Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Pareto Credit

Bug bounty on Immunefi pareto.credit

Accepting reports No KYC Defi ETH Solidity
Go to program Website
Top reward
$50,000
Top severity paid
Critical
Assets in scope
24
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $50,000
for critical bugs.
Report on Immunefi
Submit through the program page.
Paid by USDC, IDLE
No identity check to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Immunefi lists as the payout for each severity.

Severity Reward
Critical $50,000 10% of funds at risk
High $20,000
Medium $5,000

Scope

24 assets you may test.

Smart contracts 24

  • https://docs.pareto.credit/developers/addresses/product/credit-vaults
  • https://etherscan.io/address/0x0b4F695B05902efc14344d19ED1d0B0E061C8A3E
  • https://etherscan.io/address/0x14B8E918848349D1e71e806a52c13D4e0d3246E0
  • https://etherscan.io/address/0x17E9Ab2992dfecBe779a06A92a6cDB9fE6aEeEf3
  • https://etherscan.io/address/0x2Cd361544a3647Ab16A983cA2576f084abEA80D0
  • https://etherscan.io/address/0x338e0a8008364a4d5139cB49E00e93bDb51290d6
  • https://etherscan.io/address/0x3Fc0265E92EeafED0cCd9F8621764Ce0981882cE
  • https://etherscan.io/address/0x433D5B175148dA32Ffe1e1A37a939E1b7e79be4d
  • https://etherscan.io/address/0x45054c6753b4bce40c5d54418dabc20b070f85be
  • https://etherscan.io/address/0x5cC24f44cCAa80DD2c079156753fc1e908F495DC
  • https://etherscan.io/address/0x5eCF8bF9eae51c2FF47FAc8808252FaCd8e36797
  • https://etherscan.io/address/0x74E862277B5BEC233E2f1b0272CE1e215462507a
  • https://etherscan.io/address/0x7A4E728B9fEbec04de724821eb9056828C2D1c06
  • https://etherscan.io/address/0x9372a533Db980bD9591D3c7C457dC220Bf1A0Ab4
  • https://etherscan.io/address/0x9cF358aff79DeA96070A85F00c0AC79569970Ec3
  • https://etherscan.io/address/0xa30bE796FB2BAbF9228359E86A041c14e29f86Fc
  • https://etherscan.io/address/0xae7913c672c7F1f76C2a1a0Ac4de97d082681234
  • https://etherscan.io/address/0xBC6cffAFC8F98d7DF780cE05fA55e14781C1C14D
  • https://etherscan.io/address/0xC26A6Fa2C37b38E549a4a1807543801Db684f99C
  • https://etherscan.io/address/0xC35D078092872Ec1f2ae82bcd6f0b6b89F0850de
  • https://etherscan.io/address/0xD1624bb76743dd8dC8D8043246e7338A5CD23772
  • https://etherscan.io/address/0xf6223C567F21E33e859ED7A045773526E9E3c2D5
  • https://etherscan.io/address/0xf6b24eC487680Aa3716f0DAEfB9264419b429384
  • https://etherscan.io/token/0xEC6a70F62a83418c7fb238182eD2865F80491a8B

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Pareto Credit (via Immunefi)'s policy. "We" in these lines means the program, not this site.

While testing

  • Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
  • Any testing with pricing oracles or third-party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks that are executed against project assets
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty
  • Any other actions prohibited by the Immunefi Rules

Not accepted

  • Best practices critiques are not accepted under this program.

Summarised with AI from the program policy on Immunefi, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Reward terms

    The reward table or payout terms were edited

  2. Reward terms

    The reward table or payout terms were edited

  3. Rules updated

    Added: “…ated**/**Decommissioned** in doc are not considered in scope. For Queue contracts only Critical are evaluated”

