Cowrie Research

immunefi-primary-sources-2026-04-28

5 min read

Immunefi primary-source snapshot

Fetched: 2026-04-28 UTC

1) Official homepage

Source: https://immunefi.com/

Selected excerpts from the official site:

The Leader in Onchain Security

$190B+ Protected across web3

$25B+ Hacks prevented before they could happen

60k+ Security Researchers working in our ecosystem

650+ Secured Protocols

Additional signals from the source:

  • The homepage positions Immunefi much more broadly than a simple bug-bounty listing site
  • The metrics-heavy framing suggests the company wants to be understood as ecosystem-scale security infrastructure

2) Official projects page

Source: https://immunefi.com/projects/

Selected excerpts from the official site:

Secure your project, sleep well at night, and show you take security seriously. Launch your bug bounty program with Immunefi.

Immunefi is the leading bug bounty and security services platform for Web3, which features the world’s largest bounties.

Immunefi guards over $190 billion in user funds across projects like Synthetix, Chainlink, SushiSwap, MakerDAO, Wormhole, GMX, Alchemix, Nexus Mutual, and many others.

Immunefi is chain-agnostic: we host bug bounties for blockchain projects across all chains and networks.

Additional signals from the source:

  • This page is the clearest compact statement of Immunefi’s market position and target audience
  • It explicitly frames the platform as both bug bounty infrastructure and a broader security-services platform

3) Project onboarding / contact flow

Source: https://immunefi.com/projects/get-started/

Selected excerpts/signals from the official site:

Which services are you interested in?

PR Reviews

Multisig Transaction Review

Immunefi Firewall, Powered by Dedaub

Monitoring

Audit

Audit Competition

Bug Bounty Program

Managed Triage

Nexus BBP Cover

Additional signals from the source:

  • This onboarding flow is unusually high-signal because it reveals the real menu of security services Immunefi is trying to coordinate for protocol teams
  • The list broadens Immunefi from bounty marketplace into a wider onchain security-operations layer

4) Audit Competitions page

Source: https://immunefi.com/audit-competitions/

Selected excerpts from the official site:

Immunefi Audit Competitions have generated 10,000+ bug reports and have paid out $6+ million to top-tier security researchers.

An Audit Competition is a crowdsourced, timebound code review, where projects offer a capped rewards pool that is distributed to whitehats at the end of the event based on bug report submissions.

Once the Audit Competition concludes, whitehats receive their rewards, and projects receive a full Audit Competition summary report, detailing learnings and findings.

Free managed triaging during Audit Competitions, powered by leading web3 security experts who are ex-auditors and ex-hackers.

Additional signals from the source:

  • This page makes Immunefi’s competition model explicit and shows that the company is standardizing a specific security workflow, not just hosting bounty listings
  • Managed triage and final summary reporting are especially important clues that Immunefi functions as an operational control plane for protocol teams

5) Severity classification systems page

Source: https://immunefi.com/severity-classification-systems/

Selected excerpts from the official site:

Full list of severity classification systems on Immunefi

Every project on Immunefi has a severity classification, which is listed in that project’s bug bounty program page in the Rewards by Threat Level section.

Immunefi Vulnerability Severity Classification System v2.3

Additional signals from the source:

  • This page is a strong primary source because it shows Immunefi maintaining platform-level security taxonomy infrastructure
  • The explicit versioning also suggests an evolving operational standard rather than informal bounty guidelines

6) GitHub organization overview

Source: https://github.com/immunefi-team

Selected excerpts/signals from the official GitHub org:

Information about web3 security and programming tutorials/tools

Bug reports from Immunefi Bounty Boosts

Past-Audit-Competitions

Additional signals from the source:

  • The public GitHub surface shows Immunefi extending into education, bug-report publication, and competition artifacts
  • This broadens the company from a platform operator into a public coordination and knowledge layer for web3 security

7) Web3 Security Library repository

Source: https://github.com/immunefi-team/Web3-Security-Library

Selected excerpts from the repository page:

This is a collaborative repository that aims to contain all the information you need to start or expand your knowledge in web3 security.

Bug Fix Reviews

Hack Analyses

Tools

Vulnerabilities

Additional signals from the source:

  • The library is useful evidence that Immunefi also acts as a first-party educational and exploit-analysis hub
  • The category structure suggests a deliberate attempt to become part of the default operating and learning stack for web3 security researchers

8) Official playbook PDF

Source: https://immunefi.com/whitepapers/web3-security-playbook.pdf

Selected excerpts/signals from linked context on the official homepage:

The Web3 Security Playbook

Immunefi’s playbook offering operational guidance for protocol teams to design, run, and scale secure onchain systems.

Additional signals from the source:

  • The PDF itself is an official first-party document and has been saved locally as immunefi-web3-security-playbook.pdf
  • Even without treating it as a canonical protocol whitepaper, it is useful evidence that Immunefi publishes strategic/operator-facing guidance rather than only marketplace pages

Notes

  • Immunefi appears best cataloged as web3 bug-bounty platform / audit-competition infrastructure / managed-triage and review services / onchain security operations control plane.
  • The most important categorization clue is the combination of bounty hosting, time-bound competitions, triage/review services, platform-level severity frameworks, and public educational/security-research surfaces.
  • Immunefi publishes an official Web3 Security Playbook PDF, but no single canonical protocol whitepaper surfaced in this pass.

Graph View