Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

AAVE

Bug bounty on Immunefi aave.com

Accepting reports KYC to get paid Asset Management DAO Defi
Go to program
Top reward
$1,000,000
Top severity paid
Critical
Assets in scope
105
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $1,000,000
for critical bugs, from $1,000.
Report on Immunefi
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Paid by AAVE, stablecoin
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Immunefi lists as the payout for each severity.

Severity Reward
Critical $1,000,000 10% of funds at risk · from $50,000
High $75,000 from $10,000
Medium $10,000
Low $1,000
Safe harbor
Partial Aave adheres to category 3. This Policy determines what information whitehats are allowed to make public from their submitted bug reports.

Summarised with AI from the program policy on Immunefi, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

105 assets you may test, 3 excluded.

Source code 80

  • https://github.com/aave/
  • https://github.com/aave/aave-v3-core/blob/master/contracts/protocol/tokenization/StableDebtToken.sol
  • https://github.com/aave/ccip/blob/d5c6cedde6fbca9890a92a55f2db80e94793d0ec/contracts/src/v0.8/ccip/pools/GHO/UpgradeableBurnMintTokenPool.sol
  • https://github.com/aave/ccip/blob/d5c6cedde6fbca9890a92a55f2db80e94793d0ec/contracts/src/v0.8/ccip/pools/GHO/UpgradeableLockReleaseTokenPool.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/helpers/L2Encoder.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/AaveOracle.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/aave-upgradeability/BaseImmutableAdminUpgradeabilityProxy.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/aave-upgradeability/InitializableImmutableAdminUpgradeabilityProxy.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/aave-upgradeability/VersionedInitializable.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/DefaultReserveInterestRateStrategyV2.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/misc/PriceOracleSentinel.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/configuration/ACLManager.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/configuration/PoolAddressesProvider.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/configuration/ReserveConfiguration.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/configuration/UserConfiguration.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/BorrowLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/BridgeLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/CalldataLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/ConfiguratorLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/EModeLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/FlashLoanLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/GenericLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/IsolationModeLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/LiquidationLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/PoolLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/ReserveLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/SupplyLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/logic/ValidationLogic.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/math/MathUtils.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/math/PercentageMath.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/libraries/math/WadRayMath.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/pool/L2Pool.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/pool/PoolConfigurator.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/pool/Pool.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/tokenization/AToken.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/tokenization/VariableDebtToken.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/rewards/EmissionManager.sol
  • https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/rewards/RewardsController.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/aave/oracle/GhoOracle.so
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/flashMinter/GhoFlashMinter.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/feeStrategy/FixedFeeStrategy.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/GhoReserve.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/Gsm4626.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/Gsm.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/OwnableFacilitator.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/priceStrategy/FixedPriceStrategy4626.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/facilitators/gsm/priceStrategy/FixedPriceStrategy.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/gho/GhoToken.sol
  • https://github.com/aave-dao/gho-origin/blob/main/src/contracts/gho/UpgradeableGhoToken.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/misc/AaveOracle.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/configuration/LendingPoolAddressesProvider.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/DefaultReserveInterestRateStrategy.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/LendingPoolCollateralManager.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/LendingPoolConfigurator.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/lendingpool/LendingPool.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/aave-upgradeability/BaseImmutableAdminUpgradeabilityProxy.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/aave-upgradeability/InitializableImmutableAdminUpgradeabilityProxy.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/aave-upgradeability/VersionedInitializable.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/configuration/ReserveConfiguration.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/configuration/UserConfiguration.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/logic/GenericLogic.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/logic/ReserveLogic.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/logic/ValidationLogic.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/math/MathUtils.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/math/PercentageMath.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/libraries/math/WadRayMath.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/tokenization/AToken.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/tokenization/StableDebtToken.sol
  • https://github.com/aave/protocol-v2/blob/master/contracts/protocol/tokenization/VariableDebtToken.sol
  • https://github.com/bgd-labs/aave-collector-unification/blob/main/src/contracts/Collector.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/GovernancePowerStrategy.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/Governance.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/payloads/Executor.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/payloads/PayloadsController.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/voting/DataWarehouse.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/voting/VotingMachine.sol
  • https://github.com/bgd-labs/aave-governance-v3/blob/main/src/contracts/voting/VotingStrategy.sol
  • https://github.com/bgd-labs/aave-stk-gov-v3/blob/main/src/contracts/StakedAaveV3.sol
  • https://github.com/bgd-labs/solidity-utils/blob/7a7548c1d01f011febdb1c0d47e52c7ec6c30f9d/src/contracts/transparent-proxy/TransparentUpgradeableProxy.sol
  • https://github.com/bgd-labs/stake-token/blob/main/src/contracts/StakeToken.sol

