At Immunefi, we’re in the business of creating revolutionary new security standards. Today, we’re proud to announce the launch of Immunefi Arbitration, the world’s first legally binding dispute resolution system for bug bounties.

Through Immunefi Arbitration, our bug bounty programs can now provide a fair, fast, cost-efficient, and globally enforceable path to resolve disputes over the most important vulnerabilities, making responsible disclosure and bug hunting safer for security researchers and projects alike.

Assurances of being a good faith actor is the future of web3 security.

Why Is Arbitration Needed?

Bug bounties play a vital role in securing the onchain economy. However, disagreements about the validity, severity, or payment of a bug report can create serious friction between security researchers and projects. Immunefi mediation has been honed over years to resolve the overwhelming majority of bug bounty disputes, but it’s impossible to resolve all cases.

In the past, these disputes have dragged on without clear resolution, often harming both sides. Immunefi Arbitration changes this by offering a neutral, legally enforceable path forward when mediation isn’t enough.

To do this, we’ve partnered with the London Chamber of Arbitration and Mediation (LCAM), which provides globally enforceable rulings in 172 countries. This sets a new standard for transparency and accountability in the onchain security ecosystem.

Dozens of projects have already signed up for Immunefi Arbitration and received Arbitration badges, which are now visible on the Explore page of our website.

Arbitration Benefits

Arbitration offers important benefits to both projects and whitehats that haven’t been possible up until now.

Projects want the best eyes on their code. Having a whitehat spend time on a project’s code could be the difference between the life or death of that project. That’s how serious vulnerabilities can be in web3. We all know what real critical impact looks like, and we’ve seen countless disastrous cases in the news of exploits that could have been prevented.

With Arbitration, projects now have the most credible way possible to get the best eyes on code via the ironclad trust assurance of Arbitration, thereby signaling to all whitehats that your project is best-in-class for security.

Projects who opt-in to Arbitration will receive an Arbitration badge, and their program will be well-ranked on the Immunefi Explore page. They will be consistently promoted as projects with the highest degree of security standards in the industry. We’re confident with that assessment, as Arbitration is neutral, third-party, independent, and much cheaper and faster than traditional courts.

Arbitration is also the best way for whitehats to get a final determination on their report from a neutral and independent party in the rare case where mediation does not resolve the dispute. As mentioned, this ruling, whether in favor of the project or in favor of the whitehat, is legally binding. Whitehats are also able to request Arbitration pseudonymously in the event that they have concerns about disclosing their identity.

How Arbitration Works on Immunefi

If a dispute can’t be resolved through Immunefi’s mediation process, either party — the security researcher or the project — can turn to Arbitration. Arbitration is strictly opt-in for projects, but we encourage all projects to adopt it. If you’re interested in Arbitration as a project, contact your Immunefi account manager.

Here’s a quick overview of how it works:

1. Mediation First

The process starts with an attempt to resolve the issue through mediation. Immunefi offers a non-binding resolution to help the parties come to an agreement. Mediation is much quicker and less intensive than Arbitration, so we always recommend starting here.

2. Initiating Arbitration

If mediation fails, and the project is Arbitration-enabled, then either party can request Arbitration after Immunefi’s mediation recommendation. A top-tier arbitrator from the LCAM will be appointed to review the case. LCAM arbitrators have the option to appoint technical experts to assist with complex security cases, ensuring that the nuances of blockchain vulnerabilities are properly understood.

To begin Arbitration, the requesting party must pay Arbitration fees. The fees for both parties are neither too high, nor too low. A traditional court case can cost hundreds of thousands of dollars and take years to resolve. To get Arbitration started, the floor price is £7,500 (for claims up to £1,000,000) because a neutral, third-party decision from a world-class Arbitration that is legally enforceable does cost money. But another very important reason for this floor price is so that Arbitration is not invoked frivolously and is only used when one party strongly believes in their case. And if a large bounty reward is potentially at stake, then the cost is very justifiable.

