category.bug_bounties.label

category.bug_bounties.promise

Starting path

The advertised maximum is a ceiling, not a record

Bug Bounty Platforms evaluated across fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.

category.bug_bounties.promise Reviewed on fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.

Start with the smart category assistant or jump straight into quick questions. Both paths narrow to the same recommendation standard.

How we review

Recommendation first, comparison only if needed.

Reviewed and rechecked on the current cycle.

Commercial relationships disclosed before clickout.

Audit

Infrastructure

Methodology

2026.04.0

published 2026-04-27

Providers tracked

450+

across 46 categories

Last verified

2026-08-04

editorial freshness

Editorial board

4

audit-log live

Decision guide

What matters most before choosing in this category

The right bounty platform depends on your stack, your deadline, and how much assurance you actually need — but the decisive input is the firm's record on code it has already reviewed. Brand, client logo walls and self-reported 'TVL secured' are not scored here, because a self-reported metric without a denominator is marketing. What is scored is what happened after the review, and whether the engagement can be reconstructed from a published report and a commit-pinned scope.

Key question

Do you want continuous coverage of deployed code, or a time-boxed contest before launch?

Key question

Do you know what percentage the platform takes from a payout, and is it published?

Key question

What happens if you and a researcher disagree about severity — who decides, and can it be appealed?

Default starting point

Immunefi

Crypto-native continuous bug bounty marketplace with binding arbitration

Data checked Aug 2026

Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Deepest crypto-native continuous-bounty footprint: "$125M+" paid, "83,000+ registered security researchers", "500+ protocols" (immunefi.com/bug-bounty-program/), plus audit competitions, and it is absorbing Code4rena's bounty customers and researchers after that platform's 13 May 2026 wind-down. Weakest on advertised maximum vs actually paid (5/10): Immunefi's CEO publishes the single most useful honest number in the category — "A bug bounty critical pays a median of $20,000" against a mean of "$114,355" — yet the public directory marks "Total Paid" as Private on essentially all 187 listed programs; only The Graph ($1.5M) and Immunefi's own program ($68.9k)… Published price: "the subscription removes the 10% platform fee on all payouts" — i.e. the default is a 10% platform fee on every payout. The annual subscription price that removes it is NOT published; three tiers (BBP Subscription "Annual flat fee, zero commission on…

Best for

Coverage model & blockchain depth — 9/10Fee disclosure & take rate — 7/10

Main tradeoff

Its rulebook is no longer public. The support articles defining "No Fix, No Pay", Issuing Payouts and Arbitration Overview all now return a login wall ("Login to your account | Immunefi") — you cannot read the terms that govern whether you get paid until after you sign up. And the "no fix, no pay" rule itself means a project that acknowledges your critical but declines to fix it owes you nothing; immunefi.com/rules/ only references the rule obliquely, listing "Abusing the 'no fix, no pay' rule by stealth fixing the bug later without providing full payment to the whitehat" as prohibited conduct.

Verify before signup

"the subscription removes the 10% platform fee on all payouts" — i.e. the default is a 10% platform fee on every payout. The annual subscription price that removes it is NOT published; three tiers (BBP Subscription "Annual flat fee, zero commission on payouts", Enterprise Subscription, Premium BBP) are listed with no dollar amounts.

Weighted criteria

Fee disclosure & take rate30%

Dispute recourse when payment is refused30%

Advertised maximum vs actually paid25%

Coverage model & blockchain depth15%

Leading options

Shared shortlist for this category

These providers are pulled from the same category comparison catalog used in validation, so the category page, comparison page, and provider reviews stay aligned.

TradingView

Industry-standard charting + technical-analysis platform with crypto-native integrations

Editor lead

The universal charting platform used across crypto, equities, FX, and futures by roughly 70M traders. Pine Script strategies, 100+ indicators, alerts, and shareable charts. Crypto coverage spans 60+ exchanges with real-time data.

Best for: Technical-analysis-first traders, multi-asset analysts holding crypto alongside stocks/FX, alert-driven traders managing many pairs, and Pine Script strategy builders.

Glassnode

Institutional-grade on-chain intelligence for BTC, ETH, and major L1s

The dataset of record for on-chain analytics — used by hedge funds, family offices, and macro researchers to track network health, cycle position, and capital flows. Proprietary metrics like MVRV, NUPL, SOPR, and exchange-reserve series originate here before becoming consensus indicators.

Best for: Macro on-chain analysts, BTC/ETH cycle traders, institutional research desks, and position-sizing decisions backed by on-chain state rather than chart patterns alone.

Nansen

Wallet-labelled on-chain intelligence — track smart money across EVM chains

Built its category by labelling the most successful on-chain wallets and surfacing where capital is actually moving — "Smart Money" tags on funds, MEV bots, deployers, and high-conviction trader wallets. Coverage spans Ethereum, Solana, Base, Arbitrum, Optimism, BSC, and ~10 more chains.

Best for: DeFi traders tracking smart-money wallets, EVM and Solana alpha hunters, researchers studying capital flows across DEXs, and token launch / airdrop hunters.

Browse this network

Methodology

How this category is reviewed

Reviewed on fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.

Reviewed on: Fee disclosure & take rate, Dispute recourse when payment is refused, Advertised maximum vs actually paid, Coverage model & blockchain depth.

This page is a maintained category surface, not a static marketing block. Review freshness, provider positioning, and recommendation logic should stay consistent with quiz and provider pages.

Frequently asked

Questions people ask before choosing bug bounty platforms

Does a large advertised bounty mean large payouts?

No. The headline maximum is a marketing ceiling and is shown here as a fact, never scored as an achievement. What is scorable is whether the platform lets anyone verify the gap between what it advertises and what it has genuinely paid.

Why does coverage model carry the least weight?

Because it is the most visible difference and the easiest to check yourself. A contest covers a commit for a window; continuous coverage follows deployed code afterwards. The harder questions — what the platform keeps, and what recourse exists when a payout is refused — carry 60% between them.

What matters most when picking an bounty platform?

Fee disclosure and dispute recourse — 60% of the weight between them. They are the two things a researcher cannot discover until it is too late.

REVIEWEDApr 2026METHOD4 criteriaCATEGORYbug_bounties

Not financial advice · For informational purposes only · Always do your own research

Octopus · The AI CFO that pays for itself

Audit your entire crypto stack — free.

Score concentration, fees, security, and tax complexity across exchanges, wallets, staking, and DeFi.

Not financial advice · For informational purposes only · Always do your own research