Flow Protocol reduced its maximum bug bounty from $100K to $25K, a 75% cut affecting critical and standard reward tiers.
Tech & Launches ·
Flow Protocol has reduced its maximum bug bounty from $100,000 to $25,000, representing a 75% cut to the program's top reward tier. The reduction affects critical-severity reports, with the reward ceiling now capped at $25,000 instead of the prior $100,000. Combined across affected tiers, the total reduction amounts to $150,000 in maximum potential payouts.
The bounty program remains active and targets vulnerabilities across Flow's core repositories, including the execution layer, protocol layer, and smart contracts. Critical reports must demonstrate either unauthorized account manipulation or protocol-layer attacks exploitable through unstaked access and observer nodes. The program requires proof-of-concept submissions and prioritizes reports that adhere to specific reporting requirements outlined in the program rules.
It remains unclear what prompted the reduction or whether the lower ceiling applies retroactively to pending reports. The HackenProof page shows 138 registered hackers in the program, though the impact of the cuts on researcher participation and vulnerability disclosure patterns has not been publicly addressed.