Smart contracts 25

  • Aave v2 AToken
  • Aave v2 LendingPool
  • Aave v2 StableDebtToken
  • Aave v2 VariableDebtToken
  • Aave v3 AToken
  • Aave v3 Pool
  • Aave v3 RewardsController
  • Aave v3 StableDebtToken
  • Aave v3 StakedAaveV3
  • Aave v3 VariableDebtToken
  • GhoToken
  • Governance
  • GovernancePowerStrategy
  • https://etherscan.io/address/0x464C71f6c2F760DdA6093dCB91C24c39e5d6e18c
  • https://etherscan.io/address/0x8A32f49FFbA88aba6EFF96F45D8BD1D4b3f35c7D
  • https://etherscan.io/address/0xEFFC18fC3b7eb8E676dac549E0c693ad50D1Ce31
  • PayloadsController
  • stkAAVE
  • stkABPT
  • stkGHO
  • UpgradeableBurnMintTokenPool
  • UpgradeableGhoToken
  • UpgradeableLockReleaseTokenPool
  • VotingMachine
  • VotingStrategy
Out of scope (3)
  • non-active features
  • Testnet and mock files
  • The OpenZeppelin base contract

Rules

What the policy asks of you, and the bug types it won't reward, quoted from AAVE (via Immunefi)'s policy. "We" in these lines means the program, not this site.

While testing

  • Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
  • Any testing with pricing oracles or third-party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks that are executed against project assets
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty
  • A PoC is required for all Smart Contract bug reports.

Not accepted

  • Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
  • Loss of rewards-to-be-accrued is initially not considered a loss of funds.
  • Evident - A stablecoin (listed on Aave) gets exploited and that has immediate consequences on Aave via borrowing attacks or others.

