Bug bounty

A bug bounty program publishes the rules: which contracts or systems are in scope, how to submit a report and how much each severity level pays. A researcher who finds a flaw reports it privately, the team confirms and fixes it, and the reward is paid, often in stablecoins or the project's token. Critical bugs in DeFi are usually priced as a percentage of the funds at risk, with a cap.

Because a single bug can put hundreds of millions of dollars at stake, crypto bounties are among the largest in software, with some payouts reaching several million dollars. Specialised platforms host programs for many protocols and mediate disputes. After an exploit, teams often also offer a "whitehat bounty", typically around 10% of the stolen funds, if the attacker returns the rest.

A bounty only works if it pays well enough to beat the temptation of exploiting the bug, and if the team responds quickly and honours its terms. Slow or disputed payouts discourage researchers.