You can read more about the fees in the Help Center article for Arbitration.

3. Legally Binding Decisions

The arbitrator reviews the case and issues a decision that is enforceable in 172 countries through the New York Arbitration Convention. This ensures that no matter where you are, the Arbitration decision has real legal weight.

4. Fair Resolution

If the arbitrator rules in favor of the security researcher, the project is obligated to pay the award. If the project has enough collateral in its Immunefi vault, then payment is as simple as the project initiating a transfer from the vault to the security researcher. If not, additional collateral must be added, or else the security researcher can pursue other measures to enforce the ruling.

Immunefi Arbitration: Legal Rigor Meets Blockchain Security

Partnering with LCAM means that Immunefi Arbitration brings the rigor of traditional legal processes into the fast-moving world of blockchain security.

Arbitration typically takes weeks or months — a fraction of the time of traditional court proceedings — helping projects and security researchers alike move past disputes and focus on what matters: securing the ecosystem.

Immunefi Arbitration is available for all projects that opt in. Security researchers can submit reports to these projects with confidence, knowing there’s a clear, enforceable path to resolution if needed.

In a world where blockchain security is critical, Immunefi is proud to introduce this essential layer of protection.

Learn more about how Immunefi Arbitration works in our Help Center article on Arbitration.

Immunefi Arbitration: A New Era for Onchain Dispute Resolution was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

We’re excited to announce the launch of Immunefi Profiles v1!

Immunefi profiles showcase your achievements to the world, such as vulnerabilities you’ve reported, your earnings, the badges and awards you’ve earned, and your rank on the Immunefi Leaderboard.

If you already have a paid report on Immunefi, you can log into the Dashboard and set up your profile here.

Profiles V1 will be available to any whitehat with at least one paid report on Immunefi. In future releases, our entire community of security researchers will have access to profiles, as well as a host of new features. One of the new features you can look forward to is a Contribution Feed which will display your reports over time so you can track your impact.

The launch of Profiles is the perfect opportunity to showcase the great work that you’ve done — and the huge rewards you’ve earned along the way. Your profile will display the Immunefi badges you’ve earned.

There are currently six available:

• One Of Us: When you complete your Immunefi profile (including all social links).
• Bought The BMW: When you’ve earned more than $100,000.
• There’s Grass Outside, You Know…: When you’ve earned more than $1,000,000.
• Friends In High Places: When you’ve linked to your Immunefi profile from your Twitter bio (may take up to 24 hours to show, but usually read in 10 minutes).
• High Five: When you’ve received five bounties on Immunefi.
• Rocketman: When you receive a valid bounty from a Boost.

In V2 of our profiles, we will release more badges, Boost cards, and achievements, so watch this space!

Immunefi is home to the largest community of security talent in Web3, with more than 45,000 whitehats hunting on our platform. Our security researchers are helping protect more than $190B in assets, and have averted $25B+ in losses. In return, Immunefi has paid over $100m in rewards to whitehats — more than any other platform in the history of Web3.

Our profiles are the next step in the evolution of this vibrant, talented, and growing community of security professionals.

If you already have a paid report on Immunefi, you can log into the Dashboard and set up your profile here.

Otherwise, be sure to follow us on Twitter and join our Discord — and get hunting on Immunefi!

Introducing Immunefi Profiles V1: Showcasing the Best Security Talent in the World was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

Summary

A critical vulnerability was identified and reported by whitehat @riproprip in the Raydium protocol on January 10, 2024.

This vulnerability, found in the increase_liquidity.rs function allowed an attacker to exploit the liquidity management functionality of the automated market maker (AMM) to drain funds from liquidity pools.

A bounty of $505,000 in RAY tokens was awarded to the whitehat for this discovery. Raydium, an AMM built on the Solana blockchain, quickly addressed and resolved the issue.

What is Raydium?

Raydium is an AMM with an integrated central order book system, currently in its V3 iteration. Users can provide liquidity, perform swaps on the exchange, and stake the RAY token for additional yield.

