Ethereum Foundation Bug Bounty
By Ethereum Foundation Bug bounty on Self-hosted ethereum.org
Accepting reports
KYC to get paid
- Top reward
- $1,000,000
- Top severity paid
- Not published
- Assets in scope
- 34
- Public CVEs
- 39
- Last change
At a glance
What to know before you start testing.
- Pays up to $1,000,000
- top reward, from $2,000.
- Report by email
- [email protected]
- Replies within 7 days
- As the policy promises.
- Paid by ETH, DAI
- Proof of identity needed to get paid.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$1,000,000
Up to 1,000,000 USD
- Lowest reward
-
$2,000
Up to 2,000 USD
- Response
-
Within 7 days
Due to the increase in AI submissions, please allow up to a week for us to respond to your submission.
- Hall of fame
-
Yes
Earn up to 1,000,000 USD and a place on the leaderboard by finding protocol, client and language compiler bugs affecting the Ethereum network.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
34 assets you may test, 10 excluded.
Source code 25
- Besu
- C-KZG-4844
- Erigon
- Ethrex
- Geth
- Go-ETH-KZG
- Grandine
- https://github.com/erigontech/erigon
- https://github.com/ethereum/annotated-spec
- https://github.com/ethereum/consensus-specs
- https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md
- https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/deposit-contract.md
- https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/fast-confirmation.md
- https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/fork-choice.md
- https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/p2p-interface.md
- https://github.com/ethereum/execution-specs
- Lighthouse
- Lodestar
- Nethermind
- Nimbus
- Prysm
- Reth
- Solidity
- Teku
- Vyper
Smart contracts 3
- Deposit Contract Source Code
- Deposit Contract Specifications
- Solidity deposit contract
Products and areas 6
- Beacon Chain
- Consensus Layer Specifications
- Execution Layer Specifications
- Fast Confirmation Rule
- Fork choice
- Peer-to-peer networking
Out of scope (10)
- Any publicly known issues (includes forum posts, PRs, github issues, commits, blog posts, public discord messages, etc.)
- Anything that does not currently have a direct impact on Ethereum mainnet.
- EngineAPI is considered trusted and not meant to be publicly exposed
- ERC-20 contract bugs
- Ethereum Naming Service (ENS) bugs (maintained by the ENS foundation)
- High-effort (sustained, CPU or bandwidth intensive, and/or requires more than 1 packet or onchain transaction) single-peer DoS attacks
- Infrastructure bugs—such as webpages, DNS, email, etc.
- Tests
- Typographical errors
- Vulnerabilities requiring the user to have publicly exposed an API, such as JSON-RPC or the Beacon API
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Ethereum Foundation Bug Bounty's policy. "We" in these lines means the program, not this site.
While testing
-
your testing must not violate any law or compromise any data that is not yours and must take place on local running testnets
-
Issues without a POC or that have already been submitted by another user or are already known to spec and client maintainers are not eligible for bounty rewards.
-
Public disclosure of a vulnerability or reporting it to other parties without prior agreement makes it ineligible for a bounty.
-
Researchers should target the latest unstable client branches and check for existing issues and pull requests.
-
Bugs already covered by an open issue or pull request are not eligible.
Not accepted
-
Infrastructure bugs—such as webpages, DNS, email, etc.
-
ERC-20 contract bugs
-
Ethereum Naming Service (ENS) bugs (maintained by the ENS foundation)
-
Vulnerabilities requiring the user to have publicly exposed an API, such as JSON-RPC or the Beacon API
-
EngineAPI is considered trusted and not meant to be publicly exposed
-
Typographical errors
-
Tests
-
High-effort (sustained, CPU or bandwidth intensive, and/or requires more than 1 packet or onchain transaction) single-peer DoS attacks
-
Any publicly known issues (includes forum posts, PRs, github issues, commits, blog posts, public discord messages, etc.)
-
Anything that does not currently have a direct impact on Ethereum mainnet.
-
we do not issue rewards for crashes of the compiler on maliciously generated data
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− https://github.com/ethereum/solidity-deposit-contract/blob/master/deposit_contra...
