A bounty, in crypto and software, is a reward that a project promises to anyone who completes a defined task. The two main kinds are bug bounties, which pay security researchers for responsibly reporting vulnerabilities in code such as smart contracts, and marketing or community bounties, which pay people, usually in the project's own token, for promotion, translation, content or testing. Payment may be in stablecoins, native tokens or cash.
Bug bounties are part of a project's security programme alongside code audits and monitoring, and are common across the software industry, not only in crypto. Marketing bounties grew out of the 2017 ICO era, when projects handed out tokens for social-media activity. The two share a name but differ sharply in purpose, risk and regulatory treatment.
Bounty in plain terms
Think of a shop that pins two notices to its door. One says: "Find a broken lock on our back door and tell us before a burglar does, and we will pay you well." The other says: "Hand out our flyers around town and we will give you store vouchers."
A crypto bug bounty is the first notice. It pays honest experts to report weaknesses privately, so the project can fix them before thieves exploit them. A marketing bounty is the second notice. It pays people to spread the word, usually in the project's own tokens, which only have value if the project succeeds.
Bug bounties
Public bug bounty programmes date back to the 1990s, when Netscape offered rewards for flaws in its browser. In crypto they matter more than in most software because deployed smart contracts often hold large sums, are hard to change once live, and can be attacked by anyone. A single flaw can be used to drain funds within minutes; see hacking and flash loans, which attackers often use to fund exploits.
A typical programme sets out:
- Scope. Which contracts, websites and systems are covered.
- Severity levels. Rewards scale from low to critical, with critical bugs often capped at a fixed amount or a percentage of funds at risk.
- Rules. Researchers must report privately, must not exploit the bug beyond a proof of concept, and must give the project time to fix it (responsible disclosure).
- Payment terms. The asset paid, and any identity checks such as KYC or sanctions screening before payment.
Platforms such as Immunefi, founded in 2020, host programmes for many DeFi protocols and act as intermediaries. In 2022 the cross-chain bridge Wormhole paid a researcher a $10 million bounty, reported through Immunefi, for a critical vulnerability that was fixed before funds were lost; it was widely reported as one of the largest bug bounties paid. Cross-chain bridges are frequent targets because they lock up large balances. Ethereum's core protocol also runs its own bug bounty programme.
Post-hack bounties
After an exploit, projects sometimes publicly offer the attacker a bounty, often a percentage of the stolen funds, if the rest is returned within a deadline. The offer is usually sent as an on-chain message to the attacker's wallet address. Such deals have recovered funds in some cases, but critics argue they reward theft, and returning funds does not by itself settle possible criminal liability. Investigators also use blockchain analytics to trace stolen funds, including through mixers.
Marketing and community bounties
Marketing bounties reward tasks such as posting about a project, joining chat groups, writing articles, translating a whitepaper, or reporting problems on a testnet. In the ICO era, bounty campaigns were often run on public forums, with a fixed share of the token supply set aside and split among participants according to points. Related practices include airdrops, which distribute tokens to wallets with little or no task required, and places on a whitelist awarded for community activity.
These campaigns raise several concerns:
- Paid promotion. Participants may promote a token without disclosing they are paid, which overlaps with shilling and can mislead buyers.
- Securities rules. In August 2018 the US Securities and Exchange Commission found that Tomahawk Exploration's "bounty program", which gave tokens for promotion, was an offer of securities even though no cash changed hands.
- Value. Rewards paid in a new project's own tokens may be worth little if the token never gains liquidity or collapses after launch.
- Fake campaigns. Scammers advertise bounties or airdrops to collect personal data or trick people into signing malicious transactions; see identifying crypto scams.