WEMIX has relaunched its bug bounty program with blockchain security firm CertiK, offering vetted security researchers rewards of up to $10,000 for vulnerabilities found in the WEMIX3.0 network and its governance smart contracts. The program, hosted on CertiK Hunt, places its largest fixed reward on critical flaws affecting the Layer-1 blockchain itself.
According to the WEMIX program page on CertiK Hunt, researchers can receive $10,000 for a critical blockchain or distributed-ledger-technology vulnerability, $2,000 for a high-severity issue, and $1,000 for a medium-severity finding. Critical smart-contract reports carry rewards ranging from $2,000 to $10,000, while high-severity smart-contract findings can receive $1,000 to $2,000. Medium-severity smart-contract bugs are eligible for $1,000.
All payments are denominated in U.S. dollars and distributed in USDT on Ethereum after the report has passed review and the researcher completes mandatory Know Your Customer verification.
Focus on the WEMIX3.0 chain and governance code
The bounty scope covers the WEMIX3.0 blockchain, which WEMIX describes as an EVM-compatible Layer-1 mainnet, along with governance smart contracts. That gives researchers two distinct targets: flaws in the network’s underlying infrastructure and vulnerabilities in code governing on-chain functions.
A critical infrastructure-level vulnerability would generally involve a flaw capable of disrupting consensus, affecting network integrity, or creating a severe security risk across the chain. Smart-contract findings are assessed separately, reflecting the different ways a vulnerability can affect governance mechanisms, token-related functions, or contract-controlled assets.
The payout structure gives WEMIX discretion over the top reward for critical smart-contract reports. While the maximum is also $10,000, the final amount depends on WEMIX’s assessment of the finding’s severity, impact, and eligibility under the program rules.
Researchers can submit eligible findings through the dedicated WEMIX page at https://hunt.certik.com/explore/wemix.
CertiK limits submission rights to Vanguard researchers
The program is not open to unrestricted public submissions. CertiK Hunt requires security researchers to complete a vetting process that examines technical expertise, vulnerability-discovery history, and contributions to the security community.
Approved participants are assigned to one of three levels: Challenger, Sentinel, or Vanguard. Only researchers in the Vanguard tier can submit reports to the WEMIX program.
That structure is designed to place initial reporting in the hands of researchers who have met CertiK’s highest access threshold. It also reduces the volume of low-quality or duplicative submissions that often complicate public bounty programs, particularly where reports concern core blockchain infrastructure rather than a single application.
Vanguard researchers must include a proof of concept with each report. The proof of concept must demonstrate the vulnerability’s impact, allowing CertiK to test whether the issue is reproducible and whether it affects an asset covered by the bounty’s scope.
Two-stage review determines final rewards
CertiK performs the first review after a report is filed. The security provider evaluates whether the reported flaw, affected asset, and claimed severity fit the WEMIX bounty’s published terms before escalating the case to the project.
WEMIX then conducts its own review and makes the final determination on reward eligibility, severity classification, and payout amount. This split gives CertiK responsibility for technical triage while leaving WEMIX in control of compensation decisions for issues affecting its network and contracts.
Researchers can follow the status of their submissions through CertiK Hunt. A report proceeds to payment only after the relevant reviews are complete and the researcher has passed KYC checks.
The program excludes several categories of participants and findings. Individuals named on the U.S. Treasury Department’s Office of Foreign Assets Control Specially Designated Nationals sanctions list are ineligible. WEMIX employees, contractors, and technical contributors who received compensation from the project within the previous year also cannot participate.
The rules also exclude vulnerabilities already disclosed in publicly released audit reports where the issue remains unfixed. That provision prevents researchers from claiming rewards for known problems that have already entered the public record.
Relaunch follows a reported security incident
The renewed bounty arrives after a reported July 2026 incident in which a code flaw allegedly allowed attackers to create millions of counterfeit tokens and drain about $724,000 from the gaming blockchain. The episode added pressure on WEMIX to demonstrate that vulnerabilities can be identified before they are exploited on-chain.
Bug bounties do not replace audits, internal code review, monitoring systems, or incident-response planning. They give projects access to independent researchers who may test assumptions and attack paths that internal teams and commissioned auditors did not identify. Requiring reproducible proof of concept reports makes the program more suited to actionable vulnerabilities than speculative claims.
The $10,000 ceiling also indicates the project’s priority: the most severe network-level issues are explicitly placed at the top of the reward schedule, while governance-contract vulnerabilities are assessed across a wider critical payout range. For WEMIX, the effectiveness of the relaunch will depend less on the headline reward than on the speed and quality of triage, remediation, and communication once valid reports reach the project.
Interested in blockchain security rewards? Learn more about crypto bounty programs and sharpen your vulnerability-hunting skills.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
