The ENS audit competition with Immunefi is now live, inviting security researchers to review the new ENS Manager, Explorer, and supporting application infrastructure. The competition runs through September 14, with a maximum reward pool of $70,000.
The ENS audit competition with Immunefi is now live, and we're inviting security researchers to take a close look at the new ENS application stack.
From August 18 through September 14, 2026, researchers can review the code behind the new ENS App, ENS Explorer, and supporting application infrastructure, with a maximum reward pool of $70,000.
The competition is part of the security work around the ENSv2 Beta. With the new apps now available for public testing on Sepolia, this is an opportunity to go deeper: inspect the code, test the assumptions behind key flows, and find issues before the new experience moves beyond Beta.
A traditional audit gives one expert team a close look at the code. An audit competition brings in a much larger group of independent researchers while the apps are still in Beta, when there's still time to fix anything they uncover. According to Immunefi, researchers on its platform have found 92% of the critical vulnerabilities identified across the projects it protects, averaging roughly one critical finding per business day. For ENS, that gives the new apps another round of independent review alongside the security work already completed internally and the separate audits of the ENSv2 smart contracts.
If you work on Ethereum applications, wallets, smart accounts, transaction infrastructure, or web security, we'd especially like you to take part.
The competition covers roughly 137,000 lines of TypeScript across:
- the ENS App, which handles flows including registration, migration, name management, profile updates, and primary names
- the ENS Explorer, which lets users inspect ENS names in greater detail, including ownership, resolution, registries, contracts, and configuration
- the workers/ directory
- the transaction-manager package
- the smart-account package
The ENS smart contracts are being audited separately and aren't included in this competition.
The ENS subgraph/indexer, NFT metadata service, unmodified third-party dependencies, test files, and infrastructure outside the listed scope are also excluded.
For researchers, the Immunefi competition page has everything needed to get started, including the exact repository paths, commit hash, build instructions, exclusions, testing requirements, and submission rules.
One of the most important areas to pressure-test is the path between what an ENS app shows a user and what their wallet ultimately signs.
Names can sit directly inside transaction flows, so addresses, chains, senders, recipients, contract targets, and transaction arguments all need to remain correct from beginning to end.
We'd especially like researchers to look for issues involving:
- transactions being constructed or signed against the wrong chain
- incorrect senders, recipients, contract targets, or transaction arguments
- an authenticated session or smart account gaining more authority than intended
- unauthorized account or session takeover
- theft of funds or ENS names
- malicious interactions with an already connected wallet
- a name being hijacked or made permanently inaccessible during registration, migration, or transfer
The transaction-manager and smart-account packages are particularly relevant to several of these areas.
These are places we know deserve careful attention, but they aren't meant to narrow the search. If you find something unexpected elsewhere in the in-scope code, we want to hear about it.
Immunefi has the complete impact and severity definitions on the competition page.
Researchers shouldn't have to spend time rediscovering issues we've already found.
Ahead of Beta, the code went through several rounds of internal security work, including an AI-assisted review, expert review, follow-up audits, and a source-level review of the transaction-manager and smart-account packages.
We've published the findings from those reviews alongside known issues from QA and the internal bug tracker. Publicly disclosed issues aren't eligible for rewards, but making them available gives researchers a clearer picture of what has already been tested and where there may still be room to look deeper.
It also makes the gaps visible. Earlier application audits focused primarily on application source directories, while some supporting areas received less systematic review. The transaction-manager and smart-account packages received deeper source-level attention in August, but there's still value in another independent set of eyes.
A bypass of an existing fix can qualify as a new finding, as can a vulnerability with a separate root cause or a materially different security consequence from something already disclosed.
The competition has a maximum reward pool of $70,000, with the final pool determined by the highest-severity vulnerability found:
- Critical: $70,000
- High: $50,000
- Medium or Low: $30,000
- No security vulnerabilities found: $3,000
Rewards are denominated in USD and paid in USDC on Ethereum under Immunefi's standardized competition terms.
Submissions require a step-by-step proof of concept. A submission fee, set and managed by Immunefi, applies to each report and is shown at submission time. If a researcher disagrees with a closure decision, initiating a mediation also requires a fee set by Immunefi. Runnable code isn't required for the initial report, although Immunefi may request it where additional verification is needed. Researchers receiving rewards will also need to complete KYC.
The competition is open now through September 14.
Once submissions close, ENS and Immunefi will review the reports and complete the competition's resolution process. The current schedule has final results and payments published on October 26, 2026.
The ENSv2 Beta is already giving the community a chance to test the new experience. This competition is an invitation to security researchers to go further and examine the code that makes those experiences work.
If that's your area, we'd like you involved.