How to Set Up a Web3 Bug Bounty Program

By the Guardian team Updated November 2026 5 min read

Quick answer. Define scope and known issues, publish a severity table tied to funds at risk, and choose a platform or self-host. Then staff triage, set KYC and payout rules, adopt SEAL Safe Harbor and publish a disclosure policy.

Watch: How to Set Up a Web3 Bug Bounty Program 1:43

Video transcript

An audit reviews one commit. A bug bounty keeps running, but only when scope, rewards and triage match the risk.

Define scope, publish a severity table tied to funds at risk, pick a platform, staff triage, then adopt SEAL Safe Harbor.

Write scope as assets. List every contract by chain, what is out of scope, known audit findings, and banned actions like mainnet testing.

Size the top tier to the money at risk. GMX pays Criticals ten percent of funds directly affected, from fifty thousand dollars to five million. Fund what you publish.

A platform brings researchers and runs payouts. Self-hosting gives full control, but SEAL notes it takes significant ongoing time and skilled triage.

Triage is where programs strain. On Cantina, Coinbase's program has drawn 1,873 findings since July 2025.

Name owners for intake, validation, rating, fixes and closing the loop. Require a proof of concept, as GMX does at every severity.

A bounty covers bugs before an exploit. SEAL Safe Harbor covers the exploit itself, pre-authorizing whitehats to rescue funds and return them within 72 hours.

With Vanguard, Guardian hosts the bounty, runs tuned AI triage, matches your fifty thousand dollars on Criticals, and funds a one hundred thousand dollar Critical pot in a public Defender contest.

Read the full guide for KYC, payouts and disclosure, or talk to Guardian about Vanguard.

A bug bounty pays outside researchers for valid reports on live code. An audit reviews one commit; a bounty keeps running.

Setup decides whether it works. In the Security Alliance (SEAL) framework's words, bounties work "when scope, rewards, and triage capacity match the asset risk."

Here is each step, from scope to Safe Harbor. For timing, see when to launch a bug bounty.

Define Scope and Rules

Scope is a list researchers can test against. Write it as assets, not product names:

Contracts: each deployed address, by chain, with verified source.
Offchain assets: the web apps, APIs and keepers you want tested, if any.
Out of scope: third-party contracts, oracles and anything you do not control.
Trusted roles: whether exploits that need admin keys count.
Known issues: every acknowledged audit finding, so none is paid for again.
Prohibited actions: mainnet and public testnet testing, phishing and denial of service.

GMX's Immunefi program shows the pattern. It lists known issues, including findings from Guardian audit reports, and excludes exploits that need its Timelock or Fast Price Feed admin keys.

It also bars mainnet testing in favor of local forks.

Keep the list current. SEAL says to update scope "when features ship or systems retire."

Set Severity and Rewards

Publish a severity standard so researchers know the rules before they dig. Immunefi's Vulnerability Severity Classification System (v2.3) is one public option.

Its Critical smart contract impacts include:

Direct theft of any user funds, at rest or in motion, other than unclaimed yield.
Permanent freezing of funds.
Protocol insolvency.
Governance results changed from the voted outcome.

Then size the top tier to the money at risk. GMX pays Criticals 10% of the funds directly affected, capped at $5 million, with a $50,000 minimum.

Its full table:

Severity	Smart contracts	Websites and apps
Critical	10% of funds affected, $50,000 to $5,000,000	$10,000 to $50,000
High	$10,000 to $25,000	$5,000
Medium	$2,500 to $10,000	$1,000

Fund what you publish. HackenProof, for example, shows researchers whether a company has funded its bounty deposit.

For how severities are defined in audits, see smart contract audit severity levels.

Choose Platform or Self-Hosted

A platform brings researchers and runs intake and payouts. Self-hosting means you write the policy, watch the inbox and pay from your own treasury.

SEAL lists the tradeoffs of running it yourself:

For: full control over scope, rewards and rules, and possibly lower cash outlay.
Against: "significant ongoing time" to run intake, triage and payouts.
Against: the need for skilled triage, and the risk of overload from low-quality reports.

