Polymarket has launched a bug bounty program on Cantina with rewards of up to $5 million.

Polymarket Launches $5M Bug Bounty Program on Cantina

Prediction market platform Polymarket has launched a bug bounty program on Cantina with a top reward of $5 million. The program covers the full technology stack, including 18 smart contracts on Polygon—spanning V1/V2 CTFExchange and NegRisk versions, fee modules, conditional token frameworks, the pUSD collateral wrapping/unwrapping system, and UMA oracle adapters—along with web applications and related infrastructure. Critical web vulnerabilities like remote code execution, sensitive data leaks, subdomain takeovers tied to wallet-connected interactions, and malicious transaction injection are all eligible for the highest reward tier.

Smart contract vulnerabilities carry a maximum bounty of $5 million, while web application bugs top out at $250,000. The program is now open for submissions.