Filecoin
Bug bounty on Immunefi filecoin.io
- Top reward
- $50,000
- Top severity paid
- Critical
- Assets in scope
- 29
- Public CVEs
- 3
- Last change
At a glance
What to know before you start testing.
- Pays up to $50,000
- for critical bugs, from $1,000.
- Report on Immunefi
- Submit through the program page.
- Payment
- Proof of identity needed to get paid.
Rewards
What Immunefi lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$50,000 10% of funds at risk · from $25,000 |
| High |
|
$25,000 from $7,500 |
| Medium |
|
$7,500 from $2,000 |
| Low |
|
$2,000 from $1,000 |
Scope
29 assets you may test.
Source code 29
- https://github.com/filecoin-project/bellperson
- https://github.com/filecoin-project/boost
- https://github.com/filecoin-project/builtin-actors
- https://github.com/filecoin-project/go-address
- https://github.com/filecoin-project/go-amt-ipld
- https://github.com/filecoin-project/go-bitfield
- https://github.com/filecoin-project/go-cbor-util
- https://github.com/filecoin-project/go-crypto
- https://github.com/filecoin-project/go-data-transfer
- https://github.com/filecoin-project/go-f3
- https://github.com/filecoin-project/go-fil-commcid
- https://github.com/filecoin-project/go-padreader
- https://github.com/filecoin-project/go-sectorbuilder
- https://github.com/filecoin-project/go-statemachine
- https://github.com/filecoin-project/go-statestore
- https://github.com/filecoin-project/lotus
- https://github.com/filecoin-project/lotus/tree/master/miner
- https://github.com/filecoin-project/merkletree
- https://github.com/filecoin-project/paired
- https://github.com/filecoin-project/ref-fvm
- https://github.com/filecoin-project/rust-filecoin-proofs-api
- https://github.com/filecoin-project/rust-fil-proofs
- https://github.com/filecoin-project/rust-fil-proofs-ffi
- https://github.com/ipfs/go-graphsync
- https://github.com/ipfs/go-hamt-ipld
- https://github.com/ipfs/go-ipld-cbor
- https://github.com/lurk-lab/neptune
- https://github.com/lurk-lab/neptune-triton
- https://github.com/whyrusleeping/cbor-gen
Changes
Tracked since 11 Nov 2026. Last checked 35 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Reward terms
The reward table or payout terms were edited
-
Reward terms
The reward table or payout terms were edited
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-59941 | go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same | Medium 5.9 | 29 Sep 2025 |
| CVE-2025-59942 | go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bu | High 7.5 | 29 Sep 2025 |
| CVE-2021-21405 | Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms: "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays. Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are conside | Medium 5.9 | 15 Apr 2021 |