SP1
By Succinct Bug bounty on Immunefi succinct.xyz
- Top reward
- $15,000
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 1
- Last change
At a glance
What to know before you start testing.
- Pays up to $15,000
- for critical bugs, from $1,000.
- Report on Immunefi
- Submit through the program page.
- Payment
- No identity check to get paid.
Rewards
What Immunefi lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$15,000 from $5,000 |
| High |
|
$5,000 from $2,000 |
| Medium |
|
$2,000 from $1,000 |
Scope
8 assets you may test.
Source code 8
- https://github.com/succinctlabs/sp1/blob/main/crates/prover/src/verify.rs
- https://github.com/succinctlabs/sp1/tree/main/crates/core/executor
- https://github.com/succinctlabs/sp1/tree/main/crates/core/machine
- https://github.com/succinctlabs/sp1/tree/main/crates/hypercube
- https://github.com/succinctlabs/sp1/tree/main/crates/recursion
- https://github.com/succinctlabs/sp1/tree/main/crates/zkvm/entrypoint
- https://github.com/succinctlabs/sp1/tree/main/crates/zkvm/lib
- https://github.com/succinctlabs/sp1/tree/main/slop/crates/
Changes
Tracked since 11 Nov 2026. Last checked 55 minutes ago.
-
Cut
Top reward $100,000 to $15,000.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Added: “For Critical, High, and Medium findings, the reward within the stated range is determined by the demonstrated technical impact, the breadth of affected programs...”
-
Reward terms
The reward table or payout terms were edited
-
Rules updated
Added: “For High and Medium findings, the reward within the stated range is determined by the demonstrated technical impact, the breadth of affected programs and execut...”
-
Reward cut
Maximum $100,000 → $15,000
-
Rules updated
Added: “A bug bounty submission for a soundness vulnerability must include an end-to-end PoC demonstrating that the production verifier accepts a false claim about the...”
-
Rules updated
Added: “…es or paths intended solely for `experimental`, `mprotect`, `may_dump_elf`, debug, profiling, dummy, testing, benchmarking, or in-development circuits are out...”
-
Rules updated
Added: “…rces, concurrency, timeouts, environment variables, or user configuration are out of scope.”
-
Rules updated
Added: “The severity of a soundness or completeness finding may change due to the impact and scope of the finding, i.e. which types of programs are affected, and what t...”
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-40323 | SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue. | High 8.9 | 18 Apr 2026 |