Definition
A public program that pays security researchers for responsibly reporting vulnerabilities in deployed code. It complements, rather than replaces, an audit.
Why it matters
A bounty keeps working after launch, when the audit is over and the code keeps changing. Rewards must be high enough that reporting a critical bug is clearly more attractive than exploiting it.
What to check
- Define the scope, severity levels, reward ranges and safe harbor before announcing it.
- Launch it after the audit, not instead of it.
Related terms
- Audit (smart contract audit)An independent security review of a program at a specific commit, usually by a specialised firm, that reports vulnerabilities and recommendations before launch.
- Upgrade authorityThe key allowed to replace a deployed program’s code.
- MultisigA wallet that requires approval from several signers before executing a transaction.
Guides
- Smart contract audit vs bug bounty: which do you need, and when?Audits and bug bounties catch different bugs at different times. How each works on Solana, what they cost, and how to combine them before and after mainnet launch.
- How to choose a Solana smart contract auditor: a practical checklistWhat actually matters when picking a Solana auditor: Anchor and native Rust experience, methodology, scope, timelines, red flags in quotes and what a good report looks like.
- Solana pre-launch security checklist: 15 checks before mainnetA practical checklist for launching a Solana program on mainnet: upgrade authority, multisig, verifiable builds, token authorities, monitoring, incident response and the audit.
Get an indicative price range and timeline for auditing your Solana programs, then compare verified auditors.
Estimate your audit cost →