Bug Bounty Payout Calculator: Size Critical Rewards to TVL
Quick answer. Published programs pay Criticals 10% of the funds directly affected, not total TVL, between a minimum and a cap. GMX pays $50,000 to $5 million; Sky pays $150,000 to $10 million. Run your numbers below.
Video transcript
A Critical reward set too low gives researchers little reason to report. Set it higher than you can fund, and you make a promise you cannot keep.
The programs we read solve this the same way. They pay ten percent of the funds directly affected, raised to a minimum and cut to a cap.
Funds at risk is what this bug could take, not your whole TVL. A minimum discourages withholding a report. The cap is the most you pay for one Critical.
At GMX's terms, two hundred fifty thousand at risk pays the fifty thousand dollar minimum. Twenty million pays two million. One hundred million hits the five million cap.
Above fifty million dollars at risk, every GMX Critical pays the cap. So fund the cap you publish, and raise it as TVL grows.
Floors and ceilings vary. Sky's minimum is three times GMX's, and its cap is twice as high. Immunefi's own caps Criticals at fifty thousand dollars.
With Vanguard, Guardian hosts and manages your bug bounty. You put up fifty thousand dollars, and Guardian matches it on your bounty.
Triage is tuned AI tied to your audit. Before the bounty, Guardian funds a one hundred thousand dollar Critical pot in a public Defender contest.
Run your numbers in the full article's calculator, then talk to Guardian about Vanguard or Managed Security.
The Critical reward is the top line of a bug bounty. Set it too low and a researcher has little reason to report.
Set it higher than you can fund, and the program makes a promise you cannot keep.
The programs we read solve this the same way. They pay a percentage of the funds at risk, with a minimum and a cap.
This calculator applies that rule to your numbers. Every default comes from a published program, and you can change each one.
How Funds-at-Risk Sizing Works
Programs on Immunefi state the rule in almost the same words. GMX's reads: "Reward amount is 10% of the funds directly affected up to a maximum of" $5,000,000.
It adds "a minimum reward of USD 50 000." Sky, Lido, LayerZero and Immunefi's own program also pay 10%.
Critical reward = percentage × funds at risk, raised to the minimum and cut to the cap.
Each input means something specific:
- Funds at risk: what this bug could take, not your whole TVL.
- When it is measured: at "the time and date the bug report is submitted", in Sky's and Immunefi's terms.
- Percentage: 10% in every program we read.
- Minimum: Immunefi's own program sets one "to discourage security researchers from withholding a bug report."
- Cap: the most you will pay for one Critical.
Teams keep some discretion. GMX says its Critical rewards weigh "funds at risk, but also PR and branding aspects."
TVL is the ceiling. A bug that reaches every vault puts all of it at risk; a bug in one pool puts that pool at risk.
Use the Calculator
Start from a published program, then enter the funds a bug could reach. The reward and the math update as you type.
Size your Critical reward
Critical reward: $2,000,000
Set by the 10% rule.
- Math: 10% × $20,000,000 = $2,000,000
- Minimum and cap: between the $50,000 minimum and the $5,000,000 cap, so it stands
- Effective rate: 10% of the funds at risk
- The percentage takes over above: $500,000 at risk
- The cap binds above: $50,000,000 at risk
- High reward: $10,000 to $25,000
- Safe Harbor bounty on a full rescue: 10% × $20,000,000, capped at $1,000,000 = $1,000,000
The same rule at GMX's terms, worked by hand:
| At risk | 10% | Reward | Set by |
|---|---|---|---|
| $250K | $25K | $50K | Minimum |
| $2M | $200K | $200K | Percentage |
| $20M | $2M | $2M | Percentage |
| $100M | $10M | $5M | Cap |
Benchmarks From Published Programs
These are the smart contract terms on each program's Immunefi page, read on November 6, 2026. Each pays Criticals 10% of the funds directly affected.
| Program | Critical min | Critical cap | High |
|---|---|---|---|
| GMX | $50K | $5M | $10K to $25K |
| Sky | $150K | $10M | $5K to $100K |
| Immunefi's own | $10K | $50K | $5K to $10K |
| SEAL Safe Harbor (rescues: 10% of recovered assets) | None stated | $1M | Not applicable |
They differ on the floor and the ceiling: Sky's minimum is three times GMX's, and its cap is twice as high.
