Granite Protocol Offers Up To $100,000 For Bug Reports
Granite Protocol, a crypto app, widened its Immunefi bug bounty to 28 more assets and will pay up to $100,000 for bugs that could let thieves steal users’ money.
Key Takeaways
- Granite Protocol expanded its immunefi bug bounty to 28 additional assets and offered up to $100,000 for critical smart contract flaws
- Immunefi’s bounty page says critical rewards can reach 10% of directly affected funds, capped at $100,000
- The bounty page lists a minimum reward of $25,000 for a critical report
- Granite Protocol is using Immunefi as the public intake channel and adopted Immunefi’s repeatable attack rules
Security marketplace Immunefi posted the scope expansion, and the project’s bounty page says critical rewards can reach 10% of directly affected funds, capped at $100,000.
The protocol is using Immunefi as the public intake channel for vulnerability reports, which gives researchers a clear reward schedule, disclosure path and severity framework before they start testing code, important because smart contracts often custody user deposits directly, so a coding mistake can turn into immediate loss rather than a service outage.
Granite Protocol Widens Its Defensive Perimeter
The project did not disclose the dollar value secured by the 28 newly added assets in the Immunefi materials. It did disclose the payout ladder, and the Immunefi page says the minimum reward for a critical report is $25,000.
High-severity bugs tied to theft or permanent freezing of unclaimed yield or royalties can earn $5,000 to $25,000.
The team also adopted Immunefi’s repeatable attack rules. If a vulnerable contract can be paused or upgraded, rewards are based on the first exploit path.
If it cannot, the bounty can consider cumulative damage until funds are drained. That distinction signals which contracts are considered recoverable and which could become one-shot failures, the difference that often decides whether a bug becomes a contained incident or a full treasury event.
Also Read: Bug Bounty Site Immunefi Pays $25,000 To Stop A Crypto Cash Drain
From Earlier White Hats To 28 More Assets
Friday’s expansion follows earlier use of Immunefi, where the project had already established a paid disclosure program and, by Immunefi’s description, a record of rewarding white hats.
The new step broadens the number of in-scope assets rather than creating a bounty from scratch, a maturity move common in DeFi.
Teams often open a narrow bounty around one contract, then widen coverage as their codebase grows across vaults, bridges, routers or reward systems.
For users, scope is the key number. A bounty that covers one contract can leave adjacent assets exposed.
Naming 28 additional assets brings more of the live attack surface into the paid-review process.
Granite Protocol Bounty Economics Matter
The protocol is offering at most $100,000 for a critical finding, which is large enough to attract skilled researchers but still below the nine-figure losses that have hit the sector during major exploits.
Projects hope a credible legal path and fast payout will beat the economics of black-market exploitation. Researchers, in turn, weigh whether a capped award is worth the time needed to audit complex contracts with upgrade proxies, admin roles and token accounting edge cases.
The Immunefi setup works like a standing purchase order for adversarial testing.
Instead of waiting for an internal team to find every bug, the project publishes rules that tell outside researchers what code they may test, where to report flaws and what each severity band can pay.
The $25,000 minimum for critical reports gives a finder reason to disclose rather than sit on a flaw. The $100,000 cap limits what may be owed but also highlights where bounty programs struggle.
If a contract holds far more than $1 million, a 10% exploit can quickly outgrow the public reward.
By adding 28 assets, the team is increasing the potential review surface and showing researchers where their time is most likely to pay off. For Immunefi, a clearer scope usually leads to cleaner reports.
For users, this means more of the code that touches their funds is now inside the paid-audit perimeter.
