What it is
Lido runs a continuous bug bounty programme on Immunefi, open to any security researcher with no application or invitation needed. It has been live since 22 May 2021 and is listed on Immunefi's index of active programmes.
What it pays
Maximum payout is 2,000,000 USD. Rewards are published per asset type
Smart Contract
- Critical: 50,000 to 2,000,000 USD
- High: 10,000 to 250,000 USD
- Medium: 1,000 to 50,000 USD
- Low: 1,000 USD flat
Websites and Applications
- Critical: 50,000 to 100,000 USD
- High: 5,000 to 50,000 USD
- Medium: 1,000 to 5,000 USD
- Low: 500 USD flat
No KYC is required to claim a reward.
Scope
29 assets are in scope. The programme page carries the full asset list, severity definitions and submission rules, and was last updated on 29 June 2026.