01
Write your report
Use the smart submission form. Title, description, proof of concept, impact. Almost no learning curve.
ImmunefiStudio
Created with the best Security Researchers and Triagers that help protect the industry from million dollar vulnerabilities. Improve fast, with direct immediate feedback.
Scroll
Built on the Immunefi platform
Is your report worth millions of dollars?
- Review
- Signals
- Soon…
Find bugs. Get paid.
Get inside
the report.
- Paid out to whitehats
- $0M+
- Critical vulns found
- 0+
- Protocol value protected
- $0B+
Immunefi Studio · 01
Review
Get immediate feedback and improve before you submit — instead of risking your reputation.
Every draft, scanned
PoC clarity. Impact framing. Duplicate risk.
- Clarity — is the proof of concept reproducible end-to-end?
- Impact — does it show what happens to user funds and protocol state?
- Duplicates — has someone already reported it?
Immunefi Studio · 02
Signals
Blindly hunting? No more. Focus your attention where the bounties actually move.
Severity-aware bounty data, refreshed daily.
- Payout velocity
- Response time
- Critical payouts
- Program activity
Why Immunefi Studio
Practise on real targets. Submit when it's ready.
- 01
Real targets
Review your attacks on real targets from the safety of a sandbox environment.
- 02
Actionable feedback
Specific notes on what's missing or unclear — PoC clarity, impact framing and duplicate risk. You'll know exactly what to double-check before submission.
- 03
No risk
Still learning the ropes? Don't burn your reputation on invalid submissions. Iterate as many times as you need.
- 04
Soon
And that's not all. New tools designed to help secure the industry are coming — stay tuned.
$135M+ paid out.
Your report could be next.
Featured · Immunefi Studio Review
Know when your submission is ready to go.
Structured feedback to strengthen clarity, impact and completeness. Run it on the draft on the right.
- Duplicate risk assessment
- PoC clarity & quality analysis
- Impact framing & severity check
- Improvement notes you can apply line-by-line
Reentrancy in Vault.withdraw() drains pooled collateral
The withdraw() function sends ETH before updating balances[msg.sender].
An attacker contract re-enters through its receive() hook and withdraws again.
Funds at risk: all collateral held by the vault.
Fix: apply checks-effects-interactions or a reentrancy guard.
Assumes default fee configuration.
Verdict
Waiting for a run…
PoC clarity—Focus: test missing
Impact—Well demonstrated
Duplicate risk—No known duplicates
- HighAdd a clear, reproducible test script that proves the issue end-to-end.
- MediumClarify the impact on user funds and protocol state.
- LowConsider adding more context around edge cases and assumptions.
The Loop
Write. Get feedback. Improve until ready.
Move over the ring · click a station
02
Get instant feedback
Your report is checked for clarity, impact and duplication. Key issues are highlighted so you can refine it.
03
Improve until ready
Tighten, rerun, submit at its strongest. Every run is tracked on the same draft, so you see your reports get sharper.
Master your craft.Make your reports count.
Iterate until your vulnerability works — your million dollar reward is around the corner.