A fundamental aspect of Raydium is the Concentrated Liquidity Market Maker (CLMM).

Concentrated Liquidity Market Maker (CLMM)

Concentrated Liquidity Market Maker (CLMM) pools offer a more efficient way for liquidity providers to manage their capital.

Unlike traditional Automated Market Maker (AMM) pools, where liquidity is distributed along a broad price curve from 0 to ∞, CLMM pools allow providers to concentrate their liquidity within a specific price range.

Traditional AMMs work by putting a pair of tokens together to automatically set a price for trades. This method requires a large amount of tokens on both sides to maintain a stable price, which can lead to issues like high slippage and volatile prices due to limited liquidity.

CLMMs enhance liquidity efficiency by setting a specific price range for a pool to be in an “active” state. This allows a much smaller liquidity pool to provide the same low slippage trades as a much larger AMM pool. By concentrating liquidity within a targeted price range, CLMMs minimize the amount of capital required while maintaining stable prices and reducing slippage.

How Does CLMM Work?

In a CLMM setup, liquidity providers can choose a price range where their liquidity is active. This means they can focus their resources where they believe the most trading activity will occur, rather than spreading it thin across all possible prices.

To see CLMM in action, let’s look at Uniswap V3 as an example. In this system, liquidity providers can define a price range for their contributions. For instance, if an LP believes that the price of ETH will stay between $2,000 and $3,000, they can choose to concentrate their liquidity within this range.

• When traders operate within this range, the LP’s capital is used more intensively, earning them higher fees.
• If the price moves outside of this range, their liquidity is no longer active, prompting them to adjust their position as needed.

This is both a more efficient use of capital for liquidity providers and leads to potentially better prices and deeper liquidity for the market to execute large trades with less impact on the price.

Vulnerability Analysis

The vulnerability was located within the increase_liquidity function of the Raydium protocol. This function is essential for adding liquidity to a position within a liquidity pool.

It conducts several critical operations, including pool status validation, token amount calculations based on user-provided maximums, fee updates, and the actual increase of liquidity in the position’s state.

What are Ticks?

Ticks represent discrete price points in a CLMM. Each tick corresponds to a specific price level, and the space between ticks represents the smallest possible price movement in the pool. By defining a range with tick_lower and tick_upper, an LP specifies the boundaries within which their liquidity will be active.

• tick_lower: This is the lower boundary of the price range where the LP’s liquidity will be active. It represents the lowest price point at which the LP is willing to provide liquidity.
• tick_upper: This is the upper boundary of the price range where the LP’s liquidity will be active. It represents the highest price point at which the LP is willing to provide liquidity.

The flaw was specifically in the conditional handling of the tickarray_bitmap_extension:

The tickarray_bitmap_extension plays a crucial role in managing the pool’s pricing at extreme boundaries (very high or low prices). It also acts as an extended index to manage a larger range of price ticks which helps track which ticks have been initialized (i.e., have non-zero liquidity) beyond the default capacity of the system.

The conditional logic decides whether an account from remaining_accounts is needed as part of the operation. This account is presumably related to handling the tick array bitmap extension. This function is designed to increase liquidity in a specific position within a liquidity pool using the remaining_accounts vector.

Here are a few details you should know about the remaining_accounts function:

• remaining_accounts is a vector that contains all accounts that were passed into the instruction but are not declared in the Accounts struct. This is useful when you want your function to handle a variable amount of accounts, e.g. when initializing a game with a variable number of players.
• While remaining_accounts provides significant flexibility, it also necessitates careful validation within the smart contract to ensure security. The contract must validate the accounts in remaining_accounts to confirm they are of the expected type and have the correct permissions for the intended operations.
• Please refer to the following documentation for more information on remaining_accounts: https://www.anchor-lang.com/docs/the-program-module#context

The vulnerability arises because the function fails to verify whether remaining_accounts[0] is the accurate TickArrayBitmapExtension account linked to the current state of the pool. This oversight permits an attacker to execute liquidity operations at arbitrary price boundaries as described in the vulnerability demonstration section below.

