Dispute Between Immunefi and Spectra Finance Over Bug Bounty Payments

A disagreement between leading Web3 security platform Immunefi and EVM-based derivatives protocol Spectra Finance has sparked public debate, following an Audit Competition that offered a $40,000 reward pool. At the heart of the conflict is a dispute over reward distribution and the terms governing valid bug submissions.

Background: The Audit Competition

In April 2025, Spectra Finance partnered with Immunefi to launch an Audit Competition aimed at securing its codebase ahead of production deployment. These competitions are a core part of Immunefi’s platform, offering whitehat security researchers incentives to identify vulnerabilities in smart contract systems.

Spectra’s competition listed a total reward pool of $40,000, including a baseline of $6,000 to be distributed even if no bugs were reported. The remaining funds were earmarked for verified security vulnerabilities based on severity.

The Core Dispute

Spectra’s Perspective

According to a public statement issued by Spectra Finance on June 23, 2025, the company claims it intended to reward researchers for all valid bug submissions. Spectra’s CEO alleged that Immunefi’s reward distribution criteria were either unclear or changed after the competition ended. The protocol expressed willingness to pay researchers directly but cited confusion over the final terms.

Immunefi’s Response

Immunefi, however, strongly refuted those claims in a parallel statement issued the same day. The platform asserted that Spectra had explicitly agreed to the program’s terms prior to the launch, including the standard reward distribution structure based on Immunefi’s severity classification system. Immunefi also stated that any perceived ambiguity was due to Spectra’s own misunderstanding, not changes on their end.

Key Issue: Guaranteed Reward vs. Severity-Based Distribution

The central point of contention is whether the full $40,000 reward was guaranteed for valid submissions or if Immunefi retained discretion in distributing the funds based on severity levels.

Some community members argued that the presence of valid bug reports should have triggered the full reward distribution. Others sided with Immunefi, suggesting that the classification and reward decisions were consistent with industry standards for audit competitions.

Community Reactions and Public Perception

The crypto security community on X (formerly Twitter) responded swiftly. Reactions were mixed but pointed.