BugHunters — Bug Bounty Platform
    Back to Programs
    Ethereum Foundation

    Ethereum Foundation

    Crypto/DeFi

    Non-profit supporting the Ethereum network — the world's leading smart contract platform with $60B+ in DeFi TVL.

    https://ethereum.org

    Max Reward

    $500,000

    Total Paid

    $3,600,000

    Resolved

    134

    Avg Response

    5 days

    In-Scope Assets

    Consensus Layer

    Beacon chain, validators, and attestations

    Execution Layer

    EVM, state management, and transaction processing

    Solidity Compiler

    Solidity compiler and language features

    ethereum.org

    Documentation website and developer tools

    Out of Scope

    • ✕ Third-party dApps
    • ✕ L2 solutions
    • ✕ ENS (separate program)

    Severity Levels & Rewards

    Critical

    RCE, authentication bypass, privilege escalation, fund extraction

    High

    Stored XSS, CSRF with impact, API abuse, data manipulation

    Medium

    Reflected XSS, data leakage, logic flaws, information disclosure

    Low

    Verbose errors, minor config issues, low-impact info disclosure

    Active Bounties (1)

    IDTitleSeverityStatusRewardSubmissions
    ETH-001Consensus layer attestation forging via BLS signature malleability
    Critical
    Open
    		$100,000–$500,0000

    Rules of Engagement

    • Do not access, modify, or delete data belonging to other users.

    • Do not perform denial-of-service attacks or automated scanning at high volume.

    • Report vulnerabilities promptly and provide sufficient detail to reproduce.

    • Allow reasonable time for fix before public disclosure (90 days).

    • Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.