Either way, keep a durable security contact, so reports still reach you if platform settings change.

We compare platform fees, triage and KYC in Best Web3 Bug Bounty Platforms in 2026.

Staff Triage and Response

Triage is where programs strain. Coinbase's onchain program on Cantina shows 1,873 findings submitted since it opened in July 2025.

Name an owner for each step before launch:

Intake: a monitored security contact and a .well-known/security.txt file.
Acknowledge: SEAL notes teams often target 24 hours.
Validate: require a proof of concept, as GMX does at every severity.
Rate: one owner sets severity against your published table.
Fix: engineers on call who can patch and redeploy.
Close: tell the researcher what changed, as SEAL recommends.

Publish response targets and meet them. HackenProof says it delists companies that do not follow their program SLA.

Write a rule for AI-generated reports, too. Our exchange bug bounty benchmark shows how Kraken, OKX and Coinbase word theirs.

KYC, Payouts and Disclosure

KYC and payouts

Decide who must prove identity, and when. Coinbase's Cantina program, for example, requires KYC to join, not only to get paid.

Then state the rest of the payout terms:

The currency and chain you pay in.
Who pays: the platform, or your team directly.
Any tax forms or payment details you need.
How many business days you take to pay.

Disclosure

SEAL's rule of thumb: keep reports confidential until a fix is in place, then publish on a deliberate timeline.

Your policy should state:

Whether researchers may publish, and after how long.
Who approves the write-up.
Whether researchers are credited (SEAL says only with their permission).
Safe harbor for good-faith research that follows the rules.

Platforms set defaults. HackerOne's default setting makes a resolved report public within 30 days unless either side objects.

Adopt SEAL Safe Harbor

A bounty covers bugs reported before an exploit. SEAL Safe Harbor covers the exploit itself.

It is an onchain agreement that pre-authorizes whitehats to rescue funds during an active exploit. They must return rescued funds to your recovery address within 72 hours.

The terms you set:

Recovery address: a secure smart contract wallet, such as a Safe.
Assets in scope: contracts by chain, with or without child contracts.
Bounty percentage: SEAL calls 10% the industry standard.
Bounty cap: SEAL recommends matching your bug bounty's maximum.
Retainable: whether the whitehat deducts the bounty or returns everything first.
Identity: anonymous, pseudonymous or named; named adds KYC and sanctions screening.

A DAO can adopt it with a governance vote and onchain registration. SEAL lists 33 adopters covering more than $60 billion in assets.

For the rest of an incident, see our DeFi incident response plan.

What Vanguard Takes Off Your List

With Vanguard, Guardian hosts and manages the bounty, so several of these steps come with the audit:

Known issues: triage tracks what the audit already found.
Triage: tuned AI triage, run by Guardian.
Rewards: Guardian matches your $50,000 on Criticals.
Contest: a public Defender contest on the audited scope, with a $100,000 Critical pot Guardian funds.

Whether a contest suits your code is covered in audit contest vs private audit.

Frequently Asked Questions

How much should a web3 bug bounty pay?

Tie the top reward to the funds at risk. GMX, for example, pays Criticals 10% of the funds directly affected, from $50,000 up to $5 million. Whatever cap you publish, fund it.

What should a web3 bug bounty scope include?

Every deployed contract address by chain, plus any web apps or APIs you want tested. Then list what is out of scope, every known issue, whether admin-key exploits count, and banned actions such as mainnet testing.

Should a bug bounty require a proof of concept?

Yes. A working proof of concept lets one owner confirm severity quickly. GMX requires one at every severity, built on local forks rather than mainnet or public testnets.

What is the difference between a bug bounty and SEAL Safe Harbor?

A bounty rewards reports made before an exploit. SEAL Safe Harbor pre-authorizes whitehats to rescue funds during an active exploit and return them within 72 hours, for a bounty set in advance.

Sources

Hand your bounty setup to your auditor

Vanguard hosts the bounty, triages against known audit issues and matches $50,000 on Criticals.

Talk to Guardian Explore Vanguard