Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Ostium

Bug bounty on Immunefi ostium.com

Accepting reports KYC to get paid Arbitrum DEX Defi
Go to program Website
Top reward
$200,000
Top severity paid
Critical
Assets in scope
17
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $200,000
for critical bugs, from $500.
Report on Immunefi
Submit through the program page.
Payment
Proof of identity needed to get paid.

Rewards

What Immunefi lists as the payout for each severity.

Severity Reward
Critical Web $25,000 from $2,500
Critical Contract $200,000 10% of funds at risk · from $20,000
High Web $1,250
High Contract $50,000 from $10,000
Medium Web $500
Medium Contract $5,000
Low Contract $1,000

Scope

17 assets you may test.

Smart contracts 16

  • https://arbiscan.io/address/0x083F97BabF33D4abC03151B5DEc98170761f4025
  • https://arbiscan.io/address/0x20D419a8e12C45f88fDA7c5760bb6923Cee27F98
  • https://arbiscan.io/address/0x260E349F643f12797fDc6f8c9d3df211D5577823
  • https://arbiscan.io/address/0x3890243a8fc091c626ed26c087a028b46bc9d66c
  • https://arbiscan.io/address/0x52453FBC4A33F7A2A0a01d67B952625816f161b4
  • https://arbiscan.io/address/0x52B2a78E12b09B66C6c8ce291D653D40bAb77f0c
  • https://arbiscan.io/address/0x6D0bA1f9996DBD8885827e1b2e8f6593e7702411
  • https://arbiscan.io/address/0x7720fC8c8680bF4a1Af99d44c6c265a74e9742a9
  • https://arbiscan.io/address/0x799a139aE56e11F0476aCE2f6118CfcAed9608d2
  • https://arbiscan.io/address/0x959Da1452238F71F17f7DA5dbA2e9c04FEf57324
  • https://arbiscan.io/address/0xb4f1123BE58f5d69E1cf565ED8756C7fcf31c8D3
  • https://arbiscan.io/address/0xB71ec9eBD8145daCaCF6724363143cb5667A3d36
  • https://arbiscan.io/address/0xccd5891083a8acd2074690f65d3024e7d13d66e7
  • https://arbiscan.io/address/0xd456939e54F68Ef9B0BE62aBB2EC4A37397Cb814
  • https://arbiscan.io/address/0xE607aC9FF58697c5978AfA1Fc1C5C437a6D1858c
  • https://arbiscan.io/address/0xeB85dC6095c74D36500C9cdcaCc15EcDC223Bbf7

Domains 1

  • ostium.app

Changes

Tracked since 11 Nov 2026. Last checked 22 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Reward raised

    Maximum $200,000 → $200,000

  2. Rules updated

    Added: “All other impacts that would be classified as Critical would be rewarded a flat amount of $2,500. The rest of the severity levels are paid out according to the...”

  3. Reward terms

    The reward table or payout terms were edited

  4. Scope removed

    https://t.me/ostiumbot

  5. Rules updated

    The program rules were edited

  6. Scope removed

    https://arbiscan.io/address/0xb4f1123BE58f5d69E1cf565ED8756C7fcf31c8D3

  7. Scope removed

    https://arbiscan.io/address/0x7720fC8c8680bF4a1Af99d44c6c265a74e9742a9

  8. Scope removed

    https://arbiscan.io/address/0x20D419a8e12C45f88fDA7c5760bb6923Cee27F98

  9. Scope removed

    https://arbiscan.io/address/0xd456939e54F68Ef9B0BE62aBB2EC4A37397Cb814

  10. Scope removed

    https://arbiscan.io/address/0x3890243a8fc091c626ed26c087a028b46bc9d66c

  11. Scope removed

    https://arbiscan.io/address/0x260E349F643f12797fDc6f8c9d3df211D5577823

  12. Scope removed

    https://arbiscan.io/address/0x6D0bA1f9996DBD8885827e1b2e8f6593e7702411

  13. Scope removed

    https://arbiscan.io/address/0x959Da1452238F71F17f7DA5dbA2e9c04FEf57324

  14. Scope removed

    https://arbiscan.io/address/0x083F97BabF33D4abC03151B5DEc98170761f4025

  15. Scope removed

    https://arbiscan.io/address/0x52453FBC4A33F7A2A0a01d67B952625816f161b4

  16. Scope removed

    https://arbiscan.io/address/0xE607aC9FF58697c5978AfA1Fc1C5C437a6D1858c

  17. Scope removed

    https://arbiscan.io/address/0x52B2a78E12b09B66C6c8ce291D653D40bAb77f0c

  18. Scope removed

    https://arbiscan.io/address/0x799a139aE56e11F0476aCE2f6118CfcAed9608d2

  19. Scope removed

    https://arbiscan.io/address/0xB71ec9eBD8145daCaCF6724363143cb5667A3d36

  20. Scope removed

    https://arbiscan.io/address/0xeB85dC6095c74D36500C9cdcaCc15EcDC223Bbf7

  21. Scope removed

    https://arbiscan.io/address/0xccd5891083a8acd2074690f65d3024e7d13d66e7

  22. Scope added

    https://ostium.app/

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.