Does Avalanche Bridge have a bug bounty program?

Yes, Avalanche Bridge runs a public bug bounty program on HackenProof, with rewards up to $100K. It currently lists 44 in-scope assets.

How much does Avalanche Bridge pay for bug bounties?

Avalanche Bridge's published reward range on HackenProof is up to $100K. Actual payouts depend on severity and scope.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackenProof/avalanche-bridge

Avalanche Bridge

hackenproofHackenProof·updated 7d ago

bountymanaged

Discord → RSS

max reward: $100K
scope: 44 in · 1 out
safe harbor: unknown
response: no reports

open program

hunt score

$$$cashnew

formula →

payout

47/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

44 in-scope

32contracts
11urls
1source

Scope

In scope

044

urls11

+Prod EVM Bridge Enclave Address: Avalanche· Critical
+Prod BTC Bridge Enclave Address: Avalanche· Critical
+Prod EVM Bridge Enclave Address: Ethereum· Critical
+Prod BTC Bridge Enclave Address: Bitcoin· Critical
+Testnet bridge front end for testing· Critical
+Testnet EVM Bridge Enclave address: Avalanche:· Critical
+Testnet Bridge Enclave address: Ethereum (Goerli)· Critical
+Testnet Bridge Enclave address: Bitcoin· Critical
+Enclave server (please test on testnet only)· Critical
+Ava Labs Warden server and blob st…(please test on testnet only)· Critical
▸▾show 1 morehide 1 more
- +Testnet Bridge Enclave Address: Avalanche· Critical

source code01

+Prod bridge front end (reporting only - please test on testnet)· Critical

smart contracts32

+Prod contract address: BTC.b· Critical
+Prod contract address: 1INCH.e· Critical
+Prod contract address: AAVE.e· Critical
+Prod contract address: ALPHA.e· Critical
+Prod contract address: BAT.e· Critical
+Prod contract address: BUSD.e· Critical
+Prod contract address: COMP.e· Critical
+Prod contract address: CRV.e· Critical
+Prod contract address: DAI.e· Critical
+Prod contract address: GRT.e· Critical
▸▾show 22 morehide 22 more
- +Prod contract address: LINK.e· Critical
- +Prod contract address: MKR.e· Critical
- +Prod contract address: SHIB.e· Critical
- +Prod contract address: SNX.e· Critical
- +Prod contract address: SUSHI.e· Critical
- +Prod contract address: SWAP.e· Critical
- +Prod contract address: UMA.e· Critical
- +Prod contract address: UNI.e· Critical
- +Prod contract address: USDC.e· Critical
- +Prod contract address: USDT.e· Critical
- +Prod contract address: WBTC.e· Critical
- +Prod contract address: WETH.e· Critical
- +Prod contract address: WOO.e· Critical
- +Prod contract address: YFI.e· Critical
- +Prod contract address: ZRX.e· Critical
- +Testnet contract address (subject to change): BTC.b· Critical
- +Testnet contract address (subject to change): DAI.e· Critical
- +Testnet contract address (subject to change): LINK.e· Critical
- +Testnet contract address (subject to change): USDC.e· Critical
- +Testnet contract address (subject to change): USDT.e· Critical
- +Testnet contract address (subject to change): WBTC.e· Critical
- +Testnet contract address (subject to change): WETH.e· Critical

Out of scope

001

−Non Ava Labs Warden servers and other infraurl· None

Change history

1 event

2026-10-29
first indexed
7d ago · 44 in-scope assets

// only one snapshot on record, changes appear from the next ingest onward

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Avalanche Bridge.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "assetTypes": [
    "Web",
    "blockchain",
    "smart contract"
  ],
  "stage1Hash": "2497bdaf5ce9c5612bcee2783d5badefb6246aa5fd4c20aa059d07d8aad06848",
  "description": "",
  "projectTypes": []
}