Smart contract bug bounty ROI, computed from your own inputs

By Mike, independent smart contract security researcher. Scan the Chain is an independent security research operation publishing open case studies from autonomous smart contract audit campaigns. All findings, costs, and outcomes are reported transparently.

Why a calculator and not an essay

Nobody ranking for this query will let you run your own numbers. They argue about averages; averages are useless here because the payout distribution is a power law. The only honest move is to show the formula, supply the market context, and let you type in your own probability and payout. The math is one line: expected value = p × payout − cost, and ROI = EV ÷ cost. Your inputs, your result. The site asserts nothing about what you will earn.

Expected value calculator

Illustrative inputs are pre-filled below; yours will differ.

Campaign cost in USD (infra, tooling, your time priced honestly)Estimated success probability, 0 to 1 (realistic single-campaign range is 0.01 to 0.10; see the FAQ below for why)Expected payout in USD if the critical lands (pull this from your target program's critical-severity table)

Expected value: $0

ROI on cost: 0

Past campaign results do not predict future bounty payouts. Expected value estimates assume probability-weighted outcomes and actual payouts may be zero. This site documents one independent researcher's experience and does not constitute financial or security advice.

Market context, validated at fetch time

The pool you are fishing in. Immunefi's public bounty API exposes 235 programs right now, which bounds how many distinct target sets you can run against. The largest maximum critical-severity payout offered by any program on the platform is $15,000,000. That is the ceiling, not the median; treat it as a tail number.

The money at risk, which drives program budgets. Total value locked for the target protocol, per DeFiLlama's protocol API, sits at $26.39B. Programs funded from protocol treasuries tend to scale reward pools with what an exploit would actually cost them.

The burned bug classes. Year to date across DeFi, aggregated by DeFiLlama's hacks feed, exploits have burned $2.24B. Every dollar in that total is a bug class some program has already paid to learn about, and low-hanging reentrancy and oracle bugs are the first to go.

Worked example, symbolically

Take the calculator's three inputs: cost C, probability p, payout R. Expected value is p × R − C.

EV   = 0.05 × 50,000 − 4,000
     = 2,500 − 4,000
     = −1,500

ROI  = EV ÷ cost
     = −1,500 ÷ 4,000
     = −0.375  →  −37.5%

Negative. And that is the lesson the formula forces on you: below some probability threshold, even a generous payout table cannot rescue the campaign economics. Run it yourself in the tool above. The outputs recompute on every keystroke.

Two traps to keep your inputs honest. A rejected or duplicate submission contributes zero to expected value, so dead submissions must never be counted in p or R. And vulnerability details stay private through the responsible disclosure window, which delays when a payout actually lands.

Methodology

Where these numbers come from. Program count and payout ceilings come from Immunefi's public bounty API, TVL and hack totals from DeFiLlama's public feeds, and each figure was fetched and cross-checked at page build time with a spread tolerance applied. Every displayed number is recomputed in code from a validated source, not typed by hand, and each one links to its origin inline. The calculator itself runs entirely in your browser on your own inputs; nothing you type leaves the page.

FAQ

Why do most hunters earn nothing from a campaign?

Pool dynamics. A program's reward pool is finite. The payout distribution is a power law: one hunter takes the critical, everyone else takes a duplicate or nothing.

Immunefi's public bounty API exposes 235 programs, so competition concentrates on the same funded targets. Your expected value has to be computed net of that concentration, which is exactly what the p × payout − cost formula makes explicit.

Past campaign results do not predict future bounty payouts, and actual payouts may be zero.

Why does program count matter?

Because it bounds diversification. Running one campaign against one program is a lottery ticket; running parallel campaigns across more of the 235 programs exposed by Immunefi's public API spreads your fixed infrastructure cost across more draws, without changing the per-draw probability. The calculator's cost input should include that shared infra, priced honestly.

What does the year-to-date exploit total tell me?

The $2.24B lost year to date across DeFi, aggregated by DeFiLlama's hacks feed, is a map of what nobody caught yet. High totals in a category mean the bug class is still paying; a quiet quarter for, say, oracle manipulation after repeated hits usually means programs paid out, patched, and burned that class. Aim your p estimate where the losses still are.