ZKsync Era reduced bug bounty reward tiers by up to 60%, with critical vulnerabilities now capped at $20K instead of $50K.
Tech & Launches ·
ZKsync Era has reduced its bug bounty reward structure across multiple severity tiers, with the most significant cut affecting critical vulnerabilities. The maximum payout for critical smart contract bugs is now capped at $20,000—a 60% decrease from the previous $50,000 threshold. According to the program details, the total reduction spans four reward tier adjustments totaling $73,000 in removed compensation, and the program eliminated one impact category in the process.
The new structure maintains a baseline of 10% of directly affected funds up to the critical cap, with a minimum floor of $100,000 for mainnet assets. High-severity vulnerabilities carry a minimum of $20,000, determined by an internal assessment framework that weighs exploitability, impact, and probability. Payouts are processed by ZKsync directly in USDC on Ethereum mainnet and denominated in USD, though the program now requires KYC documentation for all bounty recipients.
It remains unclear whether the reductions reflect a strategic shift in risk assessment, changes to the protocol's security posture, or other operational factors. The live bounty page shows the current reward tiers in effect.