Bug Bounty Calculator
Plan bounty program costs and reward structures
Protocol Details
Bounty Platform
Reward Structure
Expected Reports (Annual)
Annual Budget
Expected Payout Breakdown
Reward Competitiveness
ROI Analysis
Severity & Reward Guidelines
| Severity | Impact | Typical Range | Top Protocols | Examples |
|---|---|---|---|---|
| Critical | Direct fund loss | $50K-$500K | $1M-$10M+ | Drain funds, infinite mint |
| High | Significant damage | $10K-$50K | $50K-$200K | Theft with conditions, DoS |
| Medium | Limited impact | $2K-$10K | $5K-$25K | Griefing, minor leaks |
| Low | Minor issues | $500-$2K | $1K-$5K | Info disclosure, best practices |
Bug Bounty Platform Comparison
Immunefi
- • 10% fee on payouts
- • Crypto-native researchers
- • $100M+ in bounties
- • Managed triage available
HackerOne
- • Subscription model
- • Largest researcher pool
- • Enterprise features
- • Better for web2
Sherlock/Code4rena
- • Contest model
- • Fixed timeframe
- • Multiple auditors
- • Competitive pricing
When to Use This Calculator
Set Annual Budget
Launching a bounty program? Calculate how much to allocate annually including reserves and platform fees.
Benchmark Rewards
Are your payouts competitive? Compare against industry standards to attract top researchers.
Scale with TVL
TVL grew from $10M to $100M? Recalculate rewards to match your increased risk profile.
Platform Selection
Immunefi vs HackerOne? Compare platform fees and find the best fit for your protocol.
ROI Justification
Presenting to your DAO? Show the cost vs potential loss prevented to justify the budget.
Governance Proposals
Proposing a bounty program to your DAO? Generate concrete numbers for the proposal.
Frequently Asked Questions
When to start a bounty program?
After audit, before or at mainnet launch. Don't wait until you have TVL - researchers need time to review. Launch with $0 TVL is fine.
How to handle invalid reports?
Clear scope reduces noise. Use managed triage (Immunefi offers this). Respond within 48 hours. Be respectful even for invalid reports - reputation matters.
Pay in tokens or stables?
Stables preferred by researchers. Token payments often get dumped immediately. If using tokens, add a premium (20-50%) to compensate for volatility.
What if we can't afford high payouts?
Start with what you can. $10K critical is better than nothing. Scale up as TVL grows. Be transparent about your stage - researchers understand.
Bounty vs audit - which first?
Audit first. Bounties are ongoing, audits are point-in-time. Launch bounty after audit to catch what auditors missed. Both are essential.
How to attract researchers?
Competitive payouts, clear scope, fast response times, good documentation. Researchers talk - bad reputation spreads fast.
No comments yet. Be the first to share your thoughts!