Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Reserve Protocol Bug Bounty

By Reserve Protocol Bug bounty on Cantina reserve.org

Accepting reports KYC to get paid web3
Go to program Website
Top reward
$10,000,000
Top severity paid
Critical
Assets in scope
232
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $10,000,000
for critical bugs.
Report on Cantina
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Payment
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Cantina lists as the payout for each severity.

Severity Reward
Critical $10,000,000 from $100,000
High $100,000 from $5,000
Medium $5,000
Low $1,000
Safe harbor
Partial No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.

Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

232 assets you may test, 26 excluded.

Source code 123

  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/libraries/Allowance.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/libraries/Array.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/libraries/Fixed.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/libraries/Permit.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/libraries/String.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/libraries/Throttle.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/mixins/Auth.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/mixins/ComponentRegistry.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/mixins/Versioned.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/AssetRegistry.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/BackingManager.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/BasketHandler.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/Broker.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/Deployer.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/Distributor.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/Furnace.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/Main.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/mixins/BasketLib.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/mixins/Component.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/mixins/RecollateralizationLib.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/mixins/RewardableLib.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/mixins/TradeLib.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/mixins/Trading.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/RevenueTrader.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/RToken.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/StRSR.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/p1/StRSRVotes.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/aave/ATokenFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/aave/IStaticATokenLM.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/aave/StaticATokenErrors.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/aave/StaticATokenLM.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/aave-v3/AaveV3FiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/aave-v3/mock/MockStaticATokenV3.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/ankr/AnkrStakedEthCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/AppreciatingFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/Asset.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/cbeth/CBETHCollateralL2.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/cbeth/CBETHCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv2/CTokenFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv2/CTokenNonFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv2/CTokenSelfReferentialCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv2/ICToken.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv3/CFiatV3Wrapper.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv3/CometHelpers.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv3/CTokenV3Collateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv3/ICFiatV3Wrapper.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv3/IWrappedERC20.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/compoundv3/WrappedERC20.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/crv/CurveGaugeWrapper.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/CurveAppreciatingRTokenFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/CurveAppreciatingRTokenSelfReferentialCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/CurveRecursiveCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/CurveStableCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/CurveStableMetapoolCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/CurveStableRTokenMetapoolCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/L2ConvexStableCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/PoolTokens.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/curve/stakedao/StakeDAORecursiveCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/dsr/SDaiCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/erc20/RewardableERC20.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/erc20/RewardableERC20Wrapper.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/erc20/RewardableERC4626Vault.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/ERC4626FiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/ethena/USDeFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/EURFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/FiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/frax-eth/SFraxEthCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/frax/SFraxCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/L2LSDCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/lido/L2LidoStakedEthCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/lido/LidoStakedEthCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/meta-morpho/MetaMorphoFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/meta-morpho/MetaMorphoSelfReferentialCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/morpho-aave/IMorpho.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/morpho-aave/MorphoAaveV2TokenisedDeposit.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/morpho-aave/MorphoFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/morpho-aave/MorphoNonFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/morpho-aave/MorphoSelfReferentialCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/morpho-aave/MorphoTokenisedDeposit.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/mountain/USDMCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/NonFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/OracleErrors.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/OracleLib.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/pirex-eth/ApxEthCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/rocket-eth/RethCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/RTokenAsset.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/SelfReferentialCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/stargate/StargatePoolFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/stargate/StargateRewardableWrapper.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/VersionedAsset.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/assets/yearnv2/YearnV2CurveFiatCollateral.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/governance/Governance.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/trading/DutchTrade.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/plugins/trading/GnosisTrade.sol
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/contracts/spells/3_4_0.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/deployer/FolioDeployer.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/deployer/GovernanceDeployer.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/folio/FolioDAOFeeRegistry.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/folio/FolioProxy.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/folio/FolioVersionRegistry.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/Folio.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/governance/FolioGovernor.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/staking/StakingVault.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/staking/UnstakingManager.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/utils/MathLib.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/utils/RebalancingLib.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/contracts/utils/Versioned.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/deployer/FolioDeployer.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/deployer/GovernanceDeployer.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/folio/FolioDAOFeeRegistry.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/folio/FolioProxy.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/folio/FolioVersionRegistry.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/Folio.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/governance/FolioGovernor.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/staking/StakingVault.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/staking/UnstakingManager.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/utils/MathLib.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/utils/RebalancingLib.sol
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/241f0d244c45a311a4cd2af2c383a4f3bbe56265/contracts/utils/Versioned.sol
  • https://github.com/reserve-protocol/trusted-fillers/blob/main/contracts/extras/ImmutableTokenJar.sol
  • https://github.com/reserve-protocol/trusted-fillers/blob/main/contracts/fillers/cowswap/CowSwapFiller.sol
  • https://github.com/reserve-protocol/trusted-fillers/blob/main/contracts/fillers/cowswap/GPv2OrderLib.sol
  • https://github.com/reserve-protocol/trusted-fillers/blob/main/contracts/TrustedFillerRegistry.sol

