Near Protocol
Bug Bounty

The NEAR Protocol bug bounty program is a continuous security initiative hosted on HackenProof. It specifically targets vulnerabilities within the core blockchain infrastructure, primarily focusing on the nearcore Rust implementation. Researchers are encouraged to hunt for consensus flaws, cryptographic vulnerabilities, and transaction manipulation risks. Historically, the program has paid out over $3.39 million to ethical hackers, including a massive $1.8 million disbursement in early 2023 for critical findings.

Rewards are distributed based on a strict severity tier system. Critical vulnerabilities can earn between $200,000 and $1,000,000 per finding. High severity bugs are rewarded from $20,000 to $100,000, while Medium and Low findings yield up to $20,000 and $1,000 respectively. Submissions must adhere to the coordinated disclosure rules outlined in the official SECURITY.md document and must be reported exclusively via the HackenProof portal within 24 hours of discovery.

To ensure efficient triage and safe testing environments, hunters are strictly advised to utilize the provided one-click local testnet environment found at tools/bounty-localnet. This allows researchers to safely spin up a local network, reproduce their attack vectors, and attach the resulting network directory to their reports without risking the mainnet or public testnets.