Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Lombard Finance

Bug bounty on Immunefi lombard.finance

Accepting reports KYC to get paid Bitcoin Defi web3
Go to program Website
Top reward
$500,000
Top severity paid
Critical
Assets in scope
52
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $500,000
for critical bugs, from $1,000.
Report on Immunefi
Submit through the program page.
Paid by USDC on Ethereum
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Immunefi lists as the payout for each severity.

Severity Reward
Critical Web $30,000 from $15,000
Critical Contract $500,000 10% of funds at risk · from $50,000
High Web $10,000
High Contract $50,000 from $10,000
Medium Web $2,000
Medium Contract $2,500
Low Contract $1,000

Scope

52 assets you may test.

Source code 40

  • https://github.com/Liquid-Bitcoin/BARD/blob/main/contracts/BARD/BARD.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/Bascule.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/BasculeV2.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/GMPBasculeV1.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/GMPBasculeV2.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bridge/BridgeV2.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bridge/providers/BridgeTokenPool.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bridge/providers/LombardTokenPoolV2.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/consortium/Consortium.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/consortium/LombardTimeLock.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/gmp/Mailbox.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/AssetRouter.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/BridgeTokenAdapter.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/NativeLBTC.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/StakedLBTCOracle.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/StakedLBTC.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/stakeAndBake/depositor/veda/ERC4626VaultWrapper.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/stakeAndBake/StakeAndBake.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/stakeAndBake/veda/ERC4626VaultTokenWrapper.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/strategy/BlocklistOracle.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/strategy/MultiAssetWithAsyncRedemptionStrategy.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/strategy/shards/Shard.sol
  • https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/strategy/validators/MerkleAllowlistValidator.sol
  • https://github.com/lombard-finance/evm-smart-contracts/tree/main/contracts/strategy/converters
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/asset_router
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/bascule
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/bascule_gmp
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/bridge
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/consortium
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/lombard_token_pool
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/mailbox
  • https://github.com/lombard-finance/sol-svm-contracts/tree/main/programs/ratio_oracle
  • https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/asset_router
  • https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/bascule
  • https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/consortium
  • https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/token
  • https://github.com/lombard-finance/sui-move-contracts/tree/main/move/bascule
  • https://github.com/lombard-finance/sui-move-contracts/tree/main/move/bridge_vault
  • https://github.com/lombard-finance/sui-move-contracts/tree/main/move/consortium
  • https://github.com/lombard-finance/sui-move-contracts/tree/main/move/lbtc

Smart contracts 10

  • https://etherscan.io/address/0x055E84e7FE8955E2781010B866f10Ef6E1E77e59
  • https://etherscan.io/address/0x1De9fcfeDF3E51266c188ee422fbA1c7860DA0eF
  • https://etherscan.io/address/0x451c54981C7DA5d95901b770C540547cF5FE0A2D
  • https://etherscan.io/address/0x8236a87084f8b84306f72007f36f2618a5634494
  • https://etherscan.io/address/0x964677F337d6528d659b1892D0045B8B27183fc0
  • https://etherscan.io/address/0x9eCe5fB1aB62d9075c4ec814b321e24D8EA021ac
  • https://etherscan.io/address/0xB0F70C0bD6FD87dbEb7C10dC692a2a6106817072
  • https://etherscan.io/address/0xC3ecFE771564e3f28CFB7a9b203F4d10279338eD
  • https://etherscan.io/address/0xc750eCAC7250E0D18ecE2C7a5F130E3A765dc260
  • https://etherscan.io/address/0xdad58dfa5c1a7a34419afdbe1f0d610efeea95e4

Domains 2

  • lombard.finance
  • lombard.finance/app

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Lombard Finance (via Immunefi)'s policy. "We" in these lines means the program, not this site.

While testing

  • Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
  • Any testing with pricing oracles or third-party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks that are executed against project assets
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty
  • A PoC, demonstrating the bug's impact, is required for this program and has to comply with the Immunefi PoC Guidelines and Rules .

Not accepted

  • All issues covered by previous audits.
  • All issues previously reported via bug bounty or audit competitions.
  • Any unfixed vulnerabilities mentioned in these reports are not eligible for a reward.

Summarised with AI from the program policy on Immunefi, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 59 minutes ago.

