Immutable bug bounty programs
immutable.com Updated
Immutable runs two public programs: an Immunefi bug bounty paying up to $1,000,000 and a Bugcrowd bug bounty paying up to $10,000.
- Top reward
- $1,000,000
- Immunefi
- Programs
- 2
- 2 pay cash
- Targets in scope
- 14
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Immutable
Immunefi · Pays the most of the 2 programs: up to $1,000,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Immutable
Immunefi · Bug bounty |
$1M (highest) | $20k (highest) | $1,000 (highest) | – | $1,000,000 | – | Required | – | Open |
|
Immutable Bug Bounty
Bugcrowd · Bug bounty |
$10k | $5,000 | $450 | $100 (highest) | $10,000 | Full | – | – | Open |
-
- Critical
- $1M (highest)
- High
- $20k (highest)
- Medium
- $1,000 (highest)
- Low
- –
- KYC
- Required
-
- Critical
- $10k
- High
- $5,000
- Medium
- $450
- Low
- $100 (highest)
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
14 targets across all 2 programs, each listed once with the programs that cover it. 8 excluded.
-
https://etherscan.io/address/0x177EaFe0f1F3359375B1728dae0530a75C83E154
Smart contracts
Covered by Immunefi
-
https://etherscan.io/address/0x4f49b53928a71e553bb1b0f66a5bcb54fd4e8932
Smart contracts
Covered by Immunefi
-
https://etherscan.io/address/0xBa5E35E26Ae59c7aea6F029B68c6460De2d13eB6
Smart contracts
Covered by Immunefi
-
https://etherscan.io/address/0xE2E91C1Ae2873720C3b975a8034e887A35323345
Smart contracts
Covered by Immunefi
-
https://explorer.immutable.com/address/0x1d49c44dc4BbDE68D8D51a9C5732f3a24e48EFA6
Smart contracts
Covered by Immunefi
-
https://explorer.immutable.com/address/0x8804A8aA1F18f23aE8A456dD73806FdA3219FaD1
Smart contracts
Covered by Immunefi
-
https://explorer.immutable.com/address/0xb4c3597e6b090A2f6117780cEd103FB16B071A84
Smart contracts
Covered by Immunefi
-
https://github.com/immutable/ts-immutable-sdk/tree/main/packages/passport/
Products and areas
Covered by Bugcrowd
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.dev.x.immutable.com, *.sandbox.x.immutable.com, *.dev.x.immutable.com, *.sandbox.imtbl.com, *.dev.imtbl.com, *.ropsten.x.immutable.com, ropsten.imx.community (see brief for exceptions)
Bugcrowd
-
*.godsunchained.com
Bugcrowd
-
*.gogbackend.com
Bugcrowd
-
*.guildofguardians.com
Bugcrowd
-
Any data exposure bug that are classified as Public Data such as Ethereum Wallet Address, NFT Purchase activity, or other public blockchain activity.
Bugcrowd
-
Anything that does not belong to Immutable
Bugcrowd
-
godsunchained.com
Bugcrowd
-
gogbackend.com
Bugcrowd
Recent changes
Reward and scope changes across every Immutable program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under immutable.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.