Bug Bounty

A bug bounty is a programme in which a company, project or government agency offers rewards to independent security researchers who find and responsibly report vulnerabilities in its software, websites or systems. Rewards are usually cash payments scaled to the severity of the flaw, and they may also include public recognition. The aim is to find and fix weaknesses before criminals exploit them, by drawing on a large pool of outside talent.

Bug bounties are now common across technology, banking and payments, and they are especially prominent in crypto and decentralized finance, where a single bug in a smart contract can expose hundreds of millions of dollars. They complement, rather than replace, internal security teams, code audits and penetration tests. Researchers who take part are often called white hat hackers, in contrast to the black hat hackers who exploit flaws for gain.

Imagine a bank offering a reward to anyone who can find a weakness in its vault, on condition that they tell the bank first rather than stealing anything. Locksmiths and curious experts around the world start examining the vault. Most find nothing, but occasionally someone spots a loose bolt, reports it, collects the reward, and the bank fixes it before a burglar notices.

A bug bounty does the same for software. Rather than waiting for criminals to find flaws, the organisation pays honest experts to look for them and report them privately. The reward has to be large enough that reporting the problem is more attractive than abusing it.

A typical programme sets out:

• Scope. Which systems, apps, contracts or domains may be tested, and which are off-limits.
• Rules of engagement. What testing methods are allowed, such as no attacks that disrupt service or touch real customers' data.
• Severity levels. A scale, often from low to critical, linked to reward ranges.
• Disclosure policy. How and when findings can be made public, usually only after a fix.
• Safe harbour. A promise not to take legal action against researchers who follow the rules.

Researchers submit reports, the organisation verifies and fixes the issue, and the reward is paid. Rewards typically range from a few hundred dollars for minor issues to large sums for critical flaws that could expose personal data or customer funds. Many programmes are run through platforms such as HackerOne and Bugcrowd for general technology, or Immunefi, which specialises in crypto. Some are private and open only to invited researchers, while others are public.

Netscape is widely credited with launching one of the first bug bounty programmes in 1995, offering rewards for flaws in its web browser. Large technology firms followed, with Google, Facebook and Microsoft introducing programmes in the 2010s, and the US Department of Defense ran its "Hack the Pentagon" programme in 2016. Platforms that connect organisations with researchers emerged in the early 2010s. In crypto, the Ethereum Foundation and Bitcoin-related projects have run bounties for years, covering client software, wallet tools and core protocol code, and Immunefi, founded in 2020, became the main venue for DeFi protocols. Banks and payment companies increasingly run their own programmes as part of cybersecurity risk management.

Crypto bounties are often very large because the stakes are high and stolen funds are hard to recover. Critical vulnerabilities in DeFi protocols can earn rewards in the millions of dollars. In 2022, the bridge protocol Wormhole paid a researcher $10 million for reporting a critical flaw, among the largest bounties ever paid. Some protocols set rewards as a percentage of the funds at risk. A related practice has emerged after attacks: projects sometimes offer an attacker a "bounty" of a share of stolen funds, often around 10%, in exchange for returning the rest, hoping to recover assets quickly. Such deals are controversial, since they can reward criminal behaviour, and they do not necessarily protect the attacker from prosecution. Bounties are part of the security picture alongside audits, monitoring and protections against bug exploits.

Bug bounties give organisations access to many skilled testers, pay only for results, and encourage a culture of responsible disclosure. They also have limits:

• Coverage. Researchers focus on what pays and what is in scope, so some areas may receive little attention.
• Noise. Programmes can receive many low-quality or duplicate reports that take time to review.
• Incentive gaps. If the reward is far smaller than what a flaw could earn on the black market or through exploitation, some finders may choose crime.
• Legal uncertainty. In some jurisdictions, testing without clear authorisation can breach computer misuse laws, which is why safe harbour language matters.
• Not a substitute. Bounties do not replace secure design, code review, audits and operational risk controls.

Financial institutions that run bounties typically integrate them with incident response, vulnerability management and regulatory reporting, and many regulators now encourage coordinated vulnerability disclosure policies as part of risk management. For users, a project's bounty programme is a positive sign but not a guarantee of safety, and data security practices still matter.