Arbitrum's ongoing bug bounty program covers smart contract vulnerabilities across Arbitrum One and Arbitrum Nova, with 181 assets in scope. Critical findings pay 10 percent of the funds directly affected, capped at 2,000,000 USD with a 50,000 USD minimum. High severity findings pay 10,000 to 30,000 USD, medium 5,000 USD and low 1,000 USD. Every report must include a proof of concept to qualify, payouts are made in USDC on Ethereum, and KYC is required before funds are released. The program has run continuously since 31 August 2021 and was last updated on 30 July 2026.