Bug Bounty vs Smart Contract Audit: What Each Catches

Video transcript

A bug bounty does not replace a smart contract audit. Both look at the same code, but they pay for different work.

An audit reviews your whole scope before deployment, for a quoted fee. A bounty pays per valid bug on live code, for as long as it runs.

In our count of Guardian's 320 public audit reports, 57 percent had at least one Critical or High.

Bounties pay for impact, not coverage. Immunefi's defaults exclude centralization risks, leaked keys, bad oracle data and phishing.

Even teams with both get hit. Balancer V2 had eleven audits from four firms, Immunefi notes, yet a rounding bug caused 121.1 million dollars in losses.

Four gaps let losses through: bugs every review missed, upgrades shipped after the audit, attacks neither covers, and rewards that lag the funds at risk.

That third gap is where most money goes. Guardian's analysis of DefiLlama data puts keys, signers, infrastructure and people behind 72 to 74 percent of reported losses in 2024 and 2025.

If code holds user funds or will be upgraded, use both, in order. Audit and fix review, a contest for high value code, then the bounty at mainnet.

Vanguard puts the audit, a defender contest and a Guardian hosted bounty in one engagement. Read the full comparison, or get a quote at guardian.security.

A bug bounty and a smart contract audit look for bugs in the same code. They pay for different work, and that decides what each one catches.

Here they are compared on timing, incentives, coverage and cost, using Immunefi's published data and our count of Guardian's public audit reports.

What an Audit Covers

An audit pays a team to review an agreed scope at one frozen commit, before deployment. The team answers for the whole scope, including the parts that turn out clean.

It reports every severity, plus design and centralization issues. A fix review can then check the changes.

Our count of Guardian's 320 public reports, from March 2022 to October 2026, shows the spread of 9,617 findings:

About two in three findings (65.5%) were Low or Informational. Still, 181 of the 320 reports (57%) had at least one Critical or High.

The limit is time. Immunefi puts it plainly: an audit "is a snapshot." It does not cover code changed after the review.

What a Bounty Covers

A bounty pays outside researchers for each valid finding in deployed code. It keeps running, in Immunefi's words, "for as long as your program runs."

It pays for impact, not coverage. Immunefi's severity system rates direct theft of user funds, permanent freezing of funds and protocol insolvency as Critical.

Its recommended defaults also mark these out of scope, though each program sets its own list:

• Best practice recommendations.
• Attacks that need privileged addresses or leaked keys.
• Centralization risks.
• Incorrect data from third-party oracles.
• Phishing and social engineering of the team or users.

Some programs pay nothing for Low findings. GMX's Immunefi program, for example, lists rewards only for Critical, High and Medium.

What the long tail finds

Time is the bounty's strength. In Immunefi's April 2026 study of 593 bug bounty programs, the share that had paid for a confirmed Critical rose with time live:

• One year or more: 61.4%.
• Three years or more: 87.2%.
• Five years or more: 93.9%.

Immunefi reports $107.3 million paid for confirmed Criticals. The median Critical payout was $20,000, and the mean $114,355.

Side-by-Side Comparison

The two differ on every axis that sets coverage:

On cost, Immunefi charges a 10% platform fee on payouts unless you buy its subscription.

A bounty's real cost is the cap you publish. Fund it before launch.

Why Teams With Both Get Hit

A clean audit and a quiet bounty are evidence, not proof. Four gaps let losses through.

Bugs the reviews missed

On November 3, 2025, a rounding bug in Balancer V2's Composable Stable Pools caused $121.1 million in losses, by Balancer's own post-mortem.

Immunefi notes Balancer had been audited eleven times by four firms, and says the bug survived every review.

Code that changed

An upgrade shipped after the audit carries no audit. A bounty covers it only once it is added to scope and someone looks.

Attacks neither one covers

Immunefi's default out-of-scope list includes phishing and leaked keys. Audits review code, not who holds the keys.

That gap is where most money goes. Guardian's analysis of DefiLlama data found keys, signers, infrastructure and people caused 72% to 74% of reported losses in 2024 and 2025.

The full split is in onchain vs offchain attacks.

Rewards and triage that lag

Immunefi's study puts the median onchain hack in 2024 and 2025 at $2.2 million stolen. Its median Critical payout was $20,000.

So tie Critical rewards to the funds at risk. GMX pays Criticals 10% of the funds directly affected, up to $5 million.

Volume is the other strain. Immunefi says reports to its programs rose 135% in 2025, and half were noise on its Managed Triage programs.

Use Both When

Use both when any of these is true:

• The code will hold user funds from day one.
• It is new, or forked with changes.
• You plan upgrades after launch.
• It integrates oracles, bridges or other protocols.

Run them in order: audit and fix review, a contest for high-value code, then the bounty at mainnet. When to launch a bug bounty covers each step.

Then keep each one covering the other's gap:

• List acknowledged audit findings as known issues in the bounty.
• Raise the Critical cap as deposits grow.
• Re-audit material upgrades, then add them to the bounty scope.

Setup details are in how to set up a web3 bug bounty. With or without a bounty, publish a vulnerability disclosure policy.

How Guardian Runs Both

Vanguard puts the audit and the bounty in one engagement:

• Audit: two teams, one with manual review and invariant fuzzing, one with Helix, Guardian's AI auditor.
• Defender contest: a $100,000 Critical pot on the audited scope, funded by Guardian.
• Bug bounty: hosted by Guardian, with $50,000 in Critical matching.
• Triage: tuned AI that tracks known issues from the audit.
• Updates: six months of review after launch, up to 2,500 onchain SLOC.

With Managed Security, Guardian runs the bounty end to end: hosting, triage, severity disputes and a drafted fix.

Frequently Asked Questions

Do I need a smart contract audit if I have a bug bounty?

Yes. A bounty pays only for valid, in-scope bugs that researchers choose to report on live code. An audit assigns a team to your whole scope before launch, reports every severity and reviews the fixes.

Is a bug bounty cheaper than an audit?

Not necessarily. An audit is a fee quoted on scope and time. A bounty pays per valid bug, plus any platform fee, and you must fund the cap you publish. Immunefi reports a median Critical payout of $20,000.

What does a bug bounty not cover?

Immunefi's recommended defaults exclude best practice recommendations, attacks needing privileged addresses or leaked keys, centralization risks, bad data from third-party oracles, and phishing or social engineering. Some programs, such as GMX's, pay nothing for Low findings.

Should audit findings be in a bug bounty's scope?

List acknowledged audit findings as known issues, so no one is paid for a bug you already know about. Fixed findings need no entry, but the fixed code should stay in scope.

Sources

• Immunefi: Bug Bounty Program (read November 5, 2026)
• Immunefi: Homepage, platform statistics (read November 5, 2026)
• Immunefi: Nearly Every Long-Running Bug Bounty Program on Immunefi Has Found a Critical Bug (April 20, 2026)
• Immunefi: Vulnerability Severity Classification System v2.3
• Immunefi: GMX bug bounty program (updated November 5, 2026)
• Balancer: Nov 3 Exploit Post-Mortem (November 18, 2025)
• Guardian: Public audit portfolio, 320 reports (counted November 5, 2026)
• Guardian: Onchain vs Offchain Attacks: Where Hack Losses Came From (November 2026)
• Guardian: Vanguard
• Guardian: Managed Security