ENS (Ethereum Name Service) is a distributed, open, and extensible naming system based on the Ethereum blockchain. ENS maps human-readable names like 'alice.eth' to machine-readable identifiers such as Ethereum addresses, other cryptocurrency addresses, content hashes, and metadata. It functions as a decentralized alternative to the traditional DNS, allowing users to replace long, complex wallet addresses with simple, memorable names.
Built on a system of smart contracts, ENS supports both the '.eth' top-level domain native to Ethereum and the integration of traditional DNS names. Its architecture is composed of two principal components: the registry, which maintains the record of all domains and their owners, and resolvers, which are responsible for translating names into the corresponding addresses or resources.
Live
Triaged by Immunefi
Step-by-step PoC Required
Vault program
KYC required
This Audit Competition Is Live!
| Milestone | Date |
|---|---|
| Announcement | Aug 10, 2026 |
| Launch (competition goes live) | Aug 18, 2026 |
| Competition ends | Sep 14, 2026 |
| Project deadline to resolve all reports | Sep 20, 2026 |
| Results frozen and calculated | Sep 28, 2026 |
| Final 48-hour dispute deadline | Sep 29, 2026 |
| Payment complete | Oct 26, 2026 |
| Results published | Oct 26, 2026 |
Immunefi vault program
Rewards
Rewards by Threat Level
Rewards Terms
Rewards are distributed among SRs according to Immunefi’s Standardized Competition Reward Terms and includes All Star Pool and Podium Pool reserved for All Star Program participants.
Rewards are denominated in USD and distributed in USDC on ETH.
The reward pool is determined by the greatest severity bug found.
- A Critical is found - $70,000 USD
- A High is found - $50,000 USD
- A Medium or Low is found - $30,000 USD
If not a single security vulnerability is found (Insights do not count as bugs) the reward pool is $3k USD.
Private Known Issues Reward Policy
Private known issues — known issues that were not publicly disclosed — are valid for a reward at their full severity. They unlock reward pools as though they were one severity level lower; however, the severity level of the private known issue itself remains unchanged, and researchers earn their portion of the reward pool and their position on the leaderboard according to that unchanged severity level.
Public known issues are invalid.
KYC Requirement
ENS requires KYC information to pay for bug submissions. The following information will be required:
- Full name
- Date of birth
- Proof of address (either a redacted bank statement with address or a recent utility bill)
- Copy of Passport or other Government issued ID
Security researchers are required to submit KYC within 7 days of KYC being requested, else their rewards may be forfeited. Immunefi may make exceptions due to extenuating circumstances.
For the full process, see KYC Process for Audit Competitions (link: https://immunefisupport.zendesk.com/hc/en-us/articles/32264466580497).
Program Overview
This audit competition covers the ENS Manager and Explorer applications. Both are new applications built from scratch.
Scope
The scope is limited to the Manager and Explorer apps as designed. It does not include code from imported libraries or the underlying infrastructure. Researchers should keep the following boundaries in mind:
- Third-party dependencies: unmodified third-party dependencies are out of scope. Modifications to third-party dependencies are in scope (for example, a modified wallet connector).
- Third-party services: services such as Cloudflare and testing suites are out of scope.
Prioritized vulnerabilities
Our primary concern is any bug that could lead to a loss of user funds. In particular, vulnerabilities where the application could:
- direct users to transfer funds to an address other than the intended one,
- cause a user to reveal their private key to a third party, or
- cause a user to install software on their machine that could facilitate the theft of personal or private information.
We are also concerned with the transaction-construction and smart-account/session-key paths (packages/transaction-manager, packages/smart-account): anything that lets a transaction be built, signed, or attributed with the wrong chain, sender, target address, or arguments.
Token standards
- ENS names are ERC-1155 (wrapped v1 names and all v2 names) or ERC-721 (unwrapped v1
.ethnames, via the BaseRegistrar). - A name can be registered using an ERC-20 stablecoin.
Chains and networks
Ethereum Sepolia is the primary network. Resolution and primary-name flows also read and write the Sepolia testnets of Optimism, Arbitrum, Base, Linea and Scroll.
External dependencies
- Rhinestone (
@rhinestone/sdk) - Ensjs (this version) —
@ensdomains/ensjs&@ensdomains/ensjs-abi - Wagmi
- Viem
Program Assurances & Guarantees
🎯 Asset Accuracy Assurance
Bugs found on assets that are incorrectly listed as in-scope are considered valid.
🧊 Code Freeze Assurance
Code for in-scope assets is strictly frozen while the program is live.
- Immediate Fixes: If a bug found during the competition requires an immediate patch, it will be considered a publicly known issue as soon as the fix is deployed.
- Post-Fix Submissions: Submissions of the same bug received after the fix is public are considered duplicate valid.
- Fix Bypasses: Bypassing a deployed fix is considered a new, valid bug.
- Duplicates: Duplicate submissions of bugs are valid. Duplicate submissions of Insights are invalid.
🔒 Confidentiality Commitment The project commits to keeping all information related to bug findings completely private until this program concludes. No details regarding bug findings or planned fixes will be leaked, including findings discovered independently or through concurrent private audits.
Standardized Rules
This program follows Immunefi's standard competition rules. For the full default rules on validity, duplicates, known issues, severity, disputes, KYC, payments, and publication, read How Audit Competitions Work: Rules and Policies. Where this program page defines a specific rule, the program page prevails.
Insight Reporting
- Insight reports may be submitted to this program. Runnable code is not required, but the PoC section must describe the conditions under which the insight is valuable.
- Only the best report of a given Insight is rewarded. Duplicates of Insights are not rewarded.
- Insights are rewarded according to Immunefi's Standardized Competition Reward Terms and are not eligible for mediation or appeal.
Dispute Resolution
- Disputes may only address report validity, duplicate determinations, and severity.
- If a researcher disagrees with a closure decision while the competition is live, they may request mediation. A mediation fee, set by Immunefi, is required to initiate the review.
- After the evaluation phase, a dispute period opens for appealing decisions. Immunefi announces a final 48-hour deadline for the last disputes. Once the window closes, results are final.
- Immunefi has final say on validity, duplicates, and severity, based on the terms of this program. Insights are not eligible for mediation or appeal.
Responsible Publication Policy
Immunefi will publish bug reports, earnings, and a leaderboard for this Audit Competition. Security researchers may publish their bug reports as well, but only after Immunefi has published the results as part of the competition results.
Eligibility Criteria
Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
- On OFAC's SDN list
- An official contributor, past or present
- Employees and/or individuals closely associated with the project
- Security auditors that directly or indirectly participated in an audit review of the code in scope (such auditors may participate only if they receive project permission)
- From a restricted country or territory per Immunefi's Terms of Use
- Under 18 years of age. Participants under 18 cannot pass KYC and will not receive rewards.
Submission Fees
A submission fee, set and managed by Immunefi, applies to each report and is shown at submission time. If a researcher disagrees with a closure decision, initiating a mediation also requires a fee set by Immunefi.
Known Issues
Reports covering previously identified bugs listed below are not eligible for rewards under this program.
This includes:
- Known issues that the project is aware of, even if no fix or code changes have been implemented.
- Issues the project has consciously decided not to remediate.
- Cases where operational mitigations or procedures have been implemented to reduce potential risk.
KYC required
The submission of KYC information is a requirement for payout processing.
Additional information: KYC & Wallet OFAC SDN screening for every receiver.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 3: Approval Required
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.