Immunefi Credits: Backing Hunters Who Find Valid Bugs

Immunefi Credits are live, and more than 700 researchers already have theirs.

You asked what happens to your fee when a valid report is closed as a duplicate. You found a valid bug, and someone else reported it first. From today, you receive credits equal to that fee, ready for your next submission.

The same applies to every valid report you've paid to submit since fees began. Your own valid findings and duplicates of valid reports count. So do private known issues and mediations decided in your favor.

There's nothing to claim and no form to fill out. Your credits are on your Credits page, linked from the balance in the top right of your dashboard.

How credits work now

From today, credits are how you pay for everything on Immunefi, including submissions, mediation, account verification, and Immunefi Studio once it opens to the public. One credit is worth $1, and you can buy credits with USDC. Valid work earns them too.

Credits never replace bounty rewards. Bug bounty and audit competition rewards are paid exactly as before, and for a valid finding, you get the reward plus credits equal to your fee.

Today's backdated credits get a full 12 months from today. Every credit lasts 12 months from the day it is added to your account, earned or bought. Credits are tied to your account, so they can't be transferred or cashed out.

What changed this year

AI tools make it faster to find bugs and faster to write reports. On Immunefi, unique valid findings doubled from January to September, and submissions grew faster still. More valid findings at that volume need new systems to handle them fairly. Our triage separates valid findings from the rest, and credits back the researchers who find them.

The rules

What earns credits

You receive credits equal to your submission fee when your report is:

• valid: your own finding, once it's paid in a bug bounty or confirmed in an audit competition, insights included;
• a duplicate of another researcher's valid report, however many people found it;
• a private known issue, including a duplicate of one;
• decided in your favor in mediation. You also receive credits for the mediation fee.

Sometimes a protocol knows about a bug but can't disclose it until it's fixed. A fix can take months. Protocols register those issues with us. If your report matches one, you couldn't have known, so you receive credits for the fee.

Public known issues were already disclosed, on GitHub or in a published audit, for example. Checking for them is part of the research, so they don't earn credits.

Known-issue closures show a registration date or a public source. If one shows neither, the issue counts as private, and you receive credits for the fee. Closures from before July 2026, when tracking began, may show neither. You also receive credits for the fee if the issue was registered after you submitted.

The verification fee

If you paid to verify your account, you can receive credits for that fee too. Verification keeps throwaway accounts off the platform. A track record does the same job. So you receive credits equal to the verification fee once you have both:

• a valid report after verifying;
• an accuracy of at least 25%.

Your accuracy is the share of your reports that are valid. The 25% can come from either bug bounties or audit competitions. We'll monitor that threshold and adjust it if needed.

Verification will remain free with Human Passport. Human Passport uses your onchain activity and more, not just a passport.

What doesn't earn credits

• reports closed as invalid, out of scope or for a policy violation;
• duplicates of a rejected report: they aren't valid either;
• duplicates of your own report: the finding counts once, on the original;
• public known issues: they were already public when you submitted.

Timing and expiry

Before we add a credit, we check the report's outcome. For a duplicate, we also check the original. If either is later found valid, the credit is added at the next check. For now, these checks run every two weeks, so once a report is valid, its credit can take up to two weeks to appear. We're automating the checks, and after that, credits will arrive without the wait.

In audit competitions, credits depend on the results. A report counts once it's confirmed.

Every credit lasts 12 months, and your Credits page shows each credit's expiry date. Your oldest credits are always spent first.

The full rules are in the Credits article in our Help Center.

Why now

Researchers have asked for this since the day fees began. We collected enough data to set fair rules, built the systems to apply them to every report, and listened to how researchers responded to fees.

Crediting every fee-paid valid report at this volume needed tooling we didn't have at the start of the year:

• labeling duplicates of valid bug bounty reports, since April;
• tracking private known issues, since July;
• showing the original report behind a duplicate closure, since September;
• recording mediation outcomes.

With those in place, we can credit every fee-paid valid report since fees started. That's March 24 for bug bounties and April 10 for audit competitions.

What comes next

• Every two weeks: new credits, until we automate the process.
• #credits on Discord: questions and feedback on the program. Credits depend on each report's outcome, so disputes about a closure still go through mediation.
• If a credit looks wrong: open a support ticket and choose the credits review option.

Keep hunting, and keep earning credits. The Plether audit competition launches later today, and more competitions are on the way.

Read the full rules · Join #credits on Discord