Summarised with AI from the program policy on Immunefi, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 55 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from immunefi.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Back to Explore AAVE Aave is a decentralized non-custodial liquidity protocol where users can participate as suppliers or borrowers in a common pool. Suppliers provide liquidity to earn a passive income, while borrowers are able to borrow in an overcollateralized (perpetually) or undercollateralized (one-block liquidity) fashion. ETH Defi Asset Management DAO Lending Stablecoin Staking Solidity Maximum Bounty $1,000,000 Live Since 18 October 2023 Last Updated 17 April 2026 PoC Required KYC required Submit a Bug Information Scope Resources Rewards AAVE provides rewards in AAVE and stablecoins on Ethereum , denominated in USD. Rewards by Threat Level Smart Contract Critical Max: $1,000,000 Min: $50,000 Primacy of Rules High Max: $75,000 Min: $10,000 Primacy of Rules Medium Flat: $10,000 Primacy of Rules Low Flat: $1,000 Primacy of Rules Critical Reward Calculation Mainnet assets: Reward amount is 10 % of the funds directly affected up to a maximum of: $1,000,000 Minimum reward to discourage security researchers from withholding a bug report: $50,000 Rewards Body Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. Reward Calculation for Critical Level Reports For critical Smart Contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 1 000 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 50 000 is to be rewarded in order to incentivize security researchers against withholding a bug report. There needs to be an absolute minimum of USD 10 000 at risk in order to be considered Critical. Reward Calculation for Direct theft of any funds in the Aave Treasury For the impact “Direct theft of any funds in the Aave Treasury”, which is considered as High, the reward amount is 10% of the funds directly affected up to a maximum of USD 75 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 10 000 is to be rewarded. There needs to be a minimum of USD 5 000 at risk in order to be considered as High affecting the Aave Treasury. Repeatable Attack Limitations In cases of repeatable attacks for smart contract bugs, the amount of funds at risk will be calculated within the first 45 minutes from the first attack, inclusive, no matter how many times the attack can be executed within that time frame, as demonstrated by the PoC provided by the security researcher. Example 1: vulnerability is discovered that can steal USD 1 million 30 times within 45 minutes from the first execution of the attack, then the funds at risk is considered as USD 30 million. Example 2: if a vulnerability is discovered that can steal USD 1 million once every 45 minutes from the first execution of the attack, then the funds at risk is considered as USD 1 million. However, for smart contracts directly holding funds that can’t be protected, if a discovered vulnerability includes the temporary locking of funds that could otherwise be withdrawn and thus prevented from being stolen but still accessible to the exploiter to take the funds, the time is extended to the exact same time as temporary locking. Extensions of the temporary locking that introduce a gap where withdrawals can happen will not be considered. Reward Calculation for High Level Reports High smart contract vulnerabilities will be capped at up to 100% of the funds affected. In the event of temporary locking, the reward doubles for every additional 3600 blocks that the funds or NFTs could be temporarily locked, rounded down to the nearest multiple of 3600 blocks, up to the hard cap of USD 75 000. However, there is a further hard cap of 1000% of the funds affected after the multiplier effect of the duration of temporary locking. If the duration of temporary locking is 3600 blocks or less, then the severity level will be reduced to Medium if the amount is equal to or greater than USD 1 000 000. If not, the severity level will be downgraded to Low. There needs to be a minimum of USD 5 000 at risk in order for a report to be considered High. Unless downgraded, all bug reports with a severity level of High at the end of the evaluation of the bug report will have a minimum reward of USD 10 000. Restrictions on Security Researcher Eligibility Security researchers who fall under any of the following are INELIGIBLE for a reward: Official Contributors, defined as: Developers who have worked on Aave Labs, BGD, or any other party officially engaged with the DAO for the development of the contracts in scope. Security auditors/firms that directly or indirectly participated in the review of the code impacted. For example, an audit firm/security researcher who audited Aave v3.1 is not eligible for bounties regarding any problem related with v3.1. White-hats who already reported the same type of bug, with the same type defined as easy to infer by an Aave-expert party, like the Immunefi reviewers. Security researchers who fall under any of the following are explicitly ELIGIBLE for a reward: Independent security researchers who didn’t officially review the part of the code impacted. Independent contributors to Aave via sporadic commits. Former Official Contributors are eligible if their last contribution has been more than 24 months before the bug report. Previous Audits GHO https://github.com/aave-dao/gho-origin/blob/main/audits/2023-03-01_ABDK.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2022-08-12_Openzeppelin-v1.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2022-11-10_Openzeppelin-v2.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2023-07-06_SigmaPrime.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2023-09-20_GSM_Stermi.