Have you ever poured hours into a solid vulnerability report only to watch it get closed as a duplicate or private known issue while the submission fee simply vanished? That frustration has been a quiet constant in the bug-hunting community for months. On November 2, Immunefi finally addressed it head-on by rolling out a credits system that returns those fees to more than 700 researchers. The move feels overdue, and from what I’ve seen in community responses, it lands at exactly the right moment.
How Immunefi Credits Work For Valid Reports
The new system is straightforward in concept yet carefully designed in practice. When a researcher submits a report that turns out to be valid, Immunefi now issues credits equal to the original submission fee. These credits do not replace any bounty payout. They sit on top of it. One credit equals one dollar. Researchers can use them for future submissions, mediation costs, or account verification. They cannot be withdrawn as cash or transferred to another account.
What makes this update especially welcome is its retroactive reach. Eligible reports go back to March 24 for regular bug bounties and April 10 for audit competitions. No claim form is required. No support ticket needs filing. Balances appear automatically, though the current process runs credit checks every two weeks. Full automation is planned, but for now some researchers may wait up to fourteen days to see the numbers update.
What Counts As An Eligible Report
Not every closed report earns credits. The rules draw clear lines. A finding qualifies once it receives a bounty payout or gets confirmed inside an audit competition, including accepted insights. Duplicates of a valid original report also qualify, no matter how many researchers independently discovered the same issue. Successful mediation earns credits covering both the submission fee and the mediation fee itself.
Private known issues receive similar treatment. Protocols sometimes register vulnerabilities they cannot disclose publicly until a fix is ready. In those cases a researcher has no way of knowing the issue already sits in the system. Immunefi now treats such closures as credit-eligible when the registration date falls after the researcher’s submission or when no public source exists. Publicly disclosed vulnerabilities stay excluded, along with invalid reports, out-of-scope submissions, policy violations, and duplicates of already-rejected findings. Submitting your own previously credited report a second time does not generate another credit.
You found a valid bug, and someone else reported it first. From today, you receive credits equal to that fee, ready for your next submission.
That single sentence from the announcement captures the spirit of the change better than any policy document could.
Why Submission Fees Became Necessary In The First Place
AI tools have changed the pace of bug hunting. Unique valid findings roughly doubled between January and September, yet total submissions grew even faster. Writing reports, generating proofs of concept, and polishing language now take far less time than before. The result is a heavier triage load. One recent high-severity vulnerability in a competition attracted twenty-four separate duplicate reports. Each one still required review and classification. Submission fees help fund that work. The credits system simply returns the cost when the underlying finding proves real.
I’ve watched researchers grumble about fees for months. The common complaint was never the existence of a fee itself. It was paying for a report that later turned out to be both valid and already known. That sting is gone for a large group of hunters.
Credit Lifespan And Spending Rules
Credits expire twelve months after they enter an account. Retroactive balances receive a full year starting from the launch date. The platform spends the oldest credits first, which is a sensible detail. Purchased credits follow the same twelve-month clock. Researchers can still buy additional credits with USDC if their balance runs low.
Account-verification fees also become eligible for credit once a researcher later submits a valid report and reaches at least 25 percent accuracy in either bug bounties or audit competitions. Human Passport verification remains free. Support for Immunefi Studio will arrive once that product opens to the public.
Community Reaction And Practical Impact
Early public replies were largely positive. Several long-time participants noted that the retroactive nature removed negative balances that had accumulated during audit contests. Others pointed out that the update solves only half the original problem. Accuracy calculations had already improved earlier in the year. Returning the fee addresses the remaining financial friction.
In my view the real value sits in the reduced mental load. When a researcher knows a legitimate finding will at least return the submission cost, the decision to report becomes simpler. That shift matters more than the dollar amount itself for many part-time hunters who carefully track every expense.
- Credits equal the original submission fee on a one-to-one dollar basis
- Duplicates of valid reports qualify regardless of how many researchers found the same issue
- Private known issues earn credits when registration occurs after submission or no public source exists
- Balances appear automatically with no claim process required
- Oldest credits are spent first and expire after twelve months
Plether Audit Competition Opens Alongside The Update
The same day the credits system went live, Immunefi opened a new audit competition for Plether. The project sits on Arbitrum and offers perpetual positions on a dollar index made up of six major currencies. The total reward pool stands at 80,000 USDC, split into a 56,000 primary pool, a 16,000 All Stars pool, and an 8,000 podium pool. The code is currently running on Arbitrum Sepolia with no mainnet deployment yet.