Smart contracts 109

  • AaveV3FiatCollateral.sol
  • Allowance.sol
  • AnkrStakedEthCollateral.sol
  • AppreciatingFiatCollateral.sol
  • ApxEthCollateral.sol
  • Array.sol
  • AssetRegistry.sol
  • Asset.sol
  • ATokenFiatCollateral.sol
  • Auth.sol
  • BackingManager.sol
  • BasketHandler.sol
  • BasketLib.sol
  • Broker.sol
  • CBETHCollateralL2.sol
  • CBETHCollateral.sol
  • CFiatV3Wrapper.sol
  • CometHelpers.sol
  • ComponentRegistry.sol
  • Component.sol
  • CowSwapFiller.sol
  • CTokenFiatCollateral.sol
  • CTokenNonFiatCollateral.sol
  • CTokenSelfReferentialCollateral.sol
  • CTokenV3Collateral.sol
  • CurveAppreciatingRTokenFiatCollateral.sol
  • CurveAppreciatingRTokenSelfReferentialCollateral.sol
  • CurveGaugeWrapper.sol
  • CurveRecursiveCollateral.sol
  • CurveStableCollateral.sol
  • CurveStableMetapoolCollateral.sol
  • CurveStableRTokenMetapoolCollateral.sol
  • Deployer.sol
  • Distributor.sol
  • DutchTrade.sol
  • ERC4626FiatCollateral.sol
  • EURFiatCollateral.sol
  • FiatCollateral.sol
  • Fixed.sol
  • FolioDAOFeeRegistry.sol
  • FolioDeployer.sol
  • FolioGovernor.sol
  • FolioProxy.sol
  • Folio.sol
  • FolioVersionRegistry.sol
  • Furnace.sol
  • GnosisTrade.sol
  • GovernanceDeployer.sol
  • Governance.sol
  • GPv2OrderLib.sol
  • ICFiatV3Wrapper.sol
  • ICToken.sol
  • ImmutableTokenJar.sol
  • IMorpho.sol
  • IStaticATokenLM.sol
  • IWrappedERC20.sol
  • L2ConvexStableCollateral.sol
  • L2LidoStakedEthCollateral.sol
  • L2LSDCollateral.sol
  • LidoStakedEthCollateral.sol
  • Main.sol
  • MathLib.sol
  • MetaMorphoFiatCollateral.sol
  • MetaMorphoSelfReferentialCollateral.sol
  • MockStaticATokenV3.sol
  • MorphoAaveV2TokenisedDeposit.sol
  • MorphoFiatCollateral.sol
  • MorphoNonFiatCollateral.sol
  • MorphoSelfReferentialCollateral.sol
  • MorphoTokenisedDeposit.sol
  • NonFiatCollateral.sol
  • OracleErrors.sol
  • OracleLib.sol
  • Permit.sol
  • PoolTokens.sol
  • RebalancingLib.sol
  • RecollateralizationLib.sol
  • RethCollateral.sol
  • RevenueTrader.sol
  • RewardableERC20.sol
  • RewardableERC20Wrapper.sol
  • RewardableERC4626Vault.sol
  • RewardableLib.sol
  • RTokenAsset.sol
  • RToken.sol
  • SDaiCollateral.sol
  • SelfReferentialCollateral.sol
  • SFraxCollateral.sol
  • SFraxEthCollateral.sol
  • StakeDAORecursiveCollateral.sol
  • StakingVault.sol
  • StargatePoolFiatCollateral.sol
  • StargateRewardableWrapper.sol
  • StaticATokenErrors.sol
  • StaticATokenLM.sol
  • String.sol
  • StRSR.sol
  • StRSRVotes.sol
  • Throttle.sol
  • TradeLib.sol
  • Trading.sol
  • TrustedFillerRegistry.sol
  • UnstakingManager.sol
  • USDeFiatCollateral.sol
  • USDMCollateral.sol
  • VersionedAsset.sol
  • Versioned.sol
  • WrappedERC20.sol
  • YearnV2CurveFiatCollateral.sol
Out of scope (26)
  • Any repo, site, service, product, API, or resource not mentioned in the in-scope targets
  • Third-party contracts outside Reserve Protocol's control
  • Web interfaces and API endpoints
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Ackee%20-%20abch-reserve-protocol-report-1.1.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Code4rena%20-%20Reserve%20Audit%20Report%20-%20Release%202.1.0.md
