Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

RootstockLabs

Bug bounty on Immunefi rootstocklabs.com

Accepting reports KYC to get paid Rootstock web3
Go to program Website
Top reward
$200,000
Top severity paid
Critical
Assets in scope
15
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $200,000
for critical bugs, from $1,000.
Report on Immunefi
Submit through the program page.
Payment
Proof of identity needed to get paid.

Rewards

What Immunefi lists as the payout for each severity.

Severity Reward
Critical Blockchain $200,000 10% of funds at risk · from $10,000
Critical Web $10,000 from $5,000
Critical Contract $100,000 10% of funds at risk · from $10,000
High Blockchain $10,000 from $5,000
High Web $2,500
High Contract $10,000 from $5,000
Medium Web $1,500
Medium Blockchain $5,000 from $2,500
Medium Contract $2,500
Low Web $1,000
Low Contract $1,000
Low Blockchain $2,500 from $1,000

Scope

15 assets you may test.

Smart contracts 9

  • https://rootstock.blockscout.com/address/0x9270733402dc7c5730ea24268fc11039fd75e189
  • https://rootstock.blockscout.com/address/0x9a0678742cfb567874eb4e99df2106bded78f5e4
  • https://rootstock.blockscout.com/address/0x9a48c6b18aa000d0bd35d55616bcc98ad3553e7a
  • https://rootstock.blockscout.com/address/0xAAFF2c6D3185ccd03d9781e689005c314b936AC1?tab=contract
  • https://rootstock.blockscout.com/address/0xB0824559dF4a0872A61b228466bAd12E733f7dEC
  • https://rootstock.blockscout.com/address/0xb2c65bbf276cc5ccae73c0ab29b609a129080639
  • https://rootstock.blockscout.com/address/0xbe4d93b3afd9921cac66704ffd3caf662886fb73
  • https://rootstock.blockscout.com/address/0xd8D956312222d8acaBB58569cc960a93b1aa2f7a
  • https://rootstock.blockscout.com/token/0x2aCc95758f8b5F583470bA265Eb685a8f45fC9D5

Source code 6

  • https://github.com/rsksmart/bridges-core-sdk
  • https://github.com/rsksmart/flyover-sdk
  • https://github.com/rsksmart/liquidity-provider-server
  • https://github.com/rsksmart/powpeg-node
  • https://github.com/rsksmart/rskj
  • https://github.com/rsksmart/rsk-powhsm/releases/latest

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Reward terms

    The reward table or payout terms were edited

  2. Scope removed

    https://github.com/rsksmart/2wp-api

  3. Scope removed

    https://github.com/rsksmart/2wp-app

  4. Reward terms

    The reward table or payout terms were edited

  5. Status

    Program status changed

  6. Reward terms

    The reward table or payout terms were edited

  7. Status

    Program status changed

  8. Reward terms

    The reward table or payout terms were edited

  9. Reward terms

    The reward table or payout terms were edited

  10. Rules updated

    Added: “… funds", the word "significant" here is defined as **USD 100,000** or more. Therefore, any report where the theft is below USD 100,000 may be downgraded or con...”

  11. Rules updated

    Added: “For the Critical impact "Direct loss of significant non recoverable funds", the word "significant" here is defined as **USD 100 000** or more. Therefore, any re...”

  12. Rules updated

    The program rules were edited

  13. Scope added

    https://rootstock.blockscout.com/token/0x2aCc95758f8b5F583470bA265Eb685a8f45fC9D5

  14. Scope removed

    https://rootstock.blockscout.com/address/0xAa9caf1e3967600578727f975F283446a3dA6612

  15. Scope added

    https://rootstock.blockscout.com/address/0xb2c65bbf276cc5ccae73c0ab29b609a129080639

  16. Scope added

    https://rootstock.blockscout.com/address/0xB0824559dF4a0872A61b228466bAd12E733f7dEC

  17. Scope added

    https://rootstock.blockscout.com/address/0xd8D956312222d8acaBB58569cc960a93b1aa2f7a

  18. Scope added

    https://rootstock.blockscout.com/address/0xAAFF2c6D3185ccd03d9781e689005c314b936AC1?tab=contract

  19. Scope added

    https://rootstock.blockscout.com/address/0x9a48c6b18aa000d0bd35d55616bcc98ad3553e7a

  20. Scope added

    https://rootstock.blockscout.com/address/0xbe4d93b3afd9921cac66704ffd3caf662886fb73

  21. Scope added

    https://rootstock.blockscout.com/address/0x9a0678742cfb567874eb4e99df2106bded78f5e4

  22. Scope added

    https://rootstock.blockscout.com/address/0x9270733402dc7c5730ea24268fc11039fd75e189

  23. Scope added

    https://github.com/rsksmart/liquidity-provider-server

  24. Scope added

    https://github.com/rsksmart/flyover-sdk

  25. Scope added

    https://github.com/rsksmart/bridges-core-sdk

  26. Scope added

    https://github.com/rsksmart/rsk-powhsm/releases/latest

  27. Scope added

    https://github.com/rsksmart/rskj

  28. Scope added

    https://github.com/rsksmart/powpeg-node

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.