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2023-10-23_GSM_SigmaPrime.pdf https://github.com/aave-dao/gho-origin/blob/main/certora/reports/Aave_Gho_Formal_Verification_Report.pdf https://github.com/aave-dao/gho-origin/blob/main/certora/reports/Formal_Verification_Report_of_GHO_Stability_Module.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2024-06-11_UpgradeableGHO_Certora.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2024-09-15_ModularGhoStewards_Certora.pdf https://github.com/aave-dao/gho-origin/blob/main/audits/2025-07-15_RemoteGSM_Certora.pdf V3.3 https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-11-07_Certora_Aave-v3.3.0.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-10-22_StErMi_Aave-v3.3.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2025-01-29_Oxorio_Aave-v3.3.0.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2025-01-22_Sherlock_Aave-v3.3.0.pdf V3.2 https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-09-10_Certora_Aave-v3.2_Stable_Rate_Removal.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-09-30_Enigma_Aave-v3.2.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-09-19_Certora_Aave-v3.2_Liquid_eModes.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-09-12_Oxorio_Aav3-v3.2.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-09-15_Pashov_Aave-v3.2.pdf V3.1 https://github.com/aave-dao/aave-v3-origin/blob/main/audits/30-04-2024_Certora_AaveV3.1.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/02-05-2024_MixBytes_AaveV3.1.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/02-06-2024-Cantina-contest-AaveV3.1.pdf V3.0.1 and V3.0.2 https://github.com/aave-dao/aave-v3-origin/blob/main/audits/23-12-2022_SigmaPrime_AaveV3-0-1.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/03-2023_2023_Certora_AaveV3-0-2.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/09-12-2022_PeckShield_AaveV3-0-1.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/19-04-2023_SigmaPrime_AaveV3-0-2.pdf V3.0.0 https://github.com/aave-dao/aave-v3-origin/blob/main/audits/27-01-2022_ABDK_AaveV3.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/27-01-2022_SigmaPrime_AaveV3.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/14-01-2022_PeckShield_AaveV3.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/07-01-2022_TrailOfBits_AaveV3.pdf https://github.com/aave-dao/aave-v3-origin/blob/main/audits/01-11-2021_OpenZeppelin_AaveV3.pdf Aave has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward. However, you are encouraged to review these audits in order to get a better understanding of the codebase V2 https://github.com/aave/protocol-v2/tree/master/audits Aave Governance V3 https://github.com/bgd-labs/aave-governance-v3/tree/main/security/sp https://github.com/bgd-labs/aave-governance-v3/tree/main/security/certora/reports Proof of Concept (PoC) Requirements A PoC is required for all Smart Contract bug reports. All PoCs submitted must comply with the Immunefi-wide PoC Guidelines and Rules . Bug report submissions without a PoC when a PoC is required will not be provided with a reward. Other Terms and Information “Sub-systems of Aave” are the following: Aave liquidity pools (including v2 and v3 in the same), Aave Governance, Aave treasury, and Aave Safety Module. “Active liquidity pool instances” are Aave v2 in Ethereum, Polygon and Avalanche; Aave v3 in Ethereum, Polygon, Avalanche, Optimism, Arbitrum, Metis, Base, GnosisChain, BNBChain, Scroll, ZKSync Era and Linea. “Aave Treasury” is defined as each one of the Aave Collector smart contracts in the different networks, connected to “Active liquidity pool instances”. Only components of these instances are considered active and eligible for bounties, no matter if included or not in aave-address-book. “Active safety module instances” are: stkAAVE, stkABPT and stkGHO. “Sub-systems of GHO” are the following: GHO stablecoin, GHO reserve of the Aave Pool, GHO FlashMinter, GHO Stability Module (GSM and GSM4626), CCIP GHO bridge, GHO stewards and GHO Remote Facilitators. “GHO stablecoin” contracts are: upgradeable and non-upgradeable versions of the GHO ERC20 Token in Ethereum, Arbitrum and Base. “GHO reserve of the Aave Pool” are contracts that enables the Aave Pool on Ethereum work as GHO Facilitator (GhoAToken, GhoVariableDebtToken, GhoStableDebtToken, GhoDiscountRateStrategy and GhoOracle). “GHO Stability Module (GSM)” are contracts that enable GHO-USDC and GHO-USDT swaps in Ethereum (GSM, FixedPriceStrategy and FixedFeeStrategy).GHO Token and facilitators listed as assets in scope (including GHO reserve of Aave Pool, GHO FlashMinter and GSM). “CCIP GHO bridge” are contracts facilitating the transfer of GHO between Ethereum, Arbitrum and Base networks. “GHO stewards” are a set of contracts that manage parameter updates related to the security, risk and growth of GHO. “GHO Remote Facilitators” are a set of contracts (primarily OwnableFacilitator and GhoReserve) that define and enable distribution strategies of GHO on remote chains. Only components of these instances are considered active and eligible for bounties, no matter if included or not in aave-address-book. Whenever the same bug is fixed or anyhow mitigated in any instance of the same sub-system, it is considered as known by the project and not eligible for bounty. Exploits consequence of newly publicly available information will be considered only if they are non-evident. Examples: Evident - A stablecoin (listed on Aave) gets exploited and that has immediate consequences on Aave via borrowing attacks or others. Non-evident - A Solidity compiler bug is found, and some logic used on Aave is affected. In addition, the nature of the way the bug affects Aave is totally different from what is disclosed in said compiler bug. On attacks involving market manipulation, a solid and realistic scenario needs to be presented in order for the bug report to