Paradex Launches Bug Bounty Program with Up to $500K in Rewards

Paradex, the decentralized perpetual futures exchange built on Starknet’s first appchain, has announced a new bug bounty program on the Sherlock platform. The program, which opened for submissions on June 8, 2026, offers security researchers up to $500,000 USDC in rewards for reporting critical vulnerabilities.

The reward ceiling represents a significant escalation from Paradex’s previous bounty program on Immunefi, which ran through mid-2025 and had a total reward pool of $45,000. The new maximum is more than ten times that amount, reflecting a more aggressive approach to security economics.

The program uses a tiered payout model. Critical vulnerabilities—those that could lead to direct theft of $100,000 or more in user funds or cause protocol insolvency—are eligible for the full $500,000 payout. Researchers receive 10% of the funds at risk, with a minimum payout of $25,000 for any qualifying critical finding.

Certain types of issues are explicitly excluded from the bounty scope: oracle-related vulnerabilities, bugs already identified in prior audits, flaws in third-party dependencies, and findings that overlap with other active bounty programs.

Paradex describes itself as a self-custodial trading platform that aims to combine the speed of a centralized exchange with the transparency of settlement on a public blockchain. It launched publicly around 2023 and runs on Starknet’s appchain infrastructure, giving it a dedicated execution environment separate from Starknet’s main network.

The exchange specializes in perpetual futures—derivative contracts that allow traders to take leveraged long or short positions on crypto assets without an expiry date. These instruments are consistently among the highest-volume products in decentralized finance.

The jump from a $45,000 Immunefi pool to a $500,000 Sherlock program signals a maturing security posture. Bug bounties operate on incentive theory: the reward must exceed what an attacker could reasonably earn by exploiting a vulnerability. At $45,000, that calculus was becoming unfavorable; at $500,000, serious security researchers have stronger financial motivation to disclose issues rather than exploit them.