Bug Bounty Platforms evaluated across fee disclosure and the platform's take rate, dispute recourse when payment is refused, the advertised maximum against what was actually paid, and the coverage model and its depth on blockchains.
Ranked here: crypto bug bounty platforms through which you fund a bounty, compared on what the platform keeps, recourse when payment is refused and what is actually paid. Not ranked here: anything other than a platform through which you fund a crypto bug bounty.
#1 of 5 · published ranking
Immunefi
79ChainChoice Score
4199
Why it leads
Immunefi scores higher than everything else in this ranking on its model depth.
Show the arithmetic
Best in this ranking on model depth (9/10; next 8/10)
Cost
Not priced· No comparable price is published
ReviewedNext review by Published Methodology v2026.11.1
How this page is reviewed
Reviewed means every product ranked on this page was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
No provider can pay for a position in this table. The code that computes this order cannot read which links carry a referral code, and every build proves it. Every score below rebuilds from the published criteria.Ranking v2026.11.1 · 4 criteria · 5 products · same inputs, same order
How we review · 5 ranked of 7 assessed · 4 criteria · 0 sponsor weight
How we review
5ranked
7assessed
4criteria
0sponsor weight
Recommendation first, comparison only if needed.
Reviewed and rechecked on the current cycle.
Commercial relationships disclosed before clickout.
Personal comparison
Bug Bounty Platforms ranked comparison
No comparable price is published; ranking still uses verified product evidence.
Coverage model & blockchain depth — 9/10Trade-off: Its rulebook is no longer public. The support articles defining "No Fix, No Pay", Iss...
79score
Check availability for your country
Immunefi · immunefi.com. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
2
SHSherlockContest-first audits with post-launch b...
Fee disclosure & take rate — 7/10Trade-off: The escalation ladder that makes Sherlock look best on disputes is priced above what...
76score
Check availability for your country
Sherlock · sherlock.xyz. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
Advertised maximum vs actually paid — 7/10Trade-off: It cannot do the job most buyers of this category actually want. CodeHawks runs time-...
67score
Check availability for your country
Cyfrin CodeHawks · codehawks.cyfrin.io. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
4
Cantina (Spearbit)Spearbit's public bounty and competitio...
Coverage model & blockchain depth — 8/10Trade-off: The bounty business is no longer the main event. cantina.xyz/welcome now leads with "...
65score
Check availability for your country
Cantina (Spearbit) · cantina.xyz. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
5
HackenProofCrypto-focused bounty platform run by H...
Fee disclosure & take rate — 5/10Trade-off: Client pricing is set off-platform and researchers pay to withdraw. The Terms & Condi...
64score
Check availability for your country
HackenProof · hackenproof.com. Provider links appear once we know which country you are browsing from: ChainChoice links to providers only where it serves in full.
Commission: This provider pays ChainChoice nothing for this link. Disclosure
Crypto products are high risk. Check the provider is authorised where you live before you deposit.
Ranked on 4 published criteria weighted 30/30/25/15, which set goal alignment — 30 of the 86 points. The rest: regional access 20 (constant here), evidence depth 18 (constant here), ease of use 10 (constant here), institutional trust 8 (constant here). Profile match is shown in breakdowns but carries no weight.
How you can lose money here, and what the ranking scores
Execution failure: you get a worse price, later, or nothing.
Scored by Dispute recourse when payment is refused · 30% (Immunefi 5/10, Sherlock 7/10, Cyfrin CodeHawks 4/10)
Information failure: the number is wrong or bought, or your data leaks.
Scored by Advertised maximum vs actually paid · 25% (Immunefi 6/10, Sherlock 3/10, Cyfrin CodeHawks 7/10)
Also scored, as cost, quality or a summary of several families: Fee disclosure & take rate (30%), Coverage model & blockchain depth (15%).
