Beanstalk

Back to Explore Paused Beanstalk This bug bounty program is focused on securing all 3 of the following projects: Beanstalk is a permissionless fiat stablecoin protocol; Basin is a composable EVM-native decentralized exchange protocol; and Pipeline is a sandbox contract that can execute an arbitrary number of actions within the EVM from an EOA in a single transaction. ETH Defi Infrastructure DAO DEX Stablecoin Solidity Typescript Maximum Bounty $1,100,000 Live Since 11 October 2022 Last Updated 27 October 2026 PoC Required Vault program Submit a Bug Information Scope Resources Immunefi vault program Funds available $0 30d Avg. Funds availability $0 Assets in vault Public vault address 0x66Efac6e6d58D4058CF017E66a0039315a3eb29C Rewards Beanstalk provides rewards in BEAN on Ethereum , denominated in USD. Rewards by Threat Level Smart Contract Critical Max: $1,100,000 Min: $100,000 Primacy of Rules High Max: $100,000 Min: $10,000 Primacy of Rules Medium Max: $10,000 Min: $1,000 Primacy of Rules Critical Reward Calculation Mainnet assets: Reward amount is 10 % of the funds directly affected up to a maximum of: $1,100,000 Minimum reward to discourage security researchers from withholding a bug report: $100,000 Websites and Applications Critical Max: $50,000 Min: $1,000 Primacy of Rules Rewards Body Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3 . The following is a simplified 3-level scale, focusing on the impact of the vulnerability reported. The complete scope can be found below. In order to be considered for the maximum potential reward, bug reports must come with a Proof of Concept (PoC). Explanations and statements are not accepted in lieu of a PoC. Bug reports that do not come with a PoC may qualify for a maximum of up to 30% of the potential reward outlined below, as determined by the Beanstalk Immunefi Committee. Funds at Risk for a given bug report are defined as follows: Funds at Risk are determined based on the token amounts and USD values at time of the bug report submission; For Beans, Funds at Risk are determined based on the liquidatable USD value of the Beans at risk; For non-Beans (ETH, WETH, 3CRV, USDC, DAI, USDT, etc.) in any in-scope assets, the Funds at Risk are determined based on their respective USD values; For Circulating non-Beans (i.e., outside of any in-scope assets), the Funds at Risk are determined to be 50% of their respective USD values; and If the smart contract where the vulnerability exists can be upgraded or paused, only the Funds at Risk in initial attacks that can be executed within the first hour will be considered for a reward. Reward Calculation for Critical Smart Contract Reports Rewards for Critical smart contract vulnerabilities are capped at the lower of (a) 10% of practicable economic damage, or (b) USD 1 100 000 , primarily taking into consideration the Funds at Risk. However, there is a minimum reward of USD 100 000 for Critical severity smart contract bug reports. Reward Calculation for High Smart Contract Reports Rewards for High smart contract vulnerabilities are capped at the lower of (a) 10% of practicable economic damage, or (b) USD 100 000 , primarily taking into consideration the Funds at Risk. However, there is a minimum reward of USD 10 000 for High severity smart contract bug reports. Reward Calculation for Medium Smart Contract and All Website and Applications Reports Rewards for Medium severity smart contract vulnerabilities and all website and applications vulnerabilities are scaled based on a set of internal criteria established by the BIC. However, there is a minimum reward of USD 1 000 for Medium smart contract bug reports and Critical website and applications bug reports. The BIC will primarily take into account: The exploitability of the bug; The impact it causes; and The likelihood of the vulnerability presenting itself. Reward Payment Terms Payouts are handled by the Beanstalk Immunefi Committee Multisig (BICM) directly and are done in BEAN. Note that due to the decentralized governance process for rewarding bug bounties, rewards can take several days to be paid out after a report is confirmed to be valid. BIC Determination The BIC shall determine whether a submitting party is entitled to a bug bounty/reward, and if so, the amount of such bounty/reward (and specifically, whether such submission qualifies for a Critical, High or Medium Impact bounty/reward, what is the potential practicable economic damage of such bug based on the Funds at Risk, and what the appropriate bounty/reward should be within each Impact range). The BIC’s determination of (i) whether such submission qualifies for a Critical, High or Medium Impact bounty/reward, (ii) what is the potential practicable economic damage of such bug based on the Funds at Risk, and (iii) whether such submission came with a PoC, thereby enabling