What it is
Starknet runs a continuous bug bounty programme on Immunefi, open to any security researcher with no application or invitation needed. It has been live since 19 October 2022 and is listed on Immunefi's index of active programmes.
What it pays
Maximum payout is 250,000 USD. Rewards are published per asset type
Blockchain/DLT
- Critical: 15,000 to 250,000 USD
- High: 10,000 USD flat
- Medium: 2,500 USD flat
Smart Contract
- Critical: 15,000 to 250,000 USD
Websites and Applications
- Critical: 5,000 to 10,000 USD
- High: 1,250 to 2,500 USD
KYC is required before a reward is released.
Scope
40 assets are in scope. The programme page carries the full asset list, severity definitions and submission rules, and was last updated on 10 August 2026.