Immunefi: what its public programmes pay, measured

What happened

Immunefi's public feed holds 237 programmes, 170 of them live on 19 September 2026, with 5,843 in-scope assets (5,225 smart contracts, 354 blockchain or DLT, 264 web). The median advertised ceiling is $100,000 and the top is $15,000,000 at LayerZero, with $109,262,597 of combined ceiling across the live set. 97 of 170 live programmes require KYC and 158 publish a proof-of-concept matrix by asset type and severity. Measured from the platform's own endpoint.

The advertised ceiling is rarely the payable amount: 140 of 747 reward rows carry a reward calculation percentage of 10, so a critical pays up to a tenth of the funds at risk. The impact taxonomy runs to 888 unique (asset type, severity, title) triples across 2,742 rows, and it is the same list the submission form renders. Live means not paused, not invite-only, no past end date and no future launch date; the feed's other 67 programmes fail one of those.