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Code4rena%20-%20Reserve%20Audit%20Report%20-%20Release%203.0.0%20(collaterals).md
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Code4rena%20-%20Reserve%20Audit%20Report%20-%20Release%203.0.0%20(core).md
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Code4rena%20-%20Reserve%20Audit%20Report%20-%20Release%204.0.0.md
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Halborn%20-%20Reserve_Protocol_Smart_Contract_Security_Audit_Report_Halborn_Final.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Reserve_June_Plugins_v1.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Reserve_PR_4_0_0_v1.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Solidified%20-%20Audit%20Report%20-%20Reserve%20Protocol%20-%20April%2025%202024.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Solidified%20-%20Audit%20Report%20-%20Reserve%20Protocol%203.4.0.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Solidified%20-%20Audit%20Report%20-%20Reserve%20Protocol.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/trail-of-bits-2022-08-reserve-protocol-fixreview.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/trail-of-bits-2022-08-reserve-protocol-securityreview.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Trust%20Security%20-%20Reserve%20Audit%203.4.0%20Spell.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Trust%20Security%20-%20Reserve%20Audit%20Report%203_1_0.pdf
  • https://github.com/reserve-protocol/protocol/blob/3ad40fa2c79482b73e9dbd7f54c66298da6cdb4a/audits/Trust%20Security%20-%20Reserve%20Audit%20Report%203_2_0.pdf
  • https://github.com/reserve-protocol/protocol/blob/master/audits/Trust%20Security%20-%20Reserve%20Audit%20Report%204_2_0.pdf
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/audits/cantina/report-competition-reserve-jan2025.pdf
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/audits/pashov/reserve-security-review_2025-06-02.pdf
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/audits/trail-of-bits/2025-04-reserve-folio-solidity-2.0.0.pdf
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/audits/trail-of-bits/2025-06-reserve-folio-solidity-4.0.0.pdf
  • https://github.com/reserve-protocol/reserve-index-dtf/blob/0a60baf1c28b26997e8ba43b495808b1386ba832/audits/trust-security/v1-audit-dec-2024.pdf
  • https://github.com/reserve-protocol/trusted-fillers/blob/main/audits/ImmutableTokenJar_Jan2026_TrustSecurity.pdf

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Reserve Protocol Bug Bounty (via Cantina)'s policy.

While testing

  • No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization.
  • No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.
  • No Exploitation or Data Exfiltration: Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue.
  • No Conflict of Interest: Individuals currently or formerly employed by Reserve Protocol, or who contributed to the development of the affected code, are ineligible to participate.

Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 54 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope removed

    ICusdcV3Wrapper.sol

  2. Scope removed

    CusdcV3Wrapper.sol

  3. Scope removed

    0.sol

  4. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/EURFiatCollateral.sol

  5. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/NonFiatCollateral.sol

  6. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/spells/3_4_0.sol

  7. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/meta-morpho/MetaMorphoSelfReferentialCollateral.sol

  8. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/meta-morpho/MetaMorphoFiatCollateral.sol

  9. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/ERC4626FiatCollateral.sol

  10. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/p1/mixins/TradeLib.sol

  11. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/p1/mixins/Trading.sol

  12. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/curve/CurveStableCollateral.sol

  13. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/AppreciatingFiatCollateral.sol

  14. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/curve/CurveRecursiveCollateral.sol

  15. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/aave/StaticATokenErrors.sol

  16. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/compoundv3/CusdcV3Wrapper.sol

  17. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/p1/BasketHandler.sol

  18. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/curve/PoolTokens.sol

  19. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/compoundv3/CTokenV3Collateral.sol

  20. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/compoundv2/ICToken.sol

  21. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/aave-v3/AaveV3FiatCollateral.sol

  22. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/erc20/RewardableERC20.sol

  23. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/libraries/Permit.sol

  24. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/stargate/StargateRewardableWrapper.sol

  25. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/VersionedAsset.sol

  26. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/compoundv2/CTokenNonFiatCollateral.sol

  27. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/erc20/RewardableERC20Wrapper.sol

  28. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/rocket-eth/RethCollateral.sol

  29. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/morpho-aave/MorphoAaveV2TokenisedDeposit.sol

  30. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/cbeth/CBETHCollateral.sol

  31. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/OracleErrors.sol

  32. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/frax-eth/SFraxEthCollateral.sol

  33. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/curve/CurveAppreciatingRTokenFiatCollateral.sol

  34. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/morpho-aave/MorphoSelfReferentialCollateral.sol

  35. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/aave-v3/mock/MockStaticATokenV3.sol

  36. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/morpho-aave/MorphoFiatCollateral.sol

  37. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/p1/Main.sol

  38. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/libraries/Throttle.sol

  39. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/plugins/assets/morpho-aave/IMorpho.sol

  40. Scope removed

    https://github.com/reserve-protocol/protocol/blob/3.4.0-rc1/contracts/p1/RevenueTrader.sol

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from cantina.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Reserve Protocol Bug Bounty @ reserve-protocol Live Cantina-Triaged Maximum reward $10,000,000 Severity Max. Reward Critical $10,000,000 High $100,000 Medium $5,000 Low $1,000 Deposit required $100 Findings submitted 241 Start date 26 Mar 2026 KYC Required to join Please sign in as a researcher to join the bounty. Log in Instructions Scope The Reserve project is guided by the belief that everyone should be able to own their share of the world's wealth. Its platform lets anyone hold and transfer an entire portfolio of tokenized assets as a single unit, so as more of the world's wealth moves onchain, anyone can own their share of it. This lays the groundwork for asset-backed currency: money backed by real assets rather than inflationary fiat that loses purchasing power over time. When people earn more than they spend while holding value this way, they steadily build ownership of a share of the world’s wealth. Reserve is not just a platform. It’s a coordinated universe of protocols, products, and partners working to make this belief real in practice. Rules & Eligibility To be eligible for a reward, you must: Be the first to report a previously unknown, non-public vulnerability within scope. Provide sufficient information to reproduce and fix the issue. Not have exploited the vulnerability in a malicious manner. Not have disclosed the vulnerability to third parties prior to receiving permission. Comply with all Program rules and applicable laws. You must also be of legal age in your jurisdiction and not reside in a country under sanctions or restrictions, as required by applicable laws. Disclosure Policy Please report vulnerabilities directly through the Cantina platform. Include: A clear description of the vulnerability and its impact. Steps to reproduce the issue (proof of concept preferred). Conditions under which the issue occurs. Potential implications if exploited. Reports should be made as soon as possible—ideally within 24 hours of discovery. Prohibited Actions No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization. Use local test environments or private test setups. No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose. No Exploitation or Data Exfiltration: Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue. Do not access private data, engage in social engineering, or disrupt service. No Conflict of Interest: Individuals currently or formerly employed by Reserve Protocol, or who contributed to the development of the affected code, are ineligible to participate. Risk Classification Matrix Severity