Solana
Counted from the day each project's bug bounty went live on Immunefi. A bug bounty keeps genuine researchers on your code after the audit.
57 critical vulnerabilities reported on the bug bounty programs of projects building on Solana
685 days from the bug bounty going live to the median critical vulnerability on those programs
93% of crypto's critical vulnerability disclosures flow through Immunefi
99.3% of the reports our triage closed stayed closed after review
Raydium, Orca, Marinade and Pyth run their bug bounty programs on Immunefi.
SolutionThree paths
Path A
Funds have sat in your code every day since your audit, and the upgrades you shipped after it were outside its scope. A bug bounty keeps researchers testing that code while it holds funds.
Path B
Reports to Immunefi programs rose 135% in 2025. If yours land in an inbox, on a GitHub page or on another platform, moving the program to Immunefi lets you put triage in front of every report, so your engineers only see the reports that need their review. When millions are at stake, who's finding your critical vulnerabilities matters.
Path C
A new program or upgrade holds funds from its first day. An audit competition puts hundreds of researchers on the new code before launch, and your bug bounty covers it once it is live.
Meeting us at Breakpoint? We're in London for Breakpoint, 15 to 17 November. Tell us you'll be there, and we'll set a time.
Solution01/ 05After the audit
Each upgrade since then is code the audit never saw, and the code you have not touched stays a target. On Solana projects' bug bounties, the median critical vulnerability was reported 685 days after the bug bounty went live.
In March 2025, a researcher on Raydium's Immunefi bug bounty found a critical vulnerability in its cp-swap program, which was audited in early 2024. Deposits did not validate the amounts users sent, so an attacker could drain liquidity pools. The report came 685 days after the bug bounty went live. Raydium fixed the bug and paid the researcher $505,000 in USDC.
Researchers are paid only for valid bugs, and the majority of Solana bug bounty programs on Immunefi require a proof of concept for critical reports. With triage, our agent runs it before your team sees the report.
Solution02/ 05Triage
AI-written reports now look plausible at first read. Every one your engineers open is time away from shipping, and the critical one waits in the same pile.
Triage removes spam, duplicates and out-of-scope reports. It can also check each report against your code, known issues and documentation, verify the claimed impact, and propose a severity, so your team gets a brief it can act on. In the 12 months to October 2026, our triage closed 89% of the reports sent to Alchemix before they reached its team.
Solution03/ 05Launching
A new program or upgrade is code no one outside your team has tested. Find its bugs while they are still a code change.
In an audit competition, hundreds of researchers review the new code for a fixed window before launch, and triage is included. You set the scope, the reward pool and the dates, and your bug bounty covers the code from launch day.
Tier-1 private audits found a critical vulnerability in 1 of 6 engagements.
Immunefi audit competitions found one in more than 1 of 2.
Solution04/ 05How it works
Rewards go in full to researchers.
Solution05/ 05Questions
Weigh the price against the funds in your program. In 2024 and 2025, the average onchain hack took $24.5M, and the median bounty paid on Immunefi is about $20,000. Start with the programs that hold the most funds, and add scope as you ship.
On the bug bounty programs of projects building on Solana, 6 in 10 critical vulnerabilities came a year or more after the bug bounty went live. Raydium's $505K critical vulnerability was reported on day 685, in audited code.
They earned $11.8M on Solana projects' bug bounties, $9.9M of it for critical vulnerabilities, the severity that covers direct theft or permanent freezing of funds.
It removes spam, duplicates and out-of-scope reports, and it can check each report against your code and propose a severity. 99.3% of the reports our triage closed stayed closed after review.
Webhooks send new reports and updates to Slack, or to any system that accepts JSON.
With triage, the reports that need your review are escalated to you. Your team decides which reports are valid. If a researcher disputes your decision, Immunefi mediates.
End of fileSolanaSolution ยท By ecosystem
Whether you are live with no bug bounty yet, drowning in slop, or about to ship, we set up the program on your rules and launch it to our researchers.
If your priority is the lowest price, we're probably not the right fit. If it's protecting everything you've built, let's talk.