Participation rules exclude individuals on the OFAC sanctions list, people from restricted jurisdictions, and project insiders. Every vulnerability report must include a runnable proof of concept. That requirement has become standard for good reason. It cuts down on low-effort submissions and speeds up triage.
The timing feels deliberate. Launching a fresh competition while rolling out fee credits sends a clear signal that the platform wants both higher quality volume and fairer treatment of researchers.
Broader Context For Bug Bounty Economics
Bug bounty platforms have always walked a tightrope between cost control and researcher motivation. Too many free submissions create noise. Too many fees create resentment. The credits approach tries to thread that needle by charging for triage capacity while refunding the cost when the work proves valuable. It is not a perfect solution. Credits still expire. They cannot leave the platform. Yet for most active hunters the system removes the worst outcome: paying to report a real vulnerability that someone else found first or that the project already knew about.
Perhaps the most interesting aspect is how AI has accelerated the need for such mechanisms. Faster report generation is a net positive for security. Protocols get more eyes on their code. The downside is the sheer volume of near-identical findings. Without some form of fee structure, triage teams would drown. Returning the fee on valid work keeps the incentive aligned.
Practical Tips For Researchers Using The New System
If you have submitted reports since late March, check your balance after the next credit cycle. Do not assume the process is instant. Two-week windows mean patience is still required. Keep accurate personal records of submission dates and outcomes so you can spot any discrepancies later. When credits appear, decide whether to hold them for a high-value competition or spend them on the next solid finding you uncover.
Accuracy remains important. Reaching the 25 percent threshold unlocks verification fee credits. That metric rewards consistent quality over sheer volume, which is healthy for the entire ecosystem. Focus on well-written reports with clear impact and solid proofs of concept. The credits system rewards the work that already deserved recognition.
What This Means For Protocol Teams
Protocols that list on Immunefi also benefit indirectly. When researchers feel the financial risk of reporting is lower, more skilled hunters stay active. Higher participation often translates into better coverage. The private known issue rules also encourage protocols to register issues promptly rather than leave them undocumented. Clear registration dates protect both sides.
I expect other platforms to watch this experiment closely. If the volume of valid unique findings continues to rise while researcher satisfaction improves, similar credit or rebate models may appear elsewhere. Competition for talent among security researchers is real. Fair treatment has become a differentiator.
Looking Ahead
The credits system will not solve every friction point in bug bounty work. Some reports will still fall outside the rules. Expiration dates will still create mild pressure to stay active. Yet returning fees on valid findings, including duplicates and private known issues, removes a genuine source of resentment. Over 700 researchers already carry positive balances because of the change. That number will grow as more reports move through the pipeline.
For anyone who has ever closed a laptop after learning their carefully written report was a duplicate of a private issue, the update feels personal. The platform listened. The policy is retroactive. The process is automatic. Those three details matter more than the marketing language surrounding them.
Security research remains demanding work. The financial and emotional costs of false starts can add up. Small policy shifts that respect the effort behind valid findings help keep talented people in the field. Immunefi’s credits system is one of those shifts. It will not make headlines outside the community, yet inside the community it registers as meaningful progress.
As AI tools continue to lower the barrier to writing reports, the need for thoughtful economics will only increase. Platforms that balance triage costs against researcher fairness will attract the strongest talent. Those that ignore the issue risk losing quiet, high-quality contributors who simply decide the math no longer works. Returning submission fees on valid work is a practical step in the right direction. The next twelve months will show how well the system holds up under real usage, but the initial reception suggests the core idea is sound.
Researchers who have been waiting for this kind of adjustment finally have something concrete. Credits are live. Eligibility is broad. The process requires no extra paperwork. For many, that combination is enough to reopen a few closed tabs and start looking at the next target with slightly less hesitation. In a field where motivation can be fragile, removing avoidable friction is never a small thing.