Normal Behavior

In normal operation, when a user adds liquidity:

1. The increase_liquidity function validates the current state of the pool and the price range specified by tick_lower and tick_upper.
2. It calculates the token amounts needed based on the user’s input and current pool state.
3. It updates the fee structure and increases the liquidity in the specified position.
4. If the price range specified requires the tickarray_bitmap_extension (because it is at an extreme boundary), the function uses an account from remaining_accounts to manage this extension properly.

Here is the code snippet for the increase_liquidity function:

Attack Behavior

Due to the bug, the function fails to verify whether remaining_accounts[0] is the accurate TickArrayBitmapExtension account linked to the current state of the pool.

This oversight permits an attacker to execute liquidity operations at arbitrary price boundaries.

Vulnerability Demonstration

The whitehat showed how to exploit the system by manipulating the tickarray_bitmap_extension. This allowed them to bypass the intended removal of liquidity at specific price points, known as ticks.

Steps of the Attack:

1. Create a Secondary Pool: The attacker sets up a secondary pool.
2. Target a Tick: They open a position at a specific tick they want to exploit in the primary pool.
3. Zero Out and Manipulate Liquidity: They reduce the liquidity at this tick to zero and then increase it in a way that incorrectly uses the tickarray_bitmap of the primary pool.

This manipulation lets the attacker “flip” a tick’s status in the bitmap.Transactions that should have adjusted liquidity at certain prices bypass these checks, allowing unauthorized liquidity increases.

To clarify the exploit process using a practical example, consider price points A, B, and C, with A < B < C and both A and B within the lower range of the bitmap_array.

The steps to exploit the vulnerability are as follows:

1. Identify a victim pool.

2. Execute a swap to shift the price to just above point A (A+1).

3. Create liquidity within the price range B to C.

4. Perform a swap across B without crossing C, which adds liquidity to the pool state due to the manipulated tickarray_bitmap.

5. Execute the described attack to switch the tickarray_bitmap status at B to DISABLED, allowing a swap at A+1 to skip over B without affecting liquidity.

6. Repeat the attack to re-enable the tickarray_bitmap at B.

7. Perform another swap over B without crossing C, effectively doubling the liquidity erroneously.

8. This process can be repeated as many times as desired to amass an excessive amount of liquidity.

9. Following this procedure, swaps directed towards C will yield disproportionately high amounts of Token A, indicating the vulnerability has been fully exploited.

10. If the goal is to acquire Token B, the process can be replicated at the higher end of the price spectrum.

The core issue is the ability to “flip” a tick’s status within the tickarray_bitmap, allowing liquidity to be added without proper checks. This leads to significant discrepancies in liquidity management and compromises the integrity of the liquidity pool.

Vulnerability Fix

The vulnerability was addressed by Raydium through a critical update, as documented in their GitHub commit:

Fix: fix for open position v2 with zero liquidity · raydium-io/raydium-clmm@83b5a47

The correction involved adding a security check to ensure the correct application of the tickarray_bitmap_extension:

This fix introduces a validation step to confirm that the remaining_accounts[0] is the correct TickArrayBitmapExtension account associated with the pool’s current state.

This ensures the proper handling of liquidity operations involving extreme price boundaries, thereby preventing the exploitation of this vulnerability in the future.

Acknowledgements

We would like to thank the whitehat @riproprip for doing an amazing job in responsibly disclosing such an important bug. Big props also to the Raydium team who quickly responded to the report and patched the issue.

This bugfix review was written by Immunefi triager, Arbaz Hussain.

If you’re a developer or a whitehat considering a lucrative bug-hunting career in web3 — this message is for you. With 10–100x the rewards commonly found in web2, your efforts will pay off exponentially by switching to web3.

Check out the Web3 Security Library, and start earning rewards on Immunefi — the leading bug bounty platform for web3 with the world’s biggest payouts.