be considered eligible for consideration. Realistic Scenario Example - Manipulation of an asset listed as collateral is possible via flash loans, allowing for borrowing of all available liquidity. Non-Realistic Scenario Example - Manipulation of an asset listed as collateral, but not via flash loans, depending on CL oracle update with the manipulated price, and putting at risk considerable capital. Attacks whose losses materialize via market dynamics, like shorting of AAVE in parallel with the exploit, will not take into account that component when determining the severity level. Thus, other impacts according to the Impacts in Scope Table will be considered when determining the severity level of the bug report. Precision mechanisms on aToken and other tokenization (due to balance growing) are out of scope unless they enable a provable new attack vector involving loss of funds. Loss of rewards-to-be-accrued is initially not considered a loss of funds. Only rewards already accrued would be considered under the loss of funds assessment. Otherwise, this will be downgraded to Medium. For all assets labeled as “Aave v2” and deployed on the Ethereum network, only Critical and High impacts are in-scope. For all assets labeled as “Aave v2” and deployed on networks other than Ethereum, including L2s on Ethereum, only Critical impacts are in-scope. In the event that a vulnerability exists on the GitHub file but not on the most recently deployed contract, this may be due to actions taken to fix a vulnerability quietly and that public announcement is still being planned, or any other internal operational procedure. Thus, in order to be eligible for a reward, the vulnerability must exist both in the deployed smart contract and the respective GitHub file in the Assets in Scope table, otherwise the bug report will be considered as invalid. All addresses of eligible assets can be found on the following links: Aave v2 Ethereum: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV2Ethereum.sol Aave v2 Polygon: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV2Polygon.sol Aave v2 Avalanche: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV2Avalanche.sol Aave v3 and Governance Ethereum: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Ethereum.sol , https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Ethereum.sol , https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3EthereumLido.sol Aave v3 Polygon: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Polygon.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Polygon.sol Aave v3 Optimism: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Optimism.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Optimism.sol Aave v3 Arbitrum: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Arbitrum.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Arbitrum.sol Aave v3 Avalanche: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Avalanche.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Avalanche.sol Aave v3 Metis: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Metis.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Metis.sol Aave v3 Base: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Base.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Base.sol Aave v3 Gnosis: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Gnosis.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Gnosis.sol Aave v3 BNBChain: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3BNB.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3BNB.sol Aave v3 Scroll: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Scroll.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Scroll.sol Aave v3 ZKSync Era: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3ZkSync.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3ZkSync.sol Aave v3 Linea: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Linea.sol https://github.com/bgd-labs/aave-address-book/blob/main/src/GovernanceV3Linea.sol Aave Safety Module: https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveSafetyModule.sol GHO Ethereum: https://github.com/bgd-labs/aave-address-book/blob/main/src/GhoEthereum.sol GHO Arbitrum: https://github.com/bgd-labs/aave-address-book/blob/main/src/GhoArbitrum.sol GHO Base: https://github.com/bgd-labs/aave-address-book/blob/main/src/GhoBase.sol GHO Avalanche: https://github.com/bgd-labs/aave-address-book/blob/main/src/GhoAvalanche.sol GHO Gnosis: https://github.com/bgd-labs/aave-address-book/blob/main/src/GhoGnosis.sol The following assets have their inheritance chain of contracts also included as in-scope for the bug bounty program within the limitations of the respective asset being in v2, v3 or GHO. The OpenZeppelin base contract, however, is not considered as in-scope. If you find a bug in the inheritance chain of contracts, select the related asset in the Assets in Scope table. Aave v2 LendingPool Aave v2 AToken Aave v2 VariableDebtToken Aave v2 StableDebtToken Aave v3 Pool Aave v3 AToken Aave v3 VariableDebtToken Aave v3 StableDebtToken Aave v3 RewardsController Aave v3 StakedAaveV3 Governance VotingStrategy GovernancePowerStrategy VotingMachine PayloadsController GhoToken UpgradeableGhoToken UpgradeableLockReleaseTokenPool UpgradeableBurnMintTokenPool The following assets are based on Chainlink’s Cross-Chain Interoperability Protocol (CCIP) v1.5.1 . and are covered by the Chainlink Immunefi Bug Bounty Program. Only logic related to GHO and specifically added for GHO integration (including inheritance chain of contracts, except OpenZepellin base contract) is within the program’s scope. UpgradeableLockReleaseTokenPool UpgradeableBurnMintTokenPool Reward Payment Terms Payouts are handled by the Aave DAO directly, but in coordination with BGD and Aave Labs, and are denominated in USD. However, payments