BUG BOUNTIESLivepeer Bug Bounty on Immunefi
The authoritative source for scope, reward tiers, rules, and submission instructions.
PROGRAMME OVERVIEWProgramme Overview
- Scope: Smart contracts only. The programme does not currently cover websites, apps, or off-chain infrastructure.
- Rewards: Paid in USDC on Ethereum, denominated in USD.
- KYC: Required for all reporters claiming a reward. You will need to provide visual proof of identity.
- Proof of Concept: Required for all severity levels. Submissions without a PoC will not be considered.
- Triage: Since early 2025, the Immunefi triage pipeline has been operated by the Protocol R&D SPE (Sidestream), which processes incoming reports and ensures response-readiness.
SEVERITY & REWARDSSeverity Levels and Rewards
Rewards are distributed according to the Immunefi Vulnerability Severity Classification System (V2.2), a five-level scale covering both the consequence of exploitation and the likelihood of a successful attack.Critical
Rewards are capped at 10% of the economic damage caused, with the primary focus on possible loss of funds for Orchestrators, Delegators, and Broadcasters at the smart contract level.If there is a repeatable attack, only the first attack is considered unless further attacks cannot be mitigated via an upgrade or pause.
High
Rewards for High severity vulnerabilities depend on the amount of unclaimed yield at risk and how long funds could be frozen.
Focus Areas
The programme focuses on preventing:- Direct theft of user funds (at-rest or in-motion, excluding unclaimed yield)
- Unexpected calls to privileged functions (for example, functions that should only be callable by the Governor contract)
- Any condition that results in permanent freezing of user funds
SCOPEScope
The programme covers Livepeer’s deployed smart contracts on Ethereum and Arbitrum. See the full scope listing on Immunefi for the definitive list of in-scope assets and contract addresses.Out of Scope
The following are explicitly excluded:- Testing on mainnet or public testnet deployed code — all testing must be done on local forks
- Testing with pricing oracles or third-party smart contracts
- Phishing or social engineering attacks against employees or customers
- Testing with third-party systems, browser extensions, or SSO providers
- Denial of service attacks against project assets
- Automated testing that generates significant traffic
- Public disclosure of an unpatched vulnerability before it has been resolved
SUBMITTING A REPORTHow to Submit a Report
Reproduce and document the vulnerability
Ensure you have a working proof of concept on a local fork of mainnet or testnet. Document the attack vector, impact, and reproduction steps clearly.
Submit via Immunefi
Submit your report through the Livepeer programme page on Immunefi. Do not disclose the vulnerability publicly before it has been resolved.
Complete KYC
On confirmation of a valid report, you will be asked to complete KYC verification via an external service before payment is released. You will need government-issued photo ID.
RECENT PROGRAMME ACTIVITYRecent Programme Activity
The Livepeer bug bounty programme has been actively used. Recent examples include:- March 2024 — A protocol bug was fixed after a responsible disclosure through Immunefi. The vulnerability addressed a potential griefing attack allowing a bad actor to prevent a delegating token holder from accessing their rewards.
- October 2024 — A critical-level bounty was paid after disclosure of a vulnerability that could have allowed a bad actor to drain ETH from the Minter contract via successive steps across multiple rounds.
- August 2025 — A critical-level bounty was paid after disclosure of a vulnerability that could have allowed a bad actor to claim more ETH fees than intended through successive steps across multiple rounds.
RELATEDOpen Source Contributions
Contribute code, documentation, or test coverage to Livepeer’s core repositories.
Protocol R&D SPE (Sidestream)
The SPE responsible for protocol security, vulnerability triage, and safe upgrades.
Immunefi Programme Page
Full scope, reward tiers, rules, and submission portal for the Livepeer bug bounty.
Livepeer GitHub
The official Livepeer GitHub organisation. For non-security bugs, open an issue in the relevant repository.