Horizen is an EVM-native, privacy-first blockchain ecosystem: an OP Stack L3 that settles to Base, enabling regulatory-compliant, auditable private execution for onchain businesses and privacy-minded users. ZEN, the ecosystem's governance and utility token, lives as an ERC-20 on Base and on the Horizen L3. This bug bounty program focuses on the official ZEN staking program: the ZenStaker smart contracts and the staking web application.
Runnable PoC Required
KYC required
Rewards
Rewards by Threat Level
Mainnet assets:
Reward amount is 10% of the funds directly affected up to a maximum of:
$10,000Minimum reward to discourage security researchers from withholding a bug report:
$5,000Phase A (testnet, 2026-07-21 to 2026-07-27)
Flat rewards $5000 for criticals; funds-at-risk is meaningless on testnet, so severity is judged by the mainnet impact of the same code.
Phase B (mainnet, from 2026-07-27)
Smart-contract Critical is priced by funds at risk. Principal-affecting criticals (funds at risk = staked principal) pay 10% of funds directly affected, capped at $10,000, measured at submission time. A minimum reward of $5,000 is offered for criticals.
Reward-buffer-limited criticals (funds at risk bounded by the RewardAccumulator balance, at most about one 30-day window) pay a flat $3,000; a pure percentage would understate the severity of a bug in the accumulator, which never holds principal and is flushed on a fixed schedule.
Non-critical tiers remain fixed as configured.
KYC is required before payout: valid reporters must complete identity verification before a bounty is paid.
Program Overview
Horizen completed its migration from its legacy chains (ZEND mainchain and the EON EVM sidechain, both now deprecated) to Base on July 23, 2025. ZEN now exists as an ERC-20 on Base (0xf43eB8De897Fbc7F2502483B2Bef7Bb9EA179229) and on the Horizen L3 via LayerZero OFT (0x57da2D504bf8b83Ef304759d9f2648522D7a9280). The Horizen L3 (chain ID 26514) is an OP Stack rollup deployed with Caldera that settles to Base, inheriting Ethereum security; gas is paid in ETH.
This program covers the ZEN staking system approved by the Horizen DAO (ZenIP-42408). Users stake ZEN on the Horizen L3 to earn ZEN rewards funded by multiple independent sources (Horizen DAO bootstrap and LP earnings, zkVerify node emissions, L3 sequencer fees, and — as they come online — ecosystem protocol fee sharing and Vela confidential compute revenue).
The staking contracts are built on the audited Tally/ScopeLift Staker framework. Horizen's additions are deliberately minimal: a non-upgradeable concrete implementation (ZenStaker) with view-only helper functions, and a RewardAccumulator contract that buffers rewards from multiple sources and forwards them to the Staker on a fixed schedule. The staking frontend is a fully client-side static dApp (no backend): all state is read from the chain and a public Goldsky subgraph, and all writes are transactions signed by the user's own wallet.
Network information:
| Horizen Mainnet | Horizen Testnet | |
|---|---|---|
| Chain ID | 26514 | 2651420 |
| Settlement layer | Base | Base Sepolia |
| RPC (HTTPS) | https://horizen.calderachain.xyz/http | https://horizen-testnet.rpc.caldera.xyz/http |
| Block explorer | https://horizen.calderaexplorer.xyz/ | https://horizen-testnet.explorer.caldera.xyz/ |
| Gas token | ETH | ETH |
| Bridge / faucet | https://horizen.hub.caldera.xyz/ | https://horizen-testnet.hub.caldera.xyz/ |
| ZEN token (on Horizen) | 0x57da2D504bf8b83Ef304759d9f2648522D7a9280 (LayerZero OFT) | tZEN: 0xb06EC4ce262D8dbDc24Fac87479A49A7DC4cFb87 (LayerZero OFT) |
| ZEN token (on settlement layer) | 0xf43eB8De897Fbc7F2502483B2Bef7Bb9EA179229 (Base) | tZEN: 0x107fdE93838e3404934877935993782F977324BB (Base Sepolia) |
| ZEN bridge | via Stargate/LayerZero | https://tzen-bridge.horizen.io/ |
During Phase A the in-scope deployment is on Horizen Testnet; researchers can obtain testnet ETH via the faucet and tZEN via the testnet bridge. These parameters are provided for local forking and environment setup — per the PoC policy, exploit transactions must never be broadcast to either network.
Audits
Known Issues
KYC required
The submission of KYC information is a requirement for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 2: Notice Required
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.
101k