Skip to main content

Help update this page


There’s a new version of this page but it’s only in English right now. Help us translate the latest version.

Translate page
See English

No bugs here!🐛

This page is not being translated. We've intentionally left this page in English for now.

Open for submissions

Bug Bounty Program 🐛
Earn up to $250,000 USD and a place on the leaderboard by finding protocol, client and Solidity bugs affecting the Ethereum network.
Submit a bugRead rules
protolambda GitHub avatar
42400 points
guidovranken GitHub avatar
Guido Vranken
39350 points
holiman GitHub avatar
Martin Holst Swende
38000 points
samczsun GitHub avatar
Sam Sun
35000 points
chainsecurity GitHub avatar
21000 points
See full leaderboards

Clients featured in the bounties

In Scope

Our bug bounty program spans end-to-end: from soundness of protocols (such as the blockchain consensus model, the wire and p2p protocols, proof of stake, etc.) and protocol/implementation compliance to network security and consensus integrity. Classical client security as well as security of cryptographic primitives are also part of the program. When in doubt, send an email to and ask us.


Specification bugs

The Ethereum Specifications detail the design rationale for the Execution Layer and Consensus Layer.

Consensus Layer Specifications
Execution Layer Specifications

It might be helpful to check out the following annotations:

Types of bugs

  • Safety/finality-breaking bugs
  • Denial of service (DOS) vectors
  • Inconsistencies in assumptions, like situations where honest validators can be slashed
  • Calculation or parameter inconsistencies

Specification documents

Beacon Chain
Fork choice
Solidity deposit contract
Peer-to-peer networking

Client bugs

Clients run the Ethereum Network, and they need to follow the logic set out in the specification and be secure against potential attacks. The bugs we want to find are related to the implementation of the protocol.

Currently execution layer clients (Besu, Erigon, Geth and Nethermind) and consensus layer clients (Lighthouse, Lodestar, Nimbus, Teku and Prysm) are included in the Bug Bounty Program. More clients may be added as they complete audits and become production ready.

Types of bugs

  • Spec non-compliance issues
  • Unexpected crashes, RCE or denial of service (DOS) vulnerabilities
  • Any issues causing irreparable consensus splits from the rest of the network

Helpful links


Solidity bugs

See the Solidity SECURITY.MD for more details about what is included in this scope.

Solidity does not hold security guarantees regarding compilation of untrusted input – and we do not issue rewards for crashes of the solc compiler on maliciously generated data.

Helpful links

Deposit Contract bugs

The specificiations and source code of the Beacon Chain Deposit Contract is part of the bug bounty program.

Out of scope

Only the targets listed under in-scope are part of the Bug Bounty Program. This means that for example our infrastructure; such as webpages, dns, email etc, are not part of the bounty-scope. ERC20 contract bugs are typically not included in the bounty scope. However, we can help reach out to affected parties, such as authors or exchanges in such cases. ENS is maintained by the ENS foundation, and is not part of the bounty scope.

Submit a bug

For each valid bug you find you’ll earn rewards. The quantity of rewards awarded will vary depending on Severity. The severity is calculated according to the OWASP risk rating model based on Impact on the Ethereum Network and Likelihood. View OWASP method

The EF will also provide rewards based on:

Quality of description: Higher rewards are paid for clear, well-written submissions.

Quality of reproducibility: A Proof of Concept (POC) must be included to be eligible for rewards. Please include test code, scripts and detailed instructions. The easier it is for us to reproduce and verify the vulnerability, the higher the reward.

Quality of fix, if included: Higher rewards are paid for submissions with clear description of how to fix the issue.

