Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Ethereum Foundation bug bounty programs

ethereum.org Updated

Ethereum Foundation runs one public program: a self-hosted bug bounty paying up to $1,000,000.

Top reward
$1,000,000
Self-hosted
Programs
1
1 pays cash
Targets in scope
34
3 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Ethereum Foundation runs.

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

34 targets. 10 excluded.

  • Besu

    Source code

  • C-KZG-4844

    Source code

  • Erigon

    Source code

  • Ethrex

    Source code

  • Geth

    Source code

  • Go-ETH-KZG

    Source code

  • Grandine

    Source code

  • https://github.com/erigontech/erigon

    Source code

  • https://github.com/ethereum/annotated-spec

    Source code

  • https://github.com/ethereum/consensus-specs

    Source code

  • https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md

    Source code

  • https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/deposit-contract.md

    Source code

  • https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/fast-confirmation.md

    Source code

  • https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/fork-choice.md

    Source code

  • https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/p2p-interface.md

    Source code

  • https://github.com/ethereum/execution-specs

    Source code

  • Lighthouse

    Source code

  • Lodestar

    Source code

  • Nethermind

    Source code

  • Nimbus

    Source code

  • Prysm

    Source code

  • Reth

    Source code

  • Solidity

    Source code

  • Teku

    Source code

  • Vyper

    Source code

No target matches. Try part of a host name, such as the company name.

Out of scope 10

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Any publicly known issues (includes forum posts, PRs, github issues, commits, blog posts, public discord messages, etc.)

  • Anything that does not currently have a direct impact on Ethereum mainnet.

  • EngineAPI is considered trusted and not meant to be publicly exposed

  • ERC-20 contract bugs

  • Ethereum Naming Service (ENS) bugs (maintained by the ENS foundation)

  • High-effort (sustained, CPU or bandwidth intensive, and/or requires more than 1 packet or onchain transaction) single-peer DoS attacks

  • Infrastructure bugs—such as webpages, DNS, email, etc.

  • Tests

  • Typographical errors

  • Vulnerabilities requiring the user to have publicly exposed an API, such as JSON-RPC or the Beacon API

Recent changes

Reward and scope changes across every Ethereum Foundation program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Ethereum Foundation products, from the NVD.

Search NVD
  • CVE-2026-26314 High

    go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

  • CVE-2026-26315 Medium

    go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by remo

  • CVE-2026-26313 Medium

    go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is resolved in the v1.17.0 release.

  • CVE-2026-22862 High

    go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

  • CVE-2026-22868 High

    go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8.

  • CVE-2023-42319 High

    Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.

  • CVE-2023-36980 Medium

    An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.

  • CVE-2023-40591 High

    go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerabil

About this page

This page gathers every public program listed under ethereum.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.