Raydium Tick Manipulation Bugfix Review was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

You’ve heard about Immunefi’s new Boosts, Invite-Only programs, and Attackathons. But how much will you earn from bug hunting on them?

You’ve asked and we’ve answered with Immunefi’s V.1 Contest Rewards Calculator. This version, a simplification of the actual calculator, allows you to approximate the rewards you can earn by hunting on an Immunefi contest without the hassle of creating the whole dataset. Make a copy, play around with it, show us the potential ROI you can have!

Here’s a few examples based on the Fuel Attackathon and a 4 minute video guide through it.

Example #1: Many bugs found

Total reward pool = $1,000,000 USD

Example #2: Moderate bugs found

Total reward pool = $800,000 USD

Example #3: Few bugs found

Total reward pool = $500,000 USD

You might be surprised that when the rewards pool is smaller your per-bug rewards can still increase on scaling reward pools. This results from fewer bugs sharing what is still a huge reward pool. If you dig for deeper bugs, your ROI can grow even when the contest pool shrinks.

What insights can you discover about contest rewards?

What additional factors do you wish our calculator included?

We’ll be shouting out improved versions, upgrading this one, and giving swag packs to data wizards who develop better tools for predicting your contest ROI. A special thanks to Minato for his feedback and for sharing his alternate version that lets you factor in duplicates. Your swag pack is on its way, ser!

Now, what ROI could you earn from Immunefi’s audit contests?

Try out the rewards calculator on the Fuel Attackathon and see what sweet rewards could be yours.

Immunefi Contest Rewards Calculator was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

At Immunefi, we understand the need for last-line protection of your project.

That is why we are thrilled to announce the launch of Safe Harbor!

Safe Harbor is designed for projects that want to provide legal protection and financial rewards to whitehats who engage in good faith recovery efforts during an active blackhat exploit of their protocol. In these cases, having a framework for whitehats to intervene to save funds and return them to the project is preferable to facing potentially unbounded losses.

By integrating and strengthening the Safe Harbor framework from the Security Alliance— the most legally defensible and protective agreement available for whitehats and projects — Immunefi offers a secure implementation of Safe Harbor that seamlessly integrates with your existing bug bounty dashboard and enables asset recovery by our top-of-the-line security researcher community.

We believe in Safe Harbor. That’s why we’ve enabled it for Immunefi smart contracts, such as the Vaults System.

If you’re a project wanting to get Safe Harbor, register your interest here. Set up is quick and easy.

Unmatched Security with Trusted Immunefi Infrastructure

Immunefi’s Safe Harbor provides a credible and secure channel for whitehats to intervene and return funds to the project during an active blackhat exploit. By using Immunefi’s existing Vault system, Safe Harbor ensures that whitehats return funds into a clear, third-party-verified, project-controlled wallet every time. Additionally, Safe Harbor leverages our bug report disclosure dashboard, allowing projects to use the same emergency alert system they are already familiar with, without the need for additional infrastructure setup.

Legal Protections and Financial Incentives for Security Researchers

Security researchers are vital to protecting the blockchain ecosystem, especially during active exploits. Safe Harbor provides security researchers with the robust legal protections and financial incentives needed to ensure that their interventions will be appreciated, rewarded, and protected. This new offering was meticulously crafted with input from some of the world’s most cyber-sophisticated lawyers, firms, and security experts. It expressly forbids all malicious hacking activities, ensuring that only those acting responsibly to protect a project during an active exploit benefit from its powerful legal safeguards.

A New Standard in Blockchain Security

Immunefi has successfully driven the adoption of bug bounty standards where none previously existed, and we are poised to do the same for Safe Harbor. As the main provider of last-line-of-defense solutions for on-chain protocols under the most severe and demanding conditions, Immunefi’s Safe Harbor sets a new benchmark for security in the blockchain space.

