---
title: "Bug bounties"
description: "Bug bounties: Crowdsourced review. Layer: Deployed system. Characteristic finds: Whatever survived everything else, on the code actually running."
type: "option"
url: "https://zkpick.com/audit/bug-bounties/"
section: "03 Auditing a ZK protocol"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/audit/bug-bounties.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Bug bounties — *Crowdsourced review*

> Bug bounties: Crowdsourced review. Layer: Deployed system. Characteristic finds: Whatever survived everything else, on the code actually running. Blind to: Everything, until someone looks — no pre-launch assurance. Coverage claim: None. Cost profile: Contingent; needs credible max payout. Maintained by: Run by the deploying team, usually on a bounty platform; the linked ZKsync Era programme is one example of a published ZK scope, not a recommendation. Choose it when: Every production system, funded proportionally to value at risk and live from mainnet day one. State explicitly whether circuits, prover, verifier contract and setup artefacts are in scope.

An open-ended funded programme covering deployed code, with published severity classification and reward scale. The better ZK programmes state explicitly whether circuits, prover, verifier contract and setup artefacts are in scope, whether completeness failures (valid inputs rejected, funds stuck) count alongside soundness failures, and what proof of concept is required at each severity.

**Strengths**

- The only mechanism covering the code you actually run, indefinitely, after every deployment
- Attracts specialists, including tool authors running new techniques against live targets
- Cost is contingent on findings rather than fixed
- Establishes a legitimate disclosure channel, reducing the chance a finder goes public instead

**Tradeoffs**

- No assurance before launch and no coverage guarantee ever
- An underfunded maximum payout is a negative signal for a system securing large value
- Scope must be drafted carefully: proof forgery for arbitrary statements must be unambiguously critical
- Demands 24/7 triage and a rehearsed emergency response

**Choose it when:** Every production system, funded proportionally to value at risk and live from mainnet day one. State explicitly whether circuits, prover, verifier contract and setup artefacts are in scope.

Maintained by: Run by the deploying team, usually on a bounty platform; the linked ZKsync Era programme is one example of a published ZK scope, not a recommendation · Maturity: Production standard · License: Platform · Source: https://immunefi.com/bug-bounty/zksyncera/

**In the what each assurance technique can and cannot find** (https://zkpick.com/audit/#audit-matrix-bug-bounty)

| Technique | Layer | Characteristic finds | Blind to | Coverage claim | Cost profile |
| --- | --- | --- | --- | --- | --- |
| Bug bounty | Deployed system | Whatever survived everything else, on the code actually running | Everything, until someone looks — no pre-launch assurance | None | Contingent; needs credible max payout |