LayerZero reduced its maximum bug bounty from $15M to $3.5M, a 77% cut, while supported assets decreased by 15 net.
Tech & Launches ·
LayerZero has reduced the maximum payout on its bug bounty program from $15 million to $3.5 million, representing a 77 percent cut to the top reward tier. The protocol, which provides omnichain interoperability services, also removed 18 assets from its bounty scope while adding 3, resulting in a net reduction of 15 supported assets. According to the current program details, critical smart contract vulnerabilities affecting Group 1 (EVM chains) now carry a hard cap of $3.5 million, calculated as 10 percent of funds directly affected, with a $250,000 minimum.
The program requires security researchers to submit proof-of-concept code demonstrating impact on an in-scope asset, and operates under a "Primacy of Impact" framework that prioritizes the severity of discovered vulnerabilities over strict asset eligibility. Rewards are tiered by threat level and blockchain type, with Group 1 chains receiving higher payouts than Group 2 non-EVM chains. The bounty is administered through Immunefi and mandates know-your-customer verification and arbitration capabilities.
The rationale for the reduction in maximum bounty size and supported asset count remains unstated. It is unclear whether the changes reflect a shift in LayerZero's risk assessment, reallocation of security resources, or other strategic considerations.