> ## Documentation Index
> Fetch the complete documentation index at: https://na-36-mintlify-aebde2c5.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Bug Bounties

> Report smart contract vulnerabilities in the Livepeer protocol and earn USDC rewards through the official Livepeer bug bounty programme on Immunefi.

export const BorderedBox = ({children, variant = "default", padding = "var(--lp-spacing-4)", borderRadius = "var(--lp-spacing-px-8)", accentBar = "", style = {}, className = "", ...rest}) => {
  const variants = {
    default: {
      border: "1px solid var(--lp-color-border-default)",
      backgroundColor: "var(--lp-color-bg-card)"
    },
    accent: {
      border: "1px solid var(--lp-color-accent)",
      backgroundColor: "var(--lp-color-bg-card)"
    },
    muted: {
      border: "1px solid var(--lp-color-border-default)",
      backgroundColor: "transparent"
    }
  };
  const accentBarColors = {
    accent: "var(--lp-color-accent)",
    positive: "var(--green-9)"
  };
  return <div data-docs-bordered-box="" data-accent-bar={accentBarColors[accentBar] ? "" : undefined} className={className} style={{
    ...variants[variant],
    padding: padding,
    borderRadius: borderRadius,
    ...accentBarColors[accentBar] ? {
      position: "relative",
      '--accent-bar-color': accentBarColors[accentBar]
    } : {},
    ...style
  }} {...rest}>
      {children}
    </div>;
};

export const DisplayCard = ({icon, title, style, background = 'var(--lp-color-bg-card)', children, className = "", ...rest}) => {
  if (!title) {
    console.warn("[DisplayCard] Missing required prop: title");
    return null;
  }
  const cardStyle = {
    display: 'flex',
    flexDirection: 'column',
    height: 'calc(100% - 1rem)',
    border: '1px solid var(--lp-color-accent)',
    borderRadius: '8px',
    padding: "var(--lp-spacing-4)",
    marginBottom: "var(--lp-spacing-4)",
    backgroundColor: 'var(--lp-color-bg-page)',
    gap: "var(--lp-spacing-4)"
  };
  const titleStyle = {
    display: 'flex',
    alignItems: 'center',
    gap: "var(--lp-spacing-2)",
    marginBottom: '0',
    color: 'var(--lp-color-text-primary)',
    fontSize: '1rem',
    fontWeight: 600,
    ...style
  };
  const bodyStyle = {
    display: 'flex',
    flexDirection: 'column',
    backgroundColor: background,
    borderRadius: '8px',
    flex: 1,
    padding: "var(--lp-spacing-2)",
    margin: 0
  };
  return <div className={className} style={cardStyle} {...rest}>
      <div style={titleStyle}>
        <Icon icon={icon} size={20} color="var(--lp-color-accent)" />
        {title}
      </div>
      <div style={bodyStyle}>{children}</div>
    </div>;
};

export const CustomDivider = ({color = "var(--lp-color-border-default)", middleText = "", spacing = "default", style = {}, className = "", ...rest}) => {
  const spacingPresets = {
    default: {
      margin: "24px 0"
    },
    overlap: {
      margin: "-1rem 0 -1rem 0"
    },
    tight: {
      margin: "0 0 -1rem 0"
    },
    section: {
      margin: "0 0 -2rem 0"
    },
    sectionOverlap: {
      margin: "-1rem 0 -2rem 0"
    },
    deepOverlap: {
      margin: "-1rem 0 -1.5rem 0"
    }
  };
  const spacingStyle = spacingPresets[spacing] || spacingPresets.default;
  return <div role="separator" aria-orientation="horizontal" className={className} style={{
    display: "flex",
    alignItems: "center",
    ...spacingStyle,
    fontSize: style?.fontSize || "16px",
    height: "fit-content",
    ...style
  }} {...rest}>
      <span style={{
    marginRight: "var(--lp-spacing-px-8)",
    opacity: 0.2
  }}>
        <Icon icon="/snippets/assets/logos/Livepeer-Logo-Symbol-Theme.svg" />
      </span>
      <div style={{
    flex: 1,
    height: "1px",
    background: "var(--lp-color-border-default)",
    opacity: 0.4
  }}></div>
      {middleText && <>
          <Icon icon="circle" size={2} />
          <span style={{
    margin: "0 8px",
    fontWeight: "bold",
    color: color,
    opacity: 0.7
  }}>
            {middleText}
          </span>
          <Icon icon="circle" size={2} />
        </>}
      <div style={{
    flex: 1,
    height: "1px",
    background: "var(--lp-color-border-default)",
    opacity: 0.4
  }}></div>
      <span style={{
    marginLeft: "var(--lp-spacing-px-8)",
    opacity: 0.2
  }}>
        <span style={{
    display: "inline-block",
    transform: "scaleX(-1)"
  }}>
          <Icon icon="/snippets/assets/logos/Livepeer-Logo-Symbol-Theme.svg" />
        </span>
      </span>
    </div>;
};

<CustomDivider middleText="BUG BOUNTIES" />

Livepeer runs an active bug bounty programme on [Immunefi](https://immunefi.com/bug-bounty/livepeer/information/), the leading web3 bug bounty platform. The programme rewards security researchers who responsibly disclose vulnerabilities in Livepeer's smart contracts.

Payouts are made in USDC on Ethereum, and KYC is required for all reward claims.

<Card title="Livepeer Bug Bounty on Immunefi" icon="shield-halved" href="https://immunefi.com/bug-bounty/livepeer/information/" arrow>
  The authoritative source for scope, reward tiers, rules, and submission instructions.
</Card>

<br />

<CustomDivider middleText="PROGRAMME OVERVIEW" />

## Programme Overview

<BorderedBox variant="default" padding="16px 20px">
  * **Scope:** Smart contracts only. The programme does not currently cover websites, apps, or off-chain infrastructure.
  * **Rewards:** Paid in USDC on Ethereum, denominated in USD.
  * **KYC:** Required for all reporters claiming a reward. You will need to provide visual proof of identity.
  * **Proof of Concept:** Required for all severity levels. Submissions without a PoC will not be considered.
  * **Triage:** Since early 2025, the Immunefi triage pipeline has been operated by the Protocol R\&D SPE (Sidestream), which processes incoming reports and ensures response-readiness.
</BorderedBox>

<br />

<CustomDivider middleText="SEVERITY & REWARDS" />

## Severity Levels and Rewards

Rewards are distributed according to the Immunefi Vulnerability Severity Classification System (V2.2), a five-level scale covering both the consequence of exploitation and the likelihood of a successful attack.

<Columns cols={2}>
  <DisplayCard icon="circle-exclamation" title="Critical">
    Rewards are capped at 10% of the economic damage caused, with the primary focus on possible loss of funds for Orchestrators, Delegators, and Broadcasters at the smart contract level.

    If there is a repeatable attack, only the first attack is considered unless further attacks cannot be mitigated via an upgrade or pause.
  </DisplayCard>

  <DisplayCard icon="triangle-exclamation" title="High">
    Rewards for High severity vulnerabilities depend on the amount of unclaimed yield at risk and how long funds could be frozen.
  </DisplayCard>
</Columns>

<br />

### Focus Areas

The programme focuses on preventing:

* Direct theft of user funds (at-rest or in-motion, excluding unclaimed yield)
* Unexpected calls to privileged functions (for example, functions that should only be callable by the Governor contract)
* Any condition that results in permanent freezing of user funds

<br />

<CustomDivider middleText="SCOPE" />

## Scope

The programme covers Livepeer's deployed smart contracts on Ethereum and Arbitrum. See the [full scope listing on Immunefi](https://immunefi.com/bug-bounty/livepeer/information/) for the definitive list of in-scope assets and contract addresses.

### Out of Scope

The following are explicitly excluded:

* Testing on mainnet or public testnet deployed code -- all testing must be done on local forks
* Testing with pricing oracles or third-party smart contracts
* Phishing or social engineering attacks against employees or customers
* Testing with third-party systems, browser extensions, or SSO providers
* Denial of service attacks against project assets
* Automated testing that generates high traffic
* Public disclosure of an unpatched vulnerability before it has been resolved

<br />

<CustomDivider middleText="SUBMITTING A REPORT" />

## How to Submit a Report

<Steps>
  <Step title="Reproduce and document the vulnerability">
    Ensure you have a working proof of concept on a local fork of mainnet or testnet. Document the attack vector, impact, and reproduction steps.
  </Step>

  <Step title="Submit via Immunefi">
    Submit your report through the [Livepeer programme page on Immunefi](https://immunefi.com/bug-bounty/livepeer/information/). Do not disclose the vulnerability publicly before it has been resolved.
  </Step>

  <Step title="Complete KYC">
    On confirmation of a valid report, you will be asked to complete KYC verification via an external service before payment is released. You will need government-issued photo ID.
  </Step>

  <Step title="Receive your reward">
    Valid rewards are paid in USDC on Ethereum. Payout amounts are handled directly by the Livepeer team and are denominated in USD.
  </Step>
</Steps>

<br />

<Warning>
  Public disclosure of an unpatched vulnerability is a violation of the programme rules and will disqualify a submission from receiving a reward. Always report privately first.
</Warning>

<br />

<CustomDivider middleText="RECENT PROGRAMME ACTIVITY" />

## Recent Programme Activity

The Livepeer bug bounty programme has been actively used. Recent examples include:

* **March 2024** -- A protocol bug was fixed after a responsible disclosure through Immunefi. The vulnerability addressed a potential griefing attack allowing a bad actor to prevent a delegating token holder from accessing their rewards.
* **October 2024** -- A critical-level bounty was paid after disclosure of a vulnerability that could have allowed a bad actor to drain ETH from the Minter contract via successive steps across multiple rounds.
* **August 2025** -- A critical-level bounty was paid after disclosure of a vulnerability that could have allowed a bad actor to claim more ETH fees than intended through successive steps across multiple rounds.

In all cases, no user funds were at risk at the time of patching and no exploits were observed on the network.

<br />

<CustomDivider middleText="RELATED" />

<CardGroup cols={2}>
  <Card title="Open Source Contributions" icon="code-branch" href="/v2/developers/guides/opportunities/oss-contributions" arrow>
    Contribute code, documentation, or test coverage to Livepeer's core repositories.
  </Card>

  <Card title="Protocol R&D SPE (Sidestream)" icon="shield" href="https://forum.livepeer.org/t/proposal-protocol-r-d-special-purpose-entity/3160" arrow>
    The SPE responsible for protocol security, vulnerability triage, and safe upgrades.
  </Card>

  <Card title="Immunefi Programme Page" icon="shield-halved" href="https://immunefi.com/bug-bounty/livepeer/information/" arrow>
    Full scope, reward tiers, rules, and submission portal for the Livepeer bug bounty.
  </Card>

  <Card title="Livepeer GitHub" icon="github" href="https://github.com/livepeer" arrow>
    The official Livepeer GitHub organisation. For non-security bugs, open an issue in the relevant repository.
  </Card>
</CardGroup>