Best bug bounty platforms in 2026

Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Deepest crypto-native continuous-bounty footprint: "$125M+" paid, "83,000+ registered security researchers", "500+ protocols" (immunefi.com/bug-bounty-program/), plus audit competitions, and it is absorbing Code4rena's bounty customers and researchers after that platform's 13 May 2026 wind-down. Weakest on dispute recourse when payment is refused (5/10): immunefi.com/rules/ prohibits "Disputing a bug report in the dashboard once it has been paid or marked as closed, with the exception of requesting mediation"; in the directory's data 123 of 176 programmes are "Pay to Mediate" (20 of them "No Free Mediations") and arbitration — "The expected output is a final binding decision on a report, followed by enforcement (as required) of the bounty reward from the Project to the Security Researcher" — is enabled on 19 of 176. On advertised maximum vs actually paid (6/10): Immunefi's own blog publishes "The median payout for a critical is $20,000 . The mean sits at $114,355" against "$107.3 million in awards for confirmed critical vulnerabilities alone"; the public directory lists 176 programmes and marks "Total Paid" as Private on 146, while 30 disclose a figure (The Graph 1,595,724; Immunefi's own programme 76,128; Polygon "Total paid 8.2M from 86 paid reports"). Published price: "the subscription removes the 10% platform fee on all payouts" — i.e. the default is a 10% platform fee on every payout.

Best for: Coverage model & blockchain depth — 9/10

Contest-first audits with post-launch bounty and coverage backstop. Strongest on dispute recourse when payment is refused (7/10): Best-engineered escalation ladder in the category, and it is not opt-in: Level 1 a Sherlock core-team judge; Level 2 the "Sherlock Protocol Claims Committee" enforced by a "4 of 7 multisig" with "1 week to come to a decision"; Level 3 the UMA Optimistic Oracle. Costs are published: "$1k to escalate the issue to the… Weakest on advertised maximum vs actually paid (3/10): Publishes the largest advertised bounty in the entire category — Usual Labs "16,000,000 USDC" on audits.sherlock.xyz/bug-bounties, alongside 35 other programmes with maxima down to 5,000 USDC — but publishes no total-paid figure anywhere: not per programme, not in aggregate. Pure advertised-max disclosure with no… Published price: "The Platform Fee is equal to ten percent (10%) of the Research Fee" (docs.sherlock.xyz/bug-bounties/post-launch-bounty).

Best for: Dispute recourse when payment is refused — 7/10

Cyfrin's competitive audit arena; contest-only, no continuous bounty. Strongest on advertised maximum vs actually paid (7/10): The contest model structurally removes the advertised-versus-paid gap: a fixed pool (ZKsync Era 500,000 USDC, Chainlink CCIP $200,000, Gamma $50,000 USDC) is distributed in full by a published formula, so there is no headline maximum that goes unpaid. Held below 8 because no platform-wide total-paid figure is… Weakest on fee disclosure & take rate (3/10): the only fee statements are qualitative — "True to the Cyfrin ethos, we have reduced platform fees" (cyfrin.io blog, 1 July 2024) and a docs comparison row "| **Pricing** | Low platform fees | Higher platform fees |" — and the published formula and lines-of-code pool sizing divide the pool among auditors, not the platform's take. On coverage model & blockchain depth (4/10): Contest-only — there is no continuous bug bounty product, so it cannot cover live deployed code between competitions. Prize pools are "calculated based on the number of lines of code in the codebase's scope". The contests page data holds 45 contests; only one has started since April 2025 (BattleChain Confidence Pools, 7.25 ETH, July 2026). Published price: Platform fee: not published ("True to the Cyfrin ethos, we have reduced platform fees" — no figure given, cyfrin.io blog, 1 July 2024).

Best for: Advertised maximum vs actually paid — 7/10

Spearbit's public bounty and competition arm, now inside an agentic security suite. Strongest on coverage model & blockchain depth (8/10): continuous bounties and competitions with Cantina triage — cantina.xyz/opportunities/bounties lists "All 52 Bounties 52 Competitions Ended 144", programmes are marked "Cantina-Triaged", and cantina.security/bounties states "Every valid finding is reproduced, validated, and reviewed before it reaches your team". On advertised maximum vs actually paid (4/10): the same page publishes one platform aggregate — "Payouts available $66.1M" versus "Total paid out $54.1M" — and per-programme maxima (Uniswap "Maximum reward $15,500,000", "Findings submitted 1,002"), but no per-programme paid amount, median or mean; cantina.xyz/leaderboard lists per-researcher all-time winnings ("1 zigtur @ zigtur $932,505.92") that do not reconcile any programme's advertised maximum with what it paid. Weakest on dispute recourse when payment is refused (3/10): The researcher participation guide (docs.cantina.security/for-security-researchers/participation-guides/bug-bounty-participation) describes a mediation process but states no fee schedule, no escalation tier, no external arbiter and no binding outcome. A researcher whose severity is downgraded has no published route… Published price: Platform fee/commission: not published (absent from cantina.security/bounties and from docs.cantina.security/llms-full.txt). What IS published: "Payouts available $66.1M" across 52 live bounties versus "Total paid out $54.1M" historically.

Best for: Coverage model & blockchain depth — 8/10