Bounties

Web3 Bug Bounty Programs

Open bug bounty programs from protocols and Web3 companies. Each links to its scope, rules and the official place to report.

27 bug bounty programs are open on Dapping as of October 26, 2026, sorted by maximum reward. The largest listed is GMX Bug Bounty Program, up to 5,000,000 USD.

Open programs

All bounties
Bug bounty programs

Frequently asked questions

Which Web3 bug bounty programs are open?

As of October 26, 2026, Dapping lists 27 open bug bounty programs. A program appears here when it is a bug bounty, its status is open, and it has not passed an end date.

Which program pays the most?

GMX Bug Bounty Program lists the largest maximum reward on this page, 5,000,000 USD. The list is sorted by maximum reward, highest first.

Is the maximum reward what I will be paid?

No. The maximum is the ceiling for the most severe finding in scope. Payouts depend on severity, impact and the program rules, so read the scope and the rules on the program page before testing anything.

Where do I submit a vulnerability?

Through the channel each program names on its own page. Dapping lists the programs and does not handle reports. Never test against live funds outside the scope a program allows.