Up to 2,000 USD


Up to 2,000 USD

Up to 1,000 points


  • Low impact, medium likelihood
  • Medium impact, low likelihood


Attacker can sometimes put a node in a state that causes it to drop one out of every one hundred attestations made by a validator
Submit low risk bug
Up to 10,000 USD


Up to 10,000 USD

Up to 5,000 points


  • High impact, low likelihood
  • Medium impact, medium likelihood
  • Low impact, high likelihood


Attacker can successfully conduct eclipse attacks on nodes with peer-ids with 4 leading zero bytes
Submit medium risk bug
Up to 50,000 USD


Up to 50,000 USD

Up to 10,000 points


  • High impact, medium likelihood
  • Medium impact, high likelihood


There is a consensus bug between two clients, but it is difficult or impractical for the attacker to trigger the event.
Submit high risk bug
Up to 250,000 USD


Up to 250,000 USD

Up to 25,000 points


  • High impact, high likelihood


There is a remote code execution in a majority client, and it is trivial for an attacker to trigger the vulnerability.
Submit critical risk bug

Bug hunting rules

The bug bounty program is an experimental and discretionary rewards program for our active Ethereum community to encourage and reward those who are helping to improve the platform. It is not a competition. You should know that we can cancel the program at any time, and awards are at the sole discretion of Ethereum Foundation bug bounty panel. In addition, we are not able to issue awards to individuals who are on sanctions lists or who are in countries on sanctions lists (e.g. North Korea, Iran, etc). Local laws require us to ask for proof of your identity. You are responsible for all taxes. All awards are subject to applicable law. Finally, your testing must not violate any law or compromise any data that is not yours and must take place on local running testnets.

  • Issues without a POC or that have already been submitted by another user or are already known to spec and client maintainers are not eligible for bounty rewards.
  • Public disclosure of a vulnerability makes it ineligible for a bounty.
  • Employees and contractors of the Ethereum Foundation or client teams in scope of the bounty program may participate in the program only in the accrual of points and will not receive monetary rewards.
  • Ethereum bounty program considers a number of variables in determining rewards. Determinations of eligibility, score and all terms related to an award are at the sole and final discretion of the Ethereum Foundation bug bounty panel.

Execution Layer Bug Bounty leaderboard

Find execution layer bugs to get added to this leaderboard

holiman GitHub avatar
Martin Holst Swende
35500 points
samczsun GitHub avatar
Sam Sun
35000 points
guidovranken GitHub avatar
Guido Vranken
21750 points
chainsecurity GitHub avatar
21000 points
junorouse GitHub avatar
Juno Im
20500 points
uknowy GitHub avatar
Yoonho Kim (team Hithereum)
20000 points
johnyangk GitHub avatar
John Youngseok Yang (Software Platform Lab)
20000 points
peckshield GitHub avatar
17000 points
itsunixiknowthis GitHub avatar
15000 points
catageek GitHub avatar
Bertrand Masius
15000 points
tintinweb GitHub avatar
12500 points
Ralph Pichler
12500 points
Bob Conan
12000 points
lukaszmatczak GitHub avatar
Łukasz Matczak
11000 points
10000 points
jonasnick GitHub avatar
Jonas Nick
10000 points
jtoman GitHub avatar
John Toman
10000 points
Sebastian Henningsen
8000 points
Dominic Brütsch
7500 points
HarryR GitHub avatar
Harry Roberts
5000 points
p- GitHub avatar
Peter Stöckli
5000 points
Dedaub GitHub avatar
Neville Grech
5000 points
EthHead GitHub avatar
5000 points
axic GitHub avatar
Alex Beregszaszi
3500 points
SergioDemianLerner GitHub avatar
Sergio Demian Lerner
2500 points
danhper GitHub avatar
Daniel Perez
2500 points
yaronvel GitHub avatar
Yaron Velner
2000 points
whitj00 GitHub avatar
Whit Jackson
2000 points
Ming Chuan Lin
2000 points
melonport GitHub avatar
Melonport team
2000 points
maurelian GitHub avatar
2000 points
Cjentzsch GitHub avatar
Christoph Jentzsch
2000 points
hwanjo GitHub avatar
Hwanjo Heo
1500 points
DVPNET GitHub avatar
1200 points
Vasily Vasiliev
1000 points
talko GitHub avatar
1000 points
swaldman GitHub avatar
Steve Waldman
1000 points
ptk GitHub avatar
Panu Kekäläinen
1000 points
montyly GitHub avatar
Josselin Feist
1000 points
henrit GitHub avatar
1000 points
BlameByte GitHub avatar
Marc Bartlett
1000 points
Barry Whitehat
1000 points
badmofo GitHub avatar
Lucas Ryan
1000 points
agroce GitHub avatar
Alex Groce
1000 points
n0thingness GitHub avatar
Daniel Briskin
750 points
daenamkim GitHub avatar
Daenam Kim
750 points
Myeongjae Lee
500 points
Marcin Noga (Cisco/Talos Security)
500 points
500 points
feeker GitHub avatar
Feeker - 360 ESG Codesafe Team
500 points
ethernomad GitHub avatar
Jonathan Brown
500 points
davidmurdoch GitHub avatar
David Murdoch
500 points
wadeAlexC GitHub avatar
Alexander Wade
500 points
gitpusha GitHub avatar
Luis Schliesske
200 points

