |
$100k | $10k | $2,000 | $100 | $100,000 | Full | – | 22 days average | Open |
-
- Critical
- $3M (highest)
- High
- $75k (highest)
- Medium
- $10k (highest)
- Low
- $5,000 (highest)
- KYC
- Required
-
- Critical
- $101k
- High
- $11k
- Medium
- $2,500
- Low
- $125
- Safe harbor
- Partial
- KYC
- Not required
- First response
- 12 days promised
-
- Critical
- $100k
- High
- $10k
- Medium
- $2,000
- Low
- $100
- Safe harbor
- Full
- First response
- 22 days average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
34 targets across all 3 programs, each listed once with the programs that cover it. 21 excluded.
-
https://github.com/smartcontractkit/chainlink-aptos/tree/develop/contracts
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-aptos/tree/develop/relayer
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-ccip/tree/main/chains/evm/contracts
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-ccip/tree/main/chains/solana/contracts
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-ccip/tree/main/execute
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-common/tree/main/keystore
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-solana/tree/develop/pkg/solana
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-sui/tree/develop/contracts/ccip
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-sui/tree/develop/contracts/link
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/chainlink-sui/tree/develop/contracts/mcms/mcms
Source code
Covered by Immunefi
-
https://github.com/smartcontractkit/staking-v0.1/tree/master/contracts
Smart contracts Critical
Covered by HackerOne
-
Authentication, session handling and authorisation across the node's API and the operator UI
Products and areas
Covered by Sorona
-
external-adapters-js, the adapter layer that fetches the off-chain data a job reports on, listed as its own SOURCE_CODE asset but capped at High severity, so it tops out at the $10,000 row
Products and areas
Covered by Sorona
-
https://github.com/smartcontractkit/chainlink is a bounty-eligible SOURCE_CODE asset at a maximum severity of critical. The program carves out five test-only sub-paths and nothing else, which is what confirms the rest of the repository is in.
Products and areas
Covered by Sorona
-
The key management layer and keystore, where an operator's signing keys live
Products and areas
Covered by Sorona
-
The node daemon in full: the Go core service, the job pipeline engine and its task runners, the off-chain reporting plugins, and the chain relayers that talk to each network
Products and areas
Covered by Sorona
-
The persistence layer the node keeps jobs, runs and keys in, along with its migrations
Products and areas
Covered by Sorona
-
The staking-v0.1, chainlink-evm and chainlink-solana contract directories, which the program lists as SMART_CONTRACT assets at up to critical severity
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 21
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
blog.chain.link
HackerOne
-
chainlinklabs.com
HackerOne
-
create.smartcontract.com
HackerOne
-
docs.chain.link
HackerOne
-
github.com/smartcontractkit/chainlink/contracts/src/*/dev
HackerOne
-
github.com/smartcontractkit/chainlink/examples
HackerOne
-
https://github.com/smartcontractkit/chainlink/tree/master/core/internal
HackerOne
-
https://github.com/smartcontractkit/chainlink/tree/master/core/sgx
HackerOne
-
https://github.com/smartcontractkit/chainlink/tree/master/integration
HackerOne
-
https://github.com/smartcontractkit/chainlink/tree/master/tools
HackerOne
-
https://github.com/smartcontractkit/chainlink
HackerOne
-
https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts/.../dev
HackerOne
-
https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts/.../dev
HackerOne
-
https://github.com/smartcontractkit/chainlink/tree/master/contracts
HackerOne
-
chainlinklabs.com, which the scope table marks out of scope for the program entirely
Sorona
-
Documentation and blog properties, Intercom, and the other third-party SaaS the company runs on
Sorona
-
Intercom
HackerOne
-
The *.smartcontract.com wildcard and most Chainlink web properties, which are submission-only with no bounty
Sorona
-
The contracts inside the node repository, both the chainlink SMART_CONTRACT row and chainlink/contracts, which the scope table marks not bounty-eligible even though the repository's Go code is
Sorona
-
The contracts/src/*/dev directories, which the program states are in development and not production-ready
Sorona
-
The core/sgx, tools, integration, core/internal and examples sub-paths, which contain private keys and passwords for deterministic end-to-end testing and are not bounty-eligible
Sorona
Recent changes
Reward and scope changes across every SmartContract Chainlink Ltd program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under chain.link: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.