  1. Raised

    Top reward $250,000 to $500,000.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Rules updated

    Added: “…nsures stronger incentives for bug disclosure of this nature”

  2. Reward terms

    The reward table or payout terms were edited

  3. Rules updated

    Added: “Critical web/app reports are rewarded only when the report demonstrates that the impact puts users' funds at risk:”

  4. Reward raised

    Maximum $250,000 → $500,000

  5. Scope removed

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/strategy/MultiAssetWithAsyncRedemptionStrategy.sol

  6. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/stakeAndBake/depositor/veda/ERC4626VaultWrapper.sol

  7. Scope removed

    https://etherscan.io/address/0xdad58dfa5c1a7a34419afdbe1f0d610efeea95e4

  8. Scope removed

    https://etherscan.io/address/0x1De9fcfeDF3E51266c188ee422fbA1c7860DA0eF

  9. Scope removed

    https://etherscan.io/address/0xC3ecFE771564e3f28CFB7a9b203F4d10279338eD

  10. Scope removed

    https://etherscan.io/address/0xB0F70C0bD6FD87dbEb7C10dC692a2a6106817072

  11. Scope removed

    https://etherscan.io/address/0x9eCe5fB1aB62d9075c4ec814b321e24D8EA021ac

  12. Scope removed

    https://etherscan.io/address/0x055E84e7FE8955E2781010B866f10Ef6E1E77e59

  13. Scope removed

    https://etherscan.io/address/0x8236a87084f8b84306f72007f36f2618a5634494

  14. Scope removed

    https://etherscan.io/address/0x964677F337d6528d659b1892D0045B8B27183fc0

  15. Scope removed

    https://etherscan.io/address/0xc750eCAC7250E0D18ecE2C7a5F130E3A765dc260

  16. Scope removed

    https://etherscan.io/address/0x451c54981C7DA5d95901b770C540547cF5FE0A2D

  17. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/StakedLBTCOracle.sol

  18. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/stakeAndBake/StakeAndBake.sol

  19. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/stakeAndBake/veda/ERC4626VaultTokenWrapper.sol

  20. Scope added

    https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/asset_router

  21. Scope added

    https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/bascule

  22. Scope added

    https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/consortium

  23. Scope added

    https://github.com/lombard-finance/starknet-cairo-contracts/tree/main/packages/token

  24. Scope added

    https://github.com/lombard-finance/sui-move-contracts/tree/main/move/bascule

  25. Scope added

    https://github.com/lombard-finance/sui-move-contracts/tree/main/move/bridge_vault

  26. Scope added

    https://github.com/lombard-finance/sui-move-contracts/tree/main/move/consortium

  27. Scope added

    https://github.com/lombard-finance/sui-move-contracts/tree/main/move/lbtc

  28. Scope added

    https://lombard.finance/app/

  29. Scope added

    https://github.com/Liquid-Bitcoin/BARD/blob/main/contracts/BARD/BARD.sol

  30. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/Bascule.sol

  31. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/BasculeV2.sol

  32. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/GMPBasculeV1.sol

  33. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bascule/GMPBasculeV2.sol

  34. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bridge/BridgeV2.sol

  35. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bridge/providers/BridgeTokenPool.sol

  36. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/bridge/providers/LombardTokenPoolV2.sol

  37. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/consortium/Consortium.sol

  38. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/consortium/LombardTimeLock.sol

  39. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/gmp/Mailbox.sol

  40. Scope added

    https://github.com/lombard-finance/evm-smart-contracts/blob/main/contracts/LBTC/AssetRouter.sol

