GlossaryBeginner
Bug Bounty
A program that rewards independent security researchers for responsibly disclosing a vulnerability before it can be exploited maliciously.
A bug bounty program offers a financial reward to independent security researchers who discover and responsibly disclose a vulnerability directly to the project, rather than exploiting it or disclosing it publicly before it can be fixed.
Bug bounties are a complementary practice to formal smart contract audits (see Kaavon's "How to Evaluate a Smart Contract Audit" guide), since they extend scrutiny to a much broader, ongoing pool of independent researchers beyond whatever a single audit firm's team happened to review.
Examples
- A well-funded bug bounty program can offer a researcher a reward large enough to make responsible disclosure clearly more attractive than attempting to exploit the bug.
- Bug bounties extend a protocol's security scrutiny beyond a single audit, drawing on an ongoing, much broader pool of independent researchers.