Aave bug bounty programs
aave.com Updated
Aave runs one public program: an Immunefi bug bounty paying up to $1,000,000.
- Top reward
- $1,000,000
- Immunefi
- Programs
- 1
- 1 pays cash
- Targets in scope
- 105
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Aave runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
AAVE
Immunefi · Bug bounty |
$1M | $75k | $10k | $1,000 | $1,000,000 | Partial | Required | – | Open |
-
- Critical
- $1M
- High
- $75k
- Medium
- $10k
- Low
- $1,000
- Safe harbor
- Partial
- KYC
- Required
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
105 targets. 3 excluded.
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/helpers/L2Encoder.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/aave-upgradeability/BaseImmutableAdminUpgradeabilityProxy.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/aave-upgradeability/InitializableImmutableAdminUpgradeabilityProxy.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/aave-upgradeability/VersionedInitializable.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/AaveOracle.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/DefaultReserveInterestRateStrategyV2.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/PriceOracleSentinel.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/configuration/ACLManager.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/configuration/PoolAddressesProvider.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/configuration/ReserveConfiguration.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/configuration/UserConfiguration.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/BorrowLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/BridgeLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/CalldataLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/ConfiguratorLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/EModeLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/FlashLoanLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/GenericLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/IsolationModeLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/LiquidationLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/PoolLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/ReserveLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/SupplyLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/ValidationLogic.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/math/MathUtils.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/math/PercentageMath.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/math/WadRayMath.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/pool/L2Pool.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/pool/Pool.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/pool/PoolConfigurator.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/tokenization/AToken.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/tokenization/VariableDebtToken.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/rewards/EmissionManager.sol
Source code
-
https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/rewards/RewardsController.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/aave/oracle/GhoOracle.so
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/flashMinter/GhoFlashMinter.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/feeStrategy/FixedFeeStrategy.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/GhoReserve.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/Gsm.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/Gsm4626.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/OwnableFacilitator.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/priceStrategy/FixedPriceStrategy.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/priceStrategy/FixedPriceStrategy4626.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/gho/GhoToken.sol
Source code
-
https://github.com/aave-dao/gho-origin/blob/main/src/contracts/gho/UpgradeableGhoToken.sol
Source code
-
https://github.com/aave/
Source code
-
https://github.com/aave/aave-v3-core/blob/master/contracts/protocol/tokenization/StableDebtToken.sol
Source code
-
https://github.com/aave/ccip/blob/d5c6cedde6fbca9890a92a55f2db80e94793d0ec/contracts/src/v0.8/ccip/pools/GHO/UpgradeableBurnMintTokenPool.sol
Source code
-
https://github.com/aave/ccip/blob/d5c6cedde6fbca9890a92a55f2db80e94793d0ec/contracts/src/v0.8/ccip/pools/GHO/UpgradeableLockReleaseTokenPool.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/misc/AaveOracle.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/configuration/LendingPoolAddressesProvider.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/DefaultReserveInterestRateStrategy.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/LendingPool.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/LendingPoolCollateralManager.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/LendingPoolConfigurator.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/aave-upgradeability/BaseImmutableAdminUpgradeabilityProxy.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/aave-upgradeability/InitializableImmutableAdminUpgradeabilityProxy.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/aave-upgradeability/VersionedInitializable.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/configuration/ReserveConfiguration.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/configuration/UserConfiguration.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/logic/GenericLogic.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/logic/ReserveLogic.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/logic/ValidationLogic.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/math/MathUtils.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/math/PercentageMath.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/math/WadRayMath.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/tokenization/AToken.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/tokenization/StableDebtToken.sol
Source code
-
https://github.com/aave/protocol-v2/blob/master/contracts/protocol/tokenization/VariableDebtToken.sol
Source code
-
https://github.com/bgd-labs/aave-collector-unification/blob/main/src/contracts/Collector.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/Governance.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/GovernancePowerStrategy.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/payloads/Executor.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/payloads/PayloadsController.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/voting/DataWarehouse.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/voting/VotingMachine.sol
Source code
-
https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/voting/VotingStrategy.sol
Source code
-
https://github.com/bgd-labs/aave-stk-gov-v3/blob/main/src/contracts/StakedAaveV3.sol
Source code
-
https://github.com/bgd-labs/solidity-utils/blob/7a7548c1d01f011febdb1c0d47e52c7ec6c30f9d/src/contracts/transparent-proxy/TransparentUpgradeableProxy.sol
Source code
-
https://github.com/bgd-labs/stake-token/blob/main/src/contracts/StakeToken.sol
Source code
-
Aave v2 AToken
Smart contracts
-
Aave v2 LendingPool
Smart contracts
-
Aave v2 StableDebtToken
Smart contracts
-
Aave v2 VariableDebtToken
Smart contracts
-
Aave v3 AToken
Smart contracts
-
Aave v3 Pool
Smart contracts
-
Aave v3 RewardsController
Smart contracts
-
Aave v3 StableDebtToken
Smart contracts
-
Aave v3 StakedAaveV3
Smart contracts
-
Aave v3 VariableDebtToken
Smart contracts
-
GhoToken
Smart contracts
-
Governance
Smart contracts
-
GovernancePowerStrategy
Smart contracts
-
https://etherscan.io/address/0x464C71f6c2F760DdA6093dCB91C24c39e5d6e18c
Smart contracts
-
https://etherscan.io/address/0x8A32f49FFbA88aba6EFF96F45D8BD1D4b3f35c7D
Smart contracts
-
https://etherscan.io/address/0xEFFC18fC3b7eb8E676dac549E0c693ad50D1Ce31
Smart contracts
-
PayloadsController
Smart contracts
-
stkAAVE
Smart contracts
-
stkABPT
Smart contracts
-
stkGHO
Smart contracts
-
UpgradeableBurnMintTokenPool
Smart contracts
-
UpgradeableGhoToken
Smart contracts
-
UpgradeableLockReleaseTokenPool
Smart contracts
-
VotingMachine
Smart contracts
-
VotingStrategy
Smart contracts
No target matches. Try part of a host name, such as the company name.
Out of scope 3
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
non-active features
-
Testnet and mock files
-
The OpenZeppelin base contract
Recent changes
Reward and scope changes across every Aave program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under aave.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.