Acala reduced its maximum bug bounty from $50K to $1K and removed 5 impact tiers from its Immunefi program.
Tech & Launches ·
Acala, the decentralized finance network and liquidity hub of Polkadot, has substantially reduced its bug bounty program on Immunefi. The maximum reward for critical vulnerabilities has been cut from $50,000 to $1,000, representing a 98% reduction. The program also removed five impact tiers from its structure.
Under the current framework, critical-level reports receive 5% of directly affected funds, capped at the $1,000 maximum, while other severity levels are capped at 1% of affected funds. Payouts are issued directly by the Acala team in cryptocurrency tokens valued at market rates on submission date, with pricing calculated using the average between CoinMarketCap and CoinGecko. A runnable proof of concept remains required for all submissions.
The rationale for the bounty restructuring has not been disclosed. It remains unclear whether the changes reflect a reassessment of risk scope, resource constraints, or other strategic considerations by the Acala team.