are done in a mix of AAVE and a stablecoin with a tight correlation to USD 1 with equal to or less than 0.5% average deviation over a period of 1 month preceding the submission of the bug report, at the discretion of BGD Labs. The calculation of the net amount rewarded is based on the average price of the past 30 days immediately preceding the bug report time. For avoidance of doubt, this will be calculated as exactly 720 hours preceding the bug report time. However, the stablecoin used will always have an effective value of USD 1. Due to the limitations with DAO payments, each valid bug report will require its own proposal within the DAO for payment. Though this will be coordinated with the DAO representatives and the security researcher submitting the report will not be required to be involved, this delays payments to the end of each month. As details about the bug report need to be included in the governance proposal, a proposal cannot be made until a fix has been implemented, due to the security risks of publicly disclosing a live vulnerability. View impacts in scope Program Overview Aave is a decentralized non-custodial liquidity protocol where users can participate as suppliers or borrowers in a common pool. Suppliers provide liquidity to earn a passive income, while borrowers are able to borrow in an overcollateralized (perpetually) or undercollateralized (one-block liquidity) fashion. For more information about Aave, please visit https://aave.com/. Aave provides rewards in a mix of AAVE and stablecoins. For more details about the payment process, please view the Rewards by Threat Level section further below. Aave is represented by its service providers BGD Labs (Aave v2/v3/SM/Governance) and Aave Labs (GHO). BGD and Aave Labs as appointed representatives of the DAO exclusively in this context, based on a successful Aave governance proposal. KYC Requirement The provision of KYC may be required for a reward for this bug bounty program at the discretion of the DAO representative or representatives. If KYC is requested, the following information will be required to be done: Live video call where the following may be asked: Government-issued ID KYC will not be required for bug reports classified with a severity level as Medium or Low. Responsible Publication Aave adheres to category 3. This Policy determines what information whitehats are allowed to make public from their submitted bug reports. For more information about the category selected, please refer to our Responsible Publication page. Primacy of Impact vs Primacy of Rules Aave adheres to the Primacy of Impact for the following impacts: Smart Contract - Critical - Major manipulation of governance voting result deviating from voted outcome, whenever protection mechanisms (e.g. cancellation of proposal) can’t mitigate the damage. Smart Contract - Critical - Direct theft of any user funds classified as the principal, whether at-rest or in-motion, if more than 100 USD value and representing minimum 1% of the user’s position. Smart Contract - Critical - Permanent locking of user funds classified as the principal, whenever no rescue of any type can be performed. If an impact is covered within the Primacy of Impact, it means that even if the impacted asset is not in-scope but is owned by the project, then it would be considered as in-scope of the bug bounty program. Only sub-systems of Aave and sub-systems of GHO explicitly mentioned in the section “Other Terms and Information” are considered as owned by the project, anything outside that is not eligible for any bounty. When submitting a report, just select the Primacy of Impact asset placeholder. If the impact affects something in any of the related GitHub repositories, select the placeholder containing the link to the specific repository instead. If the team behind this project has multiple projects, those other projects are not covered under the Primacy of Impact of this program. Instead, check if those other projects have a bug bounty program on Immunefi. Testnet and mock files, as well as non-active features, defined as features that 1) are not introduced in production and 2) are not able to be used due to configurations of the protocol, are not covered under the Primacy of Impact. All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms of the bug bounty program. Immunefi Standard Badge Aave has satisfied the requirements for the Immunefi Standard Badge , which is given to projects that adhere to our best practices. Governance-Run Program This bug bounty program is governed by a governance proposal. To view the governance proposal poll, visit https://app.aave.com/governance/proposal/?proposalId=325 . KYC required The submission of KYC information is a requirement for payout processing. Participants must adhere to the Eligibility Criteria. Proof of Concept Proof of concept is always required for all severities. Responsible Publication Category 3: Approval Required Prohibited Activities Default prohibited activities Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet Any testing with pricing oracles or third-party smart contracts Attempting phishing or other social engineering attacks against our employees and/or customers Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks) Any denial of service attacks that are executed against project assets Automated testing of services that generates significant amounts of traffic Public disclosure of an unpatched vulnerability in an embargoed bounty Any other actions prohibited by the Immunefi Rules Feasibility Limitations The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report. Chain Rollbacks Pre-Impact Bug Monitoring Attack Investment Amount Attacks With A Financial Risk To The Attacker When Is An Impactful Attack Downgraded To Griefing? Submit a Bug Total Assets in Scope 83