Bug bounty expected value calculation

By Mike, independent smart contract security researcher. Methodology and full campaign data are published on this site.

Expected value is one formula: success probability times payout, minus cost. Most essays about bug bounty never let you run it. Below you can, with your own inputs. The site asserts nothing about what probability or payout you will get.

EV calculator

Enter three numbers. The result updates as you type. EV = p × payout − cost, and ROI = EV ÷ cost. The pre-filled row is an illustrative scenario only; your inputs will differ and nothing here predicts your outcome.

Campaign cost in USD (infra, tooling, time priced honestly) Estimated success probability, 0 to 1 (realistic range for a single campaign on a competitive program is often well below 0.1) Expected payout in USD for a critical on your target program

EV: -2500.00 USD. ROI: -50.0%. Negative EV means the campaign loses money in expectation. Actual payouts may be zero.

Market context the calculator sits inside

The pool you are hunting in matters. Immunefi's public bounty API exposes 234 active programs (Immunefi public bounty API), and the largest maximum critical-severity payout any program offers is 15000000 USD (same API, max reward field). On the loss side, year-to-date across DeFi, aggregated by DeFiLlama's hacks feed, 2238208290.928132 USD has been lost to exploits (DeFiLlama hacks API), which tells you which bug classes are already burned by other hunters. For scale, one targeted protocol carries 26779743284.608967 USD in total value locked per DeFiLlama (DeFiLlama TVL API), the number that sets why a critical there pays what it pays.

Historical context from altFINS: DeFi protocols lost over $840 million to exploits in January through May 2026 across 50-plus incidents, a 70% year-over-year increase, and roughly 72% of 2026 losses came from stolen keys and credential theft rather than smart contract bugs (altFINS, DeFi hacks 2026). The same source reports cross-chain bridges have produced more than $2.8 billion in cumulative losses since 2022, roughly 40% of all value ever hacked in Web3 (altFINS).

Worked example of the formula shape

Take the formula symbolically. EV = p × payout − cost. Suppose p = 0.05 and payout = X and cost = C. Then EV = 0.05X − C. If X is 20 times C, EV is exactly zero, meaning the campaign breaks even in expectation. Every multiple of C above 20 pushes EV positive; below, negative. That breakeven multiple is the fastest sanity check before you spend a week on a program. Note what the formula does not include: dedupes, triage rejections, and disclosure lockouts all sit inside your real p, which is why honest p is low. For actual dollar outcomes from my own campaigns, see the campaign-report pages; no invented figures appear here.

How we know the numbers are right

Methodology: market figures on this page are pulled from validated API responses, Immunefi's public bounty API and DeFiLlama's hacks and TVL feeds, cross-checked and freshness-stamped, and recomputed in browser code at build time rather than typed by hand. The calculator's EV and ROI are recomputed in browser code from the values you enter, never guessed, and the site asserts nothing about what probability or payout you will get. Historical loss figures come from altFINS' published 2026 hack analysis.

Why most hunters earn nothing

Bug bounty pools are winner-take-most. With 234 active programs (Immunefi public bounty API) and many hunters competing per program, the first valid report on a bug takes the payout and everyone else on the same bug gets nothing. Your EV calculation has to price dedupes inside p, not after it.

Why program count matters

More programs mean more surface area where a bug may not yet be found, which is the only lever that raises p. Tracking the count via Immunefi's public API (Immunefi) tells you how the pool is growing; a shrinking pool with the same hunter count lowers everyone's EV.

Why YTD loss totals signal burned bug classes

DeFiLlama's hacks feed shows 2238208290.928132 USD lost year to date across DeFi (DeFiLlama hacks API). Each incident teaches attackers and defenders the same lesson, so exploit patterns that appear there repeatedly are classes other hunters have already mined. Combined with altFINS' finding that roughly 72% of 2026 losses came from key and credential theft rather than contract bugs (altFINS), it points away from the most crowded bug classes.

Disclaimers

Past campaign results do not predict future bounty payouts. Expected value estimates assume probability-weighted outcomes and actual payouts may be zero. This site documents one independent researcher's experience and does not constitute financial or security advice. Vulnerability details are disclosed only after responsible disclosure timelines have passed.