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-26314 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth. | High 8.7 | 19 Feb 2026 |
| CVE-2026-26315 | go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by remo | Medium 6.9 | 19 Feb 2026 |
| CVE-2026-26313 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sending a specially-crafted p2p message. The issue is resolved in the v1.17.0 release. | Medium 6.9 | 19 Feb 2026 |
| CVE-2026-22862 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8. | High 7.1 | 13 Jan 2026 |
| CVE-2026-22868 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8. | High 7.1 | 13 Jan 2026 |
| CVE-2023-42319 | Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic. | High 7.5 | 18 Oct 2023 |
| CVE-2023-36980 | An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold. | Medium 5.3 | 11 Sep 2023 |
| CVE-2023-40591 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerabil | High 7.5 | 6 Sep 2023 |
| CVE-2022-1930 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method | Medium 5.9 | 22 Aug 2022 |
| CVE-2022-37450 | Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022. | Medium 5.9 | 5 Aug 2022 |
| CVE-2022-29177 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not | Medium 5.9 | 20 May 2022 |
| CVE-2021-42219 | Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go. | High 7.5 | 17 Mar 2022 |
| CVE-2022-23327 | A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS). | High 7.5 | 4 Mar 2022 |
| CVE-2022-23328 | A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of | High 7.5 | 4 Mar 2022 |
| CVE-2021-43668 | Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal. | Medium 5.5 | 18 Nov 2021 |
| CVE-2021-41173 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading. | Medium 5.7 | 26 Oct 2021 |
| CVE-2021-39137 | go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available. | Medium 6.5 | 24 Aug 2021 |
| CVE-2020-26800 | A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service. | Medium 5.5 | 11 Jan 2021 |
| CVE-2020-26264 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25. | Medium 6.5 | 11 Dec 2020 |
| CVE-2020-26265 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made -- all users are recommended to u | Medium 5.3 | 11 Dec 2020 |
| CVE-2017-14451 | An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send malicious smart contract to trigger this vulnerability. | Critical 10.0 | 2 Dec 2020 |
| CVE-2020-26240 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as o | Medium 5.3 | 25 Nov 2020 |
| CVE-2020-26241 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory re | Medium 6.5 | 25 Nov 2020 |
| CVE-2020-26242 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18. | Medium 6.5 | 25 Nov 2020 |
| CVE-2018-15890 | An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server. | Critical 9.8 | 20 Jun 2019 |
| CVE-2018-20421 | Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly { mstore }" followed by a "c[0xC800000] = 0xFF" assignment. | High 7.5 | 24 Dec 2018 |
| CVE-2018-19184 | cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode. | High 7.5 | 12 Nov 2018 |
| CVE-2018-18920 | Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid." | High 8.8 | 12 Nov 2018 |
| CVE-2018-16733 | In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block. | High 7.5 | 8 Sep 2018 |
| CVE-2018-12018 | The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ether | High 7.5 | 5 Jul 2018 |
| CVE-2017-12113 | An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability. | High 8.1 | 19 Jan 2018 |
| CVE-2017-12116 | An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability. | High 8.1 | 19 Jan 2018 |
| CVE-2017-12118 | An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An attacker can send JSON to trigger this vulnerability. | High 8.1 | 19 Jan 2018 |
| CVE-2017-12119 | An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can cause an unhandled exception resulting in denial of service. An attacker can send malicious JSON to trigger this vulnerability. | High 7.5 | 19 Jan 2018 |
| CVE-2017-14457 | An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker can create/send malicious a smart contract to trigger this vulnerability. | High 8.2 | 19 Jan 2018 |
| CVE-2017-12112 | An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability. | High 8.1 | 19 Jan 2018 |
| CVE-2017-12114 | An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability. | Medium 6.8 | 19 Jan 2018 |
| CVE-2017-12115 | An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. | High 8.1 | 19 Jan 2018 |
| CVE-2017-12117 | An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability. | High 8.1 | 19 Jan 2018 |