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from immunefi.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Back to Explore Lombard Finance | This program requires a submission fee for all bug reports. Security researchers must pay a non-refundable fee at the time of report submission. This fee is collected by Immunefi and is not paid to the project. The fee applies to all severity levels and is required before the report can be reviewed. Lombard is an onchain Bitcoin company, issuing institutional-grade Bitcoin assets, onchain financial solutions and core infrastructure. Founded in 2024, the company's products—including LBTC, the leading yield-bearing Bitcoin, BTC.b, the Lombard SDK, and Bitcoin Smart Accounts—enable Bitcoin to become productive capital across decentralized finance. Bitcoin Defi Maximum Bounty $500,000 Live Since 04 September 2024 Last Updated 15 October 2026 PoC Required Vault program KYC required Arbitration enabled Submit a Bug Information Scope Resources Immunefi vault program Funds available $39,991.12 30d Avg. Funds availability $39,994.68 Assets in vault 40.0k USDC Public vault address 0x5B40bf8fED4dd78d9E03c9Fc5f74cA4b90568c3E Rewards Lombard Finance provides rewards in USDC on Ethereum , denominated in USD. Rewards by Threat Level Smart Contract Critical Max: $500,000 Min: $50,000 Primacy of Impact High Max: $50,000 Min: $10,000 Primacy of Impact Medium Flat: $2,500 Primacy of Rules Low Flat: $1,000 Primacy of Rules Critical Reward Calculation Mainnet assets: Reward amount is 10 % of the funds directly affected up to a maximum of: $500,000 Minimum reward to discourage security researchers from withholding a bug report: $50,000 Websites and Applications Critical Max: $30,000 Min: $15,000 Primacy of Rules High Flat: $10,000 Primacy of Rules Medium Flat: $2,000 Primacy of Rules Rewards Body Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3 . Reward Calculation for Critical Level Reports Any reward beyond the minimum for the assigned criticality rating is at the sole discretion of Lombard Finance. Hence, for critical bug reports, a minimum reward of USD 50 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report. The default Critical reward calculation shown is therefore not applicable or guaranteed. Repeatable Attack Limitations If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward. This is because the project can mitigate the risk of further exploitation by upgrading or pausing the component where the vulnerability exists. The reward amount will depend on the severity of the impact and the funds at risk. For critical repeatable attacks on smart contracts that cannot be upgraded or paused, the project will consider the cumulative impact of the repeatable attacks for a reward. This is because the project cannot prevent the attacker from repeatedly exploiting the vulnerability until all funds are drained and/or other irreversible damage is done. Reward Calculation for High Level Reports High vulnerabilities concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of $10,000 to $50,000 depending on the funds at risk, capped at the maximum high reward. In the event of temporary freezing, the reward doubles from the full frozen value for every additional [24h] that the funds are temporarily frozen, up until a max cap of the high reward. This is because as the duration of the freezing lengthens, the potential for greater damage and subsequent reputational harm intensifies. Thus, by increasing the reward proportionally with the frozen duration, the project ensures stronger incentives for bug disclosure of this nature __Critical web/app reports are rewarded only when the report demonstrates that the impact puts users' funds at risk: USD 30,000 for a loss of users' funds through an attack that does not require any user action, or for private key or private key generation leakage leading to unauthorized access to users' funds USD 15,000 for any other Critical impact that leads to a loss of users' funds An impact that cannot affect users' funds is assessed at a severity below Critical.The rest of the severity levels are paid out according to the Impact in Scope table. Reward Payment Terms Payouts are handled by the Lombard team directly and are denominated in USD. However, payments are done in USDC on Ethereum. The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. View impacts in scope Program Overview Lombard is a leading Bitcoin finance protocol with $3 billion in Bitcoin onboarded. Founded in 2024 and backed by Polychain Capital, Franklin Templeton, and Binance Labs, Lombard's products — LBTC, BTC.b, the Lombard SDK, Bitcoin Earn and Bitcoin Smart Accounts — enable Bitcoin holders, corporate treasuries, and financial institutions to earn yield on, borrow against, and deploy their Bitcoin onchain. Lombard's infrastructure powers Bitcoin products for the users of Ledger, Binance, and Bybit, and integrates with Aave, Morpho, and 50+ DeFi protocols across 10+ blockchains. For more information about Lombard, please visit https://www.lombard.finance/ Lombard provides rewards in USDC on Ethereum, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section further below. KYC Requirement Lombard will be requesting KYC information in order to pay for successful bug submissions. The following information will be required: Full name Date of birth Proof of address (either a redacted bank statement with address or a recent utility bill) Copy of Passport or other Government issued ID Primacy of Impact vs Primacy of Rules Lombard adheres to the Primacy of Impact for the following impacts: Smart contract - Critical Smart Contract - High Primacy of Impact means that the impact is prioritized rather than a specific asset. This encourages security researchers to report on all bugs with an in-scope impact, even if the affected assets are not in scope. For more information, please see Best Practices: Primacy of Impact When submitting a report on Immunefi’s dashboard, the security researcher should select the Primacy of Impact asset placeholder. If the team behind this project has multiple programs, those other programs are not covered under Primacy of Impact for this program. Instead, check if those other projects have a bug bounty program on Immunefi. If the project has any testnet and/or mock files, those will not be covered under Primacy of Impact. All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms and conditions set within this program. Proof of Concept (PoC) Requirements A PoC, demonstrating the bug's impact, is required for this program and has to comply with the Immunefi PoC Guidelines and Rules . Public Disclosure of Known Issues Bug reports covering previously-discovered bugs (listed below) are not eligible for a reward within this program. This includes known issues that the project is aware of but has consciously decided not to “fix”, necessary code changes, or any implemented operational mitigating procedures that can lessen potential risk. All issues covered by previous audits. All issues previously reported via bug bounty or audit competitions. Previous Audits Lombard’s completed audit reports can be found at https://github.com/lombard-finance/evm-smart-contracts/tree/main/docs/audit . Any unfixed vulnerabilities mentioned in these reports are not eligible for a reward. Immunefi Standard Badge By adhering to Immunefi’s best practice recommendations, Lombard has satisfied the requirements for the Immunefi Standard Badge . KYC required The submission of KYC information is a requirement for payout processing. Participants must adhere to the Eligibility Criteria. Proof of Concept Proof of concept is always required for all severities. Responsible Publication Category 3: Approval Required Prohibited Activities Default prohibited activities Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet Any testing with pricing oracles or third-party smart contracts Attempting phishing or other social engineering attacks against our employees and/or customers Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks) Any denial of service attacks that are executed against project assets Automated testing of services that generates significant amounts of traffic Public disclosure of an unpatched vulnerability in an embargoed bounty Any other actions prohibited by the Immunefi Rules Feasibility Limitations The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report. Chain Rollbacks Pre-Impact Bug Monitoring Attack Investment Amount Attacks With A Financial Risk To The Attacker When Is An Impactful Attack Downgraded To Griefing? Submit a Bug 30d Avg. Funds Availability $39,994.68 Total Assets in Scope 53