- Top reward
- $30,000
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 2
- Last change
At a glance
What to know before you start testing.
- Pays up to $30,000
- for critical bugs, from $50.
- Report on Immunefi
- Submit through the program page.
- Payment
- Proof of identity needed to get paid.
Rewards
What Immunefi lists as the payout for each severity.
| Severity | Applies to | Relative size | Reward |
|---|---|---|---|
| Critical Blockchain | Blockchain |
|
$30,000 10% of funds at risk · from $10,000 |
| High Blockchain | Blockchain |
|
$10,000 from $3,000 |
| Medium Blockchain | Blockchain |
|
$3,000 |
| Low Web | Web |
|
$100 from $50 |
Scope
8 assets you may test.
Source code 8
- https://github.com/has...edera-transaction-tool
- https://github.com/hiero-ledger/hiero-consensus-node
- https://github.com/hiero-ledger/hiero-cryptography
- https://github.com/hiero-ledger/hiero-json-rpc-relay
- https://github.com/hiero-ledger/hiero-mirror-node
- https://github.com/hiero-ledger/hiero-sdk-go
- https://github.com/hiero-ledger/hiero-sdk-java
- https://github.com/hiero-ledger/hiero-sdk-js
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Added: “If a bug is exploitable on mainnet but a feature flag is in place that nullifies it from being exploitable, it may be downgraded by at least one severity level,...”
-
Rules updated
Added: “For critical Blockchain/DLT bug reports with the impact “Direct theft of funds” and “Unintended permanent freezing of fund", the reward amount is 10% of the fun...”
-
Scope removed
https://github.com/hashgraph/hedera-transaction-tool
-
Scope added
https://github.com/has...edera-transaction-tool
-
Scope added
https://github.com/hiero-ledger/hiero-json-rpc-relay
-
Scope added
https://github.com/hiero-ledger/hiero-mirror-node
-
Scope added
https://github.com/hiero-ledger/hiero-sdk-swift
-
Scope added
https://github.com/hiero-ledger/hiero-consensus-node
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-45248 | Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registere | Medium 6.9 | 14 May 2026 |
| CVE-2026-39911 | Hashgraph Guardian through version 3.5.1, fixed in commit 45fbe2f, contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker that allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaScript expressions directly to the Node.js Function() constructor without isolation. Attackers can import native Node.js modules | High 8.7 | 9 Apr 2026 |