Frequently asked questions

What should a good vulnerability submission look like?

See a real example of a quality vulnerability submission.

Description: Remote Denial-of-service using non-validated blocks

Attack scenario: An attacker can send blocks that may require a high amount of computation (the maximum gasLimit) but has no proof-of-work. If the attacker sends blocks continuously, the attacker may force the victim node to 100% CPU utilization.

Impact: An attacker can abuse CPU utilization on remote nodes, possibly causing full DoS.

Components: Go client version v0.6.8

Reproduction: Send a block to a Go node that contains many txs but no valid PoW.

Details: Blocks are validated in the method Process(Block, dontReact). This method performs expensive CPU-intensive tasks, such as executing transactions (sm.ApplyDiff) and afterward it verifies the proof-of-work (sm.ValidateBlock()). This allows an attacker to send blocks that may require a high amount of computation (the maximum gasLimit) but has no proof-of-work. If the attacker sends blocks continuously, the attacker may force the victim node to 100% CPU utilization.

Fix: Invert the order of the checks.

Is the bug bounty program is time limited?


No end date is currently set. See the Ethereum Foundation blog for the latest news.

How are bounties paid out?

Rewards are paid out in ETH or DAI.

Rewards are paid out in ETH or DAI after the submission has been validated, usually a few days later. Local laws require us to ask for proof of your identity. In addition, we will need your ETH address.

Can I donate my reward to charity?


We can donate your reward to an established charitable organization of your choice.

I reported an issue / vulnerability but have not received a response!

Please allow a few days for someone to respond to your submission.

We aim to respond to submissions as fast as possible. Feel free to email us at if you have not received a response within a day or two.

I want to be anonymous / I do not want my name on the leader board.

You can do this, but it might make you ineligble for rewards.

Submitting anonymously or with a pseudonym is OK, but will make you ineligible for ETH/DAI rewards. To be eligible for ETH/DAI rewards, we require your real name and a proof of your identity. Donating your bounty to a charity doesn’t require your identity.

Please let us know if you do not want your name/nick displayed on the leader board.

What are the points in the leaderboard?

Every found vulnerability / issue is assigned a score

Every found vulnerability / issue is assigned a score. Bounty hunters are ranked on our leaderboard by total points.

Do you have a PGP key?

Yes. Expand for details.

Please use AE96 ED96 9E47 9B00 84F3 E17F E88D 3334 FA5F 6A0A



Email us:


Was this page helpful?

Website last updated: October 7, 2022

Use Ethereum

  • Find wallet
  • Get ETH
  • Decentralized applications (dapps)
  • Layer 2
  • Run a node
  • Stablecoins
  • Stake ETH


  • Community hub
  • Ethereum Foundation
  • Ethereum Foundation Blog
  • Ecosystem Support Program
  • Ethereum bug bounty program
  • Ecosystem Grant Programs
  • Ethereum brand assets
  • Devcon