The Graph bug bounty programs
thegraph.com Updated
The Graph runs one public program: an Immunefi bug bounty paying up to $50,000.
- Top reward
- $50,000
- Immunefi
- Programs
- 1
- 1 pays cash
- Targets in scope
- 36
- 1 type
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program The Graph runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
The Graph
Immunefi · Bug bounty |
$50k | $15k | – | – | $50,000 | – | Required | 31 hours average | Open |
-
- Critical
- $50k
- High
- $15k
- Medium
- –
- Low
- –
- KYC
- Required
- First response
- 31 hours average
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
36 targets.
-
https://arbiscan.io/address/0x00669A4CF01450B64E8A2A20E9b1FCB71E61eF03
Smart contracts
-
https://arbiscan.io/address/0x02753bae61c08abd4351bce7f48524935c2cc78e
Smart contracts
-
https://arbiscan.io/address/0x072884c745c0A23144753335776c99BE22588f8A
Smart contracts
-
https://arbiscan.io/address/0x0a8491544221dd212964fbb96487467291b2C97e
Smart contracts
-
https://arbiscan.io/address/0x0Ab2B043138352413Bb02e67E626a70320E3BD46
Smart contracts
-
https://arbiscan.io/address/0x1B07D3344188908Fb6DEcEac381f3eE63C48477a
Smart contracts
-
https://arbiscan.io/address/0x22d78fb4bc72e191C765807f8891B5e1785C8014
Smart contracts
-
https://arbiscan.io/address/0x270Ea4ea9e8A699f8fE54515E3Bb2c418952623b
Smart contracts
-
https://arbiscan.io/address/0x2983936aC20202a6555993448E0d5654AC8Ca5fd
Smart contracts
-
https://arbiscan.io/address/0x2FE023a575449AcB698648eD21276293Fa176f96
Smart contracts
-
https://arbiscan.io/address/0x3bE385576d7C282070Ad91BF94366de9f9ba3571
Smart contracts
-
https://arbiscan.io/address/0x3FbD54f0cc17b7aE649008dEEA12ed7D2622B23f
Smart contracts
-
https://arbiscan.io/address/0x5A843145c43d328B9bB7a4401d94918f131bB281
Smart contracts
-
https://arbiscan.io/address/0x65E1a5e8946e7E87d9774f5288f41c30a99fD302
Smart contracts
-
https://arbiscan.io/address/0x76C00F71F4dACE63fd83eC80dBc8c30a88B2891c
Smart contracts
-
https://arbiscan.io/address/0x7Aae8ae011927BC36Cb4d0d3e81f2E6E30daE06D
Smart contracts
-
https://arbiscan.io/address/0x8f69F5C07477Ac46FBc491B1E6D91E2bb0111A9e
Smart contracts
-
https://arbiscan.io/address/0x9623063377AD1B27544C965cCd7342f7EA7e88C7
Smart contracts
-
https://arbiscan.io/address/0x971B9d3d0Ae3ECa029CAB5eA1fB0F72c85e6a525
Smart contracts
-
https://arbiscan.io/address/0x993F00C98D1678371a7b261Ed0E0D4b6F42d9aEE
Smart contracts
-
https://arbiscan.io/address/0xb2Bb92d0DE618878E438b55D5846cfecD9301105
Smart contracts
-
https://arbiscan.io/address/0xc9E1Aa57223aDD21cC88A03088aF552f1ea8A34a
Smart contracts
-
https://arbiscan.io/address/0xec9A7fb6CbC2E41926127929c2dcE6e9c5D33Bec
Smart contracts
-
https://arbiscan.io/address/0xf6Fcc27aAf1fcD8B254498c9794451d82afC673E
Smart contracts
-
https://etherscan.io/address/0x01cDC91B0A9bA741903aA3699BF4CE31d6C5cC06
Smart contracts
-
https://etherscan.io/address/0x36aFF7001294daE4C2ED4fDEfC478a00De77F090
Smart contracts
-
https://etherscan.io/address/0x4Dbd4fc535Ac27206064B68FfCf827b0A60BAB3f
Smart contracts
-
https://etherscan.io/address/0x74Db79268e63302d3FC69FB5a7627F7454a41732
Smart contracts
-
https://etherscan.io/address/0x8017B9AF3F199CC6b08A48DA3859410F20bbea72
Smart contracts
-
https://etherscan.io/address/0x8FE00a685Bcb3B2cc296ff6FfEaB10acA4CE1538
Smart contracts
-
https://etherscan.io/address/0x97307b963662cCA2f7eD50e38dCC555dfFc4FB0b
Smart contracts
-
https://etherscan.io/address/0x9Ac758AB77733b4150A901ebd659cbF8cB93ED66
Smart contracts
-
https://etherscan.io/address/0xaDcA0dd4729c8BA3aCf3E99F3A9f471EF37b6825
Smart contracts
-
https://etherscan.io/address/0xbE5e630383b5BAEcF0Db7b15C50d410edD5A2255
Smart contracts
-
https://etherscan.io/address/0xc944E90C64B2c07662A292be6244BDf05Cda44a7
Smart contracts
-
https://etherscan.io/address/0xF55041E37E12cD407ad00CE2910B8269B01263b9
Smart contracts
No target matches. Try part of a host name, such as the company name.
Recent changes
Reward and scope changes across every The Graph program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in The Graph products, from the NVD.
-
CVE-2026-28410 Medium
The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in version 3.0.0.
About this page
This page gathers every public program listed under thegraph.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.