  4. Scope removed

    https://etherscan.io/address/0x4462eD748B8F7985A4aC6b538Dfc105Fce2dD165

  5. Scope removed

    https://etherscan.io/address/0xC49b4ECc14aa31Ef0AD077EdcF53faB4201b724c

  6. Scope removed

    https://etherscan.io/address/0x06975bB418EFFB0029fe278A6fA15B92bb97496F

  7. Reward terms

    The reward table or payout terms were edited

  8. Reward terms

    The reward table or payout terms were edited

  9. Reward terms

    The reward table or payout terms were edited

  10. Rules updated

    The program rules were edited

  11. Reward terms

    The reward table or payout terms were edited

  12. Scope added

    https://etherscan.io/address/0x338e0a8008364a4d5139cB49E00e93bDb51290d6

  13. Scope added

    https://etherscan.io/address/0x9372a533Db980bD9591D3c7C457dC220Bf1A0Ab4

  14. Scope added

    https://etherscan.io/address/0xf6b24eC487680Aa3716f0DAEfB9264419b429384

  15. Scope added

    https://etherscan.io/address/0x7A4E728B9fEbec04de724821eb9056828C2D1c06

  16. Scope added

    https://etherscan.io/address/0xBC6cffAFC8F98d7DF780cE05fA55e14781C1C14D

  17. Scope added

    https://etherscan.io/token/0xEC6a70F62a83418c7fb238182eD2865F80491a8B

  18. Scope added

    https://etherscan.io/address/0x3Fc0265E92EeafED0cCd9F8621764Ce0981882cE

  19. Scope added

    https://etherscan.io/address/0x9cF358aff79DeA96070A85F00c0AC79569970Ec3

  20. Scope added

    https://etherscan.io/address/0x5cC24f44cCAa80DD2c079156753fc1e908F495DC

  21. Scope added

    https://etherscan.io/address/0xC26A6Fa2C37b38E549a4a1807543801Db684f99C

  22. Scope added

    https://etherscan.io/address/0x17E9Ab2992dfecBe779a06A92a6cDB9fE6aEeEf3

  23. Scope added

    https://etherscan.io/address/0x433D5B175148dA32Ffe1e1A37a939E1b7e79be4d

  24. Scope added

    https://etherscan.io/address/0x5eCF8bF9eae51c2FF47FAc8808252FaCd8e36797

  25. Scope added

    https://etherscan.io/address/0xae7913c672c7F1f76C2a1a0Ac4de97d082681234

  26. Scope added

    https://etherscan.io/address/0xa30bE796FB2BAbF9228359E86A041c14e29f86Fc

  27. Scope added

    https://etherscan.io/address/0x14B8E918848349D1e71e806a52c13D4e0d3246E0

  28. Scope added

    https://etherscan.io/address/0x0b4F695B05902efc14344d19ED1d0B0E061C8A3E

  29. Scope added

    https://etherscan.io/address/0x45054c6753b4bce40c5d54418dabc20b070f85be

  30. Scope added

    https://etherscan.io/address/0xC35D078092872Ec1f2ae82bcd6f0b6b89F0850de

  31. Scope added

    https://etherscan.io/address/0xf6223C567F21E33e859ED7A045773526E9E3c2D5

  32. Scope added

    https://etherscan.io/address/0x74E862277B5BEC233E2f1b0272CE1e215462507a

  33. Scope added

    https://etherscan.io/address/0xD1624bb76743dd8dC8D8043246e7338A5CD23772

  34. Scope added

    https://etherscan.io/address/0x2Cd361544a3647Ab16A983cA2576f084abEA80D0

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from immunefi.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Back to Explore Pareto Credit | Pareto is a private credit marketplace that connects institutional lenders and borrowers, providing scalable, yield-generating opportunities and bridging institutional capital on-chain. ETH Defi Yield Aggregator Solidity Maximum Bounty $50,000 Live Since 25 March 2021 Last Updated 07 November 2026 PoC Required Submit a Bug Information Scope Resources Rewards Pareto Credit provides rewards in USDC, IDLE on Ethereum , denominated in USD. Rewards by Threat Level Smart Contract Critical Up to: $50,000 Primacy of Rules High Up to: $20,000 Primacy of Rules Medium Up to: $5,000 Primacy of Rules Critical Reward Calculation Mainnet assets: Reward amount is 10 % of the funds directly affected up to a maximum of: $50,000 Rewards Body Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System 2.2 . This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. The final reward for critical bounty payouts is capped at 10% of the funds at risk based on the vulnerability reported. PoC is required for all levels. Theft of yield or interest is considered as Medium but may be considered High depending on the amount of funds at risk. Best practices critiques are not accepted under this program. The likelihood of exploitability is also taken into consideration in the determination of the final payout amount based on the severity of the bug reported according to the table below: Medium │ High │ Critical Almost Certain │ $5,000 │ $20,000 │ $50,000 Likely │ $3,000 │ $10,000 │ $25,000 Possible │ $1,000 │ $5,000 │ $10,000 Unlikely │ $500 │ $1,000 │ $5,000 Almost Possible │ $100 │ $500 │ $1,000 Payouts are handled by Idle Finance governance directly and are denominated in USD . Payouts under $10,000 are done in USDC . When payouts are over $10,000, the first $10,000 is paid in USDC and then the rest are paid in IDLE up to the total of $50 000. View impacts in scope Program Overview Pareto is a private credit marketplace that connects institutional lenders and borrowers, providing scalable, yield-generating opportunities and bridging institutional capital on-chain. Tailored for asset managers, digital asset funds, and other professional investors, Pareto offers seamless access to regulatory-compliant alternative credit products. Its infrastructure emphasizes transparency, automation, and flexibility. Credit Vaults are the core primitive: they eliminate utilization-based inefficiencies, reduce operational overhead, and improve capital efficiency for both lenders and borrowers. Currently, Pareto Credit product suite includes: : Credit Vaults a suite of smart contracts built to simplify on-chain lending and credit position management for borrowers and lenders. They provide the infrastructure for real-world financing, making it more transparent and efficient. Payouts are handled by Pareto Credit directly and are denominated in USD, payouts are done in stablecoins. KYC not required No KYC information is required for payout processing. Proof of Concept Proof of concept is always required for all severities. Responsible Publication Category 2: Notice Required Prohibited Activities Default prohibited activities Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet Any testing with pricing oracles or third-party smart contracts Attempting phishing or other social engineering attacks against our employees and/or customers Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks) Any denial of service attacks that are executed against project assets Automated testing of services that generates significant amounts of traffic Public disclosure of an unpatched vulnerability in an embargoed bounty Any other actions prohibited by the Immunefi Rules Feasibility Limitations The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report. Chain Rollbacks Pre-Impact Bug Monitoring Attack Investment Amount Attacks With A Financial Risk To The Attacker When Is An Impactful Attack Downgraded To Griefing? Submit a Bug Total Assets in Scope 24