High rewards are fixed ranges, not percentages. Sky and Immunefi cap them at 100% of the funds affected.
Lido and LayerZero also pay 10%, but each page lists two different Critical minimums, so we left them out.
Platform fees and triage differ too. See the best web3 bug bounty platforms.
Caps, Floors and Fixed Tiers
The minimum
At low funds at risk, 10% pays little, so the minimum sets the real reward.
The percentage takes over at the minimum divided by the percentage. At GMX's terms, that is $500,000 at risk.
Pick a floor worth a skilled researcher's time while deposits are small. See when to launch a bug bounty.
The cap
Above the cap divided by the percentage, every Critical pays the cap. At GMX's terms, that is $50 million at risk.
Fund the cap you publish, and raise it as TVL grows. A cap set at launch can fall far behind the funds it protects.
Safe Harbor
SEAL Safe Harbor pays whitehats who rescue funds during an active exploit. SEAL's page sets bounties "at 10% of recovered assets (capped at $1M)".
Its framework advises a Safe Harbor percentage "equal to your bug bounty program's critical exploit payout percentage".
For the cap: "Match or set equal to your bug bounty program's max payout to avoid incentives for malicious behavior."
Fixed tiers
A fixed Critical range, like the High tiers above, is easy to budget. But it does not grow with deposits.
Either way, SEAL's framework asks teams to "Publish transparent reward structure and evaluation criteria."
How Guardian Runs Your Bounty
With Vanguard, Guardian hosts and manages the bug bounty for you, including $50,000 in Critical bounty matching.
You put up $50,000, and Guardian matches it on your bounty.
- Triage: tuned AI triage and known issue tracking, tied to the audit.
- Duration: ongoing.
- Before the bounty: a public Defender contest on the audited scope, with a $100,000 Critical pot Guardian funds.
Under Managed Security, Guardian runs your bounty end to end: hosting, triage and impact validation, severity disputes and a drafted fix.
For scope, KYC and payouts, see how to set up a web3 bug bounty.
Frequently Asked Questions
How much should a Critical bug bounty pay?
The programs we read pay 10% of the funds directly affected, between a minimum and a cap. GMX pays $50,000 to $5 million; Sky pays $150,000 to $10 million. Fund the cap you publish.
Should the reward follow TVL or funds at risk?
Funds at risk. Programs pay on the funds directly affected by the bug; Sky and Immunefi measure them when the report is submitted. TVL is the upper bound, so use it to check your cap.
How should a Safe Harbor bounty relate to my bug bounty?
SEAL advises matching them: your Critical percentage, and a cap equal to your bug bounty's maximum payout, to avoid incentives for malicious behavior. Its own page sets 10% of recovered assets, capped at $1 million.
What does Guardian's bounty matching cover?
With Vanguard, Guardian hosts and manages your bug bounty, including $50,000 in Critical bounty matching. You put up $50,000, and Guardian matches it on your bounty.
Sources
- Immunefi: GMX bug bounty program (updated Nov 5, 2026)
- Immunefi: Sky bug bounty program (updated Sep 19, 2026)
- Immunefi: Immunefi bug bounty program (updated Sep 9, 2026)
- Immunefi: Lido bug bounty program (updated Jun 29, 2026)
- Immunefi: LayerZero bug bounty program (updated Oct 29, 2026)
- Security Alliance: SEAL Safe Harbor (read Nov 6, 2026)
- SEAL Frameworks: Safe Harbor scope terms (read Nov 6, 2026)
- SEAL Frameworks: Bug Bounties (read Nov 6, 2026)
- Guardian: Vanguard
- Guardian: Managed Security
Size your bounty, then let Guardian run it
Vanguard hosts your bounty, triages it against the audit and matches $50,000 on Criticals.