it to be considered for the maximum potential applicable reward (vs. a submission that did not come with a PoC, thereby limiting such submission to a maximum of up to 30% of the applicable reward), shall be made in the BIC’s sole and absolute discretion absolute and shall be final, and not be subject to any appeal or challenge. A submitting party may only dispute the BIC’s determination (a) that a submitting party is not entitled to any bug bounty/reward, or (b) what the appropriate bounty/reward should be within each Impact range. In such disputes, Immunefi will conduct a binding mediation. If the submitting party disputes the BIC’s decision that a submitting party is not entitled to any bug bounty/reward, Immunefi will mediate, and shall determine, in its sole and absolute discretion, which is non-appealable, whether the submitting party is entitled to any bug bounty/reward, and if so, the amount of such bug bounty/reward, up to USD 10 000 in the case of a smart contract bug reports (i.e., as if it were a Medium Impact fix), and up to USD 1 000 in the case of a website and applications bug report (i.e, as if it were a Critical Impact fix). If the submitting party disputes the BIC’s determination what the appropriate bounty/reward should be within a specific Impact range, Immunefi will mediate, and shall determine, in its sole and absolute discretion, which is non-appealable, the amount of such bug bounty/reward in the relevant Impact category; however, Immunefi may not modify or change (i) the practicable economic damage determination made by the BIC, or (b) the BIC’s determination whether such submission came with a PoC, thereby enabling it to be considered it for the maximum potential applicable reward (vs. a submission that did not come with a PoC, thereby limiting such submission to a maximum of up to 30% of the applicable reward). View impacts in scope Program Overview This bug bounty program is focused on securing all 3 of the following projects: Beanstalk is a permissionless fiat stablecoin protocol; Basin is a composable EVM-native decentralized exchange protocol; and Pipeline is a sandbox contract that can execute an arbitrary number of actions within the EVM from an EOA in a single transaction. There is a list of resources (docs, repositories, etc.) under the Assets in Scope section. You can also check out past bug reports and past bounty payouts for this bug bounty program. Bounties are paid in BEAN via the Beanstalk Immunefi Committee Multisig (BICM) . For more details about the payment process, please view the Rewards by Threat Level section further below. As the Beanstalk and Pinto Bug Bounty Programs are operated by the same team, any valid submission that affects both programs, whether reported under Pinto or Beanstalk, will be considered a known issue in the other. Eligibility Criteria Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be: — A member of the Beanstalk Immunefi Committee (BIC); or —A private auditor that has been paid by Beanstalk Farms or a related party to review the code that is reported to be vulnerable. Primacy of Impact vs Primacy of Rules The Beanstalk bug bounty program adheres to the Primacy of Rules, which means that the bug bounty program is run strictly under the terms stated on this page. Previous Audits Audit reports of the various in-scope assets can be found at https://github.com/BeanstalkFarms/Beanstalk-Audits . Any unfixed vulnerabilities mentioned in these reports (or otherwise known by the BIC or BCM) are not eligible for a reward. Immunefi Standard Badge By adhering to Immunefi’s best practice recommendations, the Beanstalk bug bounty program has satisfied the requirements for the Immunefi Standard Badge. KYC not required No KYC information is required for payout processing. Proof of Concept Proof of concept is always required for all severities. Responsible Publication Category 1: Transparent Prohibited Activities Default prohibited activities Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet Any testing with pricing oracles or third-party smart contracts Attempting phishing or other social engineering attacks against our employees and/or customers Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks) Any denial of service attacks that are executed against project assets Automated testing of services that generates significant amounts of traffic Public disclosure of an unpatched vulnerability in an embargoed bounty Any other actions prohibited by the Immunefi Rules Feasibility Limitations The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report. Chain Rollbacks Pre-Impact Bug Monitoring Attack Investment Amount Attacks With A Financial Risk To The Attacker When Is An Impactful Attack Downgraded To Griefing? Submit a Bug Total paid 1.4M from 27 paid reports Med. Resolution Time 3 days Total Assets in Scope 22