Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Filecoin bug bounty programs

filecoin.io Updated

Filecoin runs two public programs: an Immunefi bug bounty paying up to $50,000 and a self-hosted bug bounty.

Top reward
$50,000
Immunefi
Programs
2
2 pay cash
Targets in scope
29
1 type, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Filecoin

Immunefi · Pays the most of the 2 programs: up to $50,000.
  • Filecoin

    Immunefi · Bug bounty

    Open

    Top reward

    $50k
    Critical
    $50k (highest)
    High
    $25k (highest)
    Medium
    $7,500 (highest)
    Low
    $2,000 (highest)
    KYC
    Required
    First response
    4 days average
  • Filecoin

    Self-hosted · Bug bounty

    Open

    Top reward

    Not published

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

29 targets across all 2 programs, each listed once with the programs that cover it.

  • https://github.com/filecoin-project/bellperson

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/boost

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/builtin-actors

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-address

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-amt-ipld

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-bitfield

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-cbor-util

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-crypto

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-data-transfer

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-f3

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-fil-commcid

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-padreader

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-sectorbuilder

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-statemachine

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/go-statestore

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/lotus

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/lotus/tree/master/miner

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/merkletree

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/paired

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/ref-fvm

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/rust-fil-proofs

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/rust-fil-proofs-ffi

    Source code

    Covered by Immunefi

  • https://github.com/filecoin-project/rust-filecoin-proofs-api

    Source code

    Covered by Immunefi

  • https://github.com/ipfs/go-graphsync

    Source code

    Covered by Immunefi

  • https://github.com/ipfs/go-hamt-ipld

    Source code

    Covered by Immunefi

No target matches. Try part of a host name, such as the company name.

Recent changes

Reward and scope changes across every Filecoin program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Filecoin products, from the NVD.

Search NVD
  • CVE-2025-59941 Medium

    go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same

  • CVE-2025-59942 High

    go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bu

  • CVE-2025-59941 Medium

    go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same

  • CVE-2025-59942 High

    go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bu

  • CVE-2021-21405 Medium

    Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms: "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays. Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are conside

  • CVE-2021-21405 Medium

    Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms: "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays. Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are conside

About this page

This page gathers every public program listed under filecoin.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.