General FAQs

How do I learn more about smart contract/blockchain hacking?

This is a big topic, but here are some simple steps to get started:

• Follow our Twitter account for educational resources, as well as the hashtag #immunefischool
• Join our Discord and learn from the top Web3 hackers
• Read through bugfix postmortems on our Medium to see a technical analysis of bugs that were reported and fixed via Immunefi
• Check out our blog post Hacking the Blockchain: An Ultimate Guide
• Check out resources for learning smart contract hacking our site

Am I able to change my username after creating my account?

Yes. To change your username, simply log into the Immunefi bugs platform, navigate to the user settings page, and click the ‘change username’ button.

Why does Immunefi prioritize smart contract/blockchain bugs over web?

Immunefi is first and foremost a bug bounty platform for web3, which includes blockchains, NFT projects, and smart contracts in DeFi. Our focus on web3 is what sets us apart and allows us to host the world's largest bug bounties. Projects on our platform sometimes want their websites secured as well, but their main focus–and ours–is to protect their web3 assets. So, we include web assets on some bounties under very limited and specific scenarios.

Why did I get a warning?

You probably violated one of our rules, but the violation wasn’t serious enough to merit a full ban. Three warnings will usually result in a permanent ban from the platform, but depending on the context, two warnings may also result in a ban. Remember, each bug bounty program also has its own set of rules, which are available one each bug bounty page.

Why did I get banned?

As an elite bug bounty platform, we offer our hackers a lot of one-on-one support and treat them well. If you’ve been banned, it’s because you’ve violated some of our most important rules, probably repeatedly. Read our rules here to make sure you don’t violate them, and most importantly, don’t test exploits on mainnet or public testnet. Each bounty program page also has its own set of rules unique to that program.

Is KYC required?

KYC isn’t required by default, and the vast majority of projects don’t require KYC. However, a few projects do.

How is KYC handled and what do I need to provide?

KYC is handled directly between the whitehat and the project. Immunefi is not involved in the KYC process, as the bounty reward payment comes from the project directly.

KYC requirements are not currently standardized in the crypto space. With that said, the usual requirement is for a national ID photo and a scan of a utility bill to show proof of residency.