Audit
Infrastructure
Methodology
2026.11.1
published 10 November 2026
Providers tracked
860+
across 121 categories
Last verified
3 November 2026
newest dated pricing or sentiment read
Named on the roster
2 people
managing directors · 6 automated processes
Decision guide
What matters most before choosing in this category
A bounty platform is not an audit, and this page scores it as what it is: a standing offer to pay strangers for bugs. The decisive questions are whether the platform discloses its fee and take rate, what recourse a researcher has when a payment is refused, and how the advertised maximum compares with what has actually been paid — headline ceilings in this market are marketing, and are shown as facts rather than scored.
Do you want continuous coverage of deployed code, or a time-boxed contest before launch?
Do you know what percentage the platform takes from a payout, and is it published?
What happens if you and a researcher disagree about severity — who decides, and can it be appealed?
Default starting point
The #1 overall and the scoring weights
ImmunefiData checked Nov 2026
Crypto-native continuous bug bounty marketplace with binding arbitration
Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Immunefi lists 155 continuous bug bounty programmes, the largest crypto-native standing footprint in this set, and runs Managed Triage with AI triage agents and expert human triagers drawn from 83,000+ registered security researchers. Weakest on dispute recourse when payment is refused (5/10): Immunefi allows mediation as the only dispute once a report is paid or closed; binding arbitration is opt-in and enabled on 17 of 155 programmes, and 142 programmes charge researchers to mediate. A mediation won returns its fee as Immunefi Credits. Published price: "the subscription removes the 10% platform fee on all payouts" (immunefi.com/bug-bounty-program/, fetched 3 November 2026), i.e. the default is a 10% platform fee on every payout.
Best forCoverage model & blockchain depth — 9/10
Main tradeoffIts rulebook is no longer public. The support articles defining "No Fix, No Pay", Issuing Payouts and Arbitration Overview all now return a login wall ("Login to your account | Immunefi") — you cannot read the terms that govern whether you get paid until after you sign up. And the "no fix, no pay" rule itself means a project that acknowledges your critical but declines to fix it owes you nothing; immunefi.com/rules/ only references the rule obliquely, listing "Abusing the 'no fix, no pay' rule by stealth fixing the bug later without providing full payment to the whitehat" as prohibited conduct.
Verify before signup"the subscription removes the 10% platform fee on all payouts" (immunefi.com/bug-bounty-program/, fetched 3 November 2026), i.e. the default is a 10% platform fee on every payout. The annual subscription price that removes it is not published: the page lists BBP Subscription ("Annual flat fee, zero commission on payouts"), Enterprise Subscription and Premium BBP ("An add-on that restricts submissions to a curated pool of experienced, vetted researchers") with no dollar amounts. Researcher-side costs also exist: Managed Triage uses "pay-to-submit pricing" to keep spam out, with the amount set per programme. Since 2 November 2026 (Immunefi blog, "Immunefi Credits") submission, mediation and verification fees are paid in Immunefi Credits, and a researcher whose report is valid, a duplicate of a valid report, a private known issue or a mediation won receives credits equal to the fee.
Weighted criteria
Fee disclosure & take rate30%
Dispute recourse when payment is refused30%
Advertised maximum vs actually paid25%
Coverage model & blockchain depth15%
Methodology
How this category is reviewed
Reviewed on fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.
The order on this page is the published ranking for this category. Every criterion, weight and source behind it is on the methodology page.
Frequently asked
Questions people ask before choosing bug bounty platforms
Does a large advertised bounty mean large payouts?
No. The headline maximum is a marketing ceiling and is shown here as a fact, never scored as an achievement. What is scorable is whether the platform lets anyone verify the gap between what it advertises and what it has genuinely paid.
Why does coverage model carry the least weight?
Because it is the most visible difference and the easiest to check yourself. A contest covers a commit for a window; continuous coverage follows deployed code afterwards. The harder questions — what the platform keeps, and what recourse exists when a payout is refused — carry 60% between them.
What matters most when picking an bounty platform?
Fee disclosure and dispute recourse — 60% of the weight between them. They are the two things a researcher cannot discover until it is too late.
Reviewed3 November 2026Method4 criteriaCategorybug_bounties
Not financial advice · For informational purposes only · Always do your own research