By adopting Safe Harbor, projects gain a powerful new tool to protect assets against active blackhat exploits. This product is not just an addition to your security measures; it’s a crucial line of defense that ensures projects are supported by the best security community in the world.

With Safe Harbor, you can face the future with confidence, knowing that Immunefi has your back.

If you’re a project wanting to get Safe Harbor, register your interest here.

If you’re a whitehat looking for more information about Safe Harbor and how it works, you can read more here.

Introducing Safe Harbor: Your Last Line of Defense Against Active Exploits was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

How do you bughunt on a codebase with 100,000+ lines of code?

You’re not alone in wondering this. Many security researchers have said they felt overwhelmed when considering the Fuel Attackathon. For only 5 weeks, this is a lot of code to review. Would your ROI (return-on-investment for your time) even be worth it? With these intimidating questions in mind, some have simply opted-out of hunting on Fuel — missing out on the most profitable audit contest of the year, even for part-time Solidity-only auditors.

To understand the ROI of hunting on the Fuel Attackathon, you need to view it as several smaller contests bundled together. The hugeness of the codebase gives you more opportunities to find bugs and stability in your potential earnings no matter which part you pick to hunt on.

So, based on your time and skills where will you get the best ROI hunting on Fuel?

Let’s break down Fuel into its parts so you can choose your own adventure. Remember, focusing on one part will yield you the best earnings.

Fuel Network Breakdown

• Rust SDK: Rust toolkit for interacting with virtual machines and full nodes. Also known as fuel-rs and fuels. Don’t confuse fuels-core Rust crate with fuel-core Rust crate. The former is part of the Rust SDK, while the latter is a full node.
• Fuel Core: The full client node. As with many projects, it implements a network layer and interaction interfaces like JSON RPC and GraphQL on top of the full node utility software such as Indexer.
• FuelVM: Transactions in Fuel Network support the execution of smart contracts. The FuelVM executes contracts, scripts, and predicates in new ways. Pay special attention to predicates and how they can be debugged.
• Sway: A new virtual machine needs a new high-level programming language. The everyday tool for developers on the Fuel Network. To get acquainted with the new language, you can use the step-by-step guide, learn how Sway builds constructs often used in Solidity, reproduce examples of popular dApps, and read the accepted standards.
• Sway Libraries: Sway already has several libraries to simplify building for developers. Among them are standard libraries and misc libraries.
• TypeScript SDK: An equally important part of the ecosystem is the user interfaces. To build web applications, developers will use the TypeScript SDK, which every dApp needs and on which the Fuel browser wallet is built.
• Fuel Bridge: The number one dApp in the ecosystem and how users can transfer data across blockchains. It is an end-user application that utilizes all the features of the Fuel Network and EVM contracts written in Solidity.

Not all of the listed assets are included in the scope list. However, all of them are built on the basic elements of the protocol — Fuel Virtual machine, Sway Compiler, SDKs. Studying a specific part at a high-level will give you insights into which code snippets or core primitives will have vulnerabilities.

Where’s Your Best ROI?

Glancing at the table above, there were probably parts that you can’t hunt on. Maybe they’re too much of a commitment or require learning tech you’re not interested in. Cross those off your list. Your best ROI will come from focusing on the part(s) most suited to you.

“But how do I find all the bugs?”

You don’t, and this is a good thing.

A unique aspect of the Fuel Attackathon is that it’s impossible for any single person to find all the bugs. Your rewards will be more reliable, since across the codebase you’re more likely to find bugs that are more unique and have fewer duplicates. Unlike a standard Solidity DeFi audit contest in which every contest auditor will be finding the same bugs, Fuel’s Attackathon has a wider attack surface allowing everyone to find more unique bugs.

Your best ROI is where your skill, interest, and time available meet.

Choose Your Own Adventure

So where should you focus?

1. If you have less than a week full-time to spend:

A. Are you a Solidity dev?
Focus on the Bridge. Bridge bugs are disastrous, especially on the L1 side on Ethereum. This allows you to utilize your Solidity skills in combination with how Fuel Network works.

B. Do you specialize in web2 or web2.5?
Focus on the Wallet, Explorer, and Connector. There’s a large attack surface on the web2 aspects of blockchain projects which fewer security researchers know how to examine and exploit.

2. If you have a week or more:

A. Do you know a bit of Rust or want to learn it?

I. Focus on the VM. This large codebase has a relatively high chance of having a critical. EVM knowledge will help here to find a bug among the moving parts.

B. Do you know about Rust or the Solidity Compiler?

I. Focus on the Compiler. Rust knowledge is required, but this is the holy grail of finding a bug because of how critical compiler bugs are. Knowing about issues in Solidity will help, as Sway is a new language, which means it may have similar issues.

3. What about the other parts?

The ultimate strategy when bughunting is to focus on what you’re interested in the most. The Client Node, Sway Libraries, SDKs, and other parts have bugs for those with the interest in understanding and breaking them. So while the VM, Compiler, and Bridge are the critical areas to focus on, this means there’ll be less competition for those who choose to hunt on these other parts.

Armed with this breakdown, where will you hunt on the Fuel Attackathon?

Start hunting on Fuel today.

Where You’ll Get the Best ROI Bughunting on Fuel’s $1.3 Million Attackathon was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

At Immunefi, our commitment to security is unwavering. In our quest to fortify the digital landscape against vulnerabilities, we’re thrilled to announce the launch of Invite-Only Programs powered by Hacker Sync!

With an Invite-Only Program, our clients gain access to a pool of top-tier blockchain security talent that has been meticulously selected to match their program’s unique requirements. Whether it’s skills, experience, or tech stack knowledge, we ensure that every researcher is ideally suited to deliver results for our clients before they are invited to view and participate in the Invite-Only program.

Projects using an Invite-Only Program can tailor their terms of use to exacting privacy standards, thus ensuring peace of mind without compromising on security. We offer a range of customization options, including KYC, confidentiality agreements, asset visibility control, and publication preferences.

Furthermore, our Invite-Only Programs are powered by Hacker Sync, a groundbreaking algorithmic feature designed to revolutionize how bug bounty programs are matched with top-tier security researchers.

But Hacker Sync is more than just another algorithm; it’s the culmination of our dedication to precision, efficiency, and quality in cybersecurity. Leveraging data from over 27,000+ reports and analyzing over 10+ parameters, Hacker Sync meticulously pairs bug bounty programs with curated security researchers, ensuring unparalleled expertise tailored to our customers’ exact needs.

The key parameters utilized by Hacker Sync are as diverse as the security challenges our clients face. From product type and blockchain ecosystem to program type, technology stack, security researcher ranking, and hit rate, Hacker Sync leaves no stone unturned in its quest to connect projects with the most suitable security talent.

One of the key strengths of Hacker Sync lies in the sheer quality of our security researcher community. With over 45,000 blockchain security researchers onboard, including over 1,000 who have successfully averted mainnet theft of funds, Immunefi boasts the largest and most prolific security researcher community in the industry.

But it’s not just about numbers; it’s about impact. Our researchers boast an impressive 52% report hit rate on impact-focused bugs. This means that more than half of the impact-focused bugs identified by our researchers are those with significant potential to cause harm. To date, our researchers have prevented a staggering $25 billion in funds from being lost to malicious actors, and they are currently safeguarding a staggering $60 billion in user funds. These figures underscore the invaluable contribution of our community to the security of the digital ecosystem.

In a world where cybersecurity threats are ever-evolving, Immunefi remains steadfast in its mission to empower organizations with the tools and expertise needed to stay one step ahead. With Invite-Only Programs and Hacker Sync, we’re redefining the paradigm of bug bounty programs, one precise match at a time.

Introducing Invite-Only Programs: Immunefi’s Latest Security Offering Powered by a Robust… was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

We are happy to announce that the Cardano Foundation has launched a bug bounty program with Immunefi!

Cardano Foundation is a trailblazing blockchain platform with a vision for positive global change. With its commitment to evidence-based development and unparalleled security, the Cardano Foundation stands as a beacon of innovation in the crypto landscape. However, even the most robust platforms are not immune to cyber threats, which is why the Cardano Foundation has chosen to partner with Immunefi to bolster its security infrastructure.

The recent surge in blockchain-related losses, totalling a staggering $1.8 billion in 2023 and with crypto losses in January 2024 soaring six times higher than the previous year, underscores the pressing need for robust security measures.

Immunefi boasts the largest and highest-quality pool of security researchers in the industry, comprising over 30,000 experts who have collectively prevented an astonishing $25 billion in potential losses. Our talent is unmatched, with over 1,000 researchers having identified bugs that could have resulted in losses of mainnet funds.

Cardano Foundation’s bug bounty program offers $10,000 for critical bugs found in their Web/App assets, $5,000 for high, $$2,000 for medium, and $1,000 for low-impact bugs. For more information, please check Cardano Foundation’s bug bounty page on Immunefi.

Cardano Foundation Has Launched a $10,000 Bug Bounty Program on Immunefi was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

We are happy to announce that NFTX, a pioneering protocol in the NFT space, has taken a proactive step towards bolstering its security infrastructure by hosting a bug bounty program on Immunefi. This move ensures the safety of assets for NFTX’s vast community of collectors, content creators, and investors.

NFTX stands out as a trailblazing protocol in the NFT landscape. By wrapping similar-value NFTs into fungible ERC20 “vTokens,” NFTX incentivizes the creation of liquid markets for these unique assets, fostering greater accessibility and liquidity within the NFT ecosystem.

Now, NFTX users can rest assured that their valuable assets are fortified against potential threats, thanks to Immunefi’s robust security solutions. As Web3’s premier blockchain security provider, Immunefi boasts the largest community of elite security researchers, dedicated to safeguarding projects and their communities.

Additionally, NFTX is proudly offering up to $150,000 in rewards for critical and up to $40,000 for high smart contract vulnerabilities discovered through their bug bounty program. All reward payments will be processed through Immunefi’s secure vault system, demonstrating NFTX’s commitment to supporting whitehats by ensuring timely payouts.

With this partnership, NFTX and Immunefi are setting a new standard for security within the Web3 ecosystem. Together, we are building a more resilient and stable future for Web3!

NFTX Launches a $150,000 Bug Bounty on Immunefi was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.

We are thrilled to announce that our Vaults System now supports OP Mainnet! This integration marks an exciting milestone in enhancing security and fostering collaboration within the Optimism ecosystem.

In addition to this integration, we are delighted to share that Immunefi has been awarded grants by the Optimism Foundation which will be used for matching rewards for critical findings on specific OP bug bounty programs. Effective immediately, whitehat rewards will be doubled for critical vulnerabilities discovered in Velodrome, Pika Protocol, Synthetix, and Extra Finance.

It’s important to note that this matching rewards plan will be applied regardless of whether the reward is processed through Vaults. Whitehats can submit their critical bug reports with confidence, knowing that their efforts will be rewarded accordingly.

This update follows Immunefi’s recent RetroFunding award of 129,193.07 OP tokens. The continuous collaboration between the Optimism Foundation and Immunefi played a crucial role in enabling us to expand and fortify the Vaults System, ensuring robust support for the Optimism ecosystem.

The Immunefi Vaults System promotes transparency and trust between projects and whitehats by facilitating secure and prompt payments. By extending the coverage of Vaults, we are reaffirming our commitment to bolstering the security of the Optimism Collective and the broader Web3 community.

We look forward to further collaborations and advancements within the Optimism ecosystem, as we continue to strengthen security and foster innovation together!

Exciting News: The Vaults System Now Supports Optimism’s OP Mainnet! was originally published in Immunefi on Medium, where people are continuing the conversation by highlighting and responding to this story.