Immunefi has launched a credits system that returns submission fees on valid bug reports to more than 700 researchers, including hunters whose findings were closed as duplicates or private known issues.
Summary
- Valid reports qualify for credits equal to submission fees, without replacing researchers’ bounty rewards.
- Each credit is worth $1, expires after 12 months, and cannot be withdrawn or transferred.
- Unique valid findings doubled between January and September, according to Immunefi’s announcement.
- Plether’s audit competition has opened with an $80,000 USDC reward pool for security researchers.
According to Immunefi’s announcement on Nov. 2, the program covers eligible reports submitted since fees began earlier this year, with balances credited automatically. Researchers do not need to submit a claim or complete a separate application.
The policy addresses a complaint from hunters who paid to report a real vulnerability, only to learn that someone else had already found it or that the protocol privately knew about it.
“You found a valid bug, and someone else reported it first,” Immunefi wrote. “From today, you receive credits equal to that fee, ready for your next submission.”
Immunefi credits cover valid findings and private known issues
Eligibility reaches back to March 24 for bug bounties and April 10 for audit competitions. A researcher’s original finding qualifies once it is paid through a bounty program or confirmed in an audit competition, including accepted insights.
Duplicates qualify when the original report is valid, regardless of how many researchers independently found the same vulnerability. Successful mediation earns credits for both the submission fee and the mediation fee.
Private known issues receive similar treatment. Immunefi said protocols sometimes register vulnerabilities they cannot disclose before a fix is ready, leaving researchers unable to know that their discovery is already documented.
A known-issue closure must show either a registration date or a public source. If neither appears, the issue counts as private for credit purposes. Reports qualify when the protocol registered the issue after the researcher submitted it.
Publicly disclosed vulnerabilities remain excluded, alongside invalid reports, out-of-scope submissions, policy violations and duplicates of rejected reports. Researchers cannot earn a second credit by submitting their own finding again.
AI-assisted submissions have grown faster than valid findings
Immunefi said unique valid findings doubled from January through September, while total submissions grew faster. The company attributed faster bug discovery and report writing to AI tools, describing the volume as requiring new systems to handle valid work fairly.
In its September update, the foundation said one high-severity vulnerability attracted 24 duplicate reports during a recent competition. Every submission requires triage and classification, work that submission fees cover, according to the update.
Researchers welcomed the announcement in public replies. Skydev described it as resolving the fee-related half of the duplicate and private-known-issue problem, following earlier changes to accuracy calculations. Vuk.Digital praised the retroactive credits and said the change removed negative balances for researchers participating in audit contests.
Keizo said the community had raised the issue and Immunefi had listened. The reactions focused on the cost of submitting legitimate work when researchers cannot inspect earlier private reports.
Credits expire after 12 months and stay within the platform
One credit equals $1, and researchers can purchase credits using USDC. Immunefi said credits now pay for submissions, mediation, and account verification, with support for Immunefi Studio when it opens publicly.
Bounty and competition rewards remain separate. A qualifying researcher receives the normal reward plus credits matching the relevant fee.
Purchased and earned credits expire 12 months after they enter an account. Retroactive balances receive a full year from launch, and the platform spends the oldest credits first.
Account-verification fees can qualify once a researcher submits a valid report after verification and reaches at least 25% accuracy in either bug bounties or audit competitions. Human Passport verification remains free.
Credit checks currently run every two weeks. Immunefi plans to automate them, but eligible balances can take up to two weeks to appear while the current process remains in place.
Plether opens an $80,000 audit competition
Immunefi’s Plether competition opened on Nov. 2 with $80,000 in USDC rewards. The Arbitrum project offers perpetual positions on a dollar index comprising six major currencies.
The program page describes the system as being tested on Arbitrum Sepolia, with no mainnet deployment. Rewards are divided into a $56,000 primary pool, a $16,000 All Stars pool, and an $8,000 podium pool.
Participation rules exclude people on the U.S. Treasury’s OFAC sanctions list, restricted jurisdictions, and project insiders. Researchers submitting vulnerability reports must provide a runnable proof of concept.
