Flow Protocol reduced maximum bug bounty rewards by 60% and extended resolution time from 14 to 28 days.
Tech & Launches ·
Flow Protocol has reduced its maximum bug bounty reward from $25,000 to $10,000, representing a 60% decrease in the highest payout tier. The protocol also extended its vulnerability resolution timeline from 14 days to 28 days. The program now offers a single critical-severity reward tier of $10,000 USD, though the terms note that for protocol-layer vulnerabilities the actual payout may be lower depending on the on-chain value at risk, with $10,000 serving as the ceiling.
The changes affect how Flow evaluates security submissions across its decentralized platform infrastructure. Critical reports must demonstrate specific classes of vulnerabilities—such as unauthorized account manipulation in the execution layer or data-altering attacks from malicious access nodes—while excluding denial-of-service claims, theoretical flaws, and vulnerabilities exploitable only through front-running or static analysis tools alone. A $1 proof-of-concept submission fee applies to all reports.
It remains unclear what prompted the reward reduction or whether Flow plans further adjustments to its bounty structure. The program remains active and has received 157 submissions from researchers, though the impact of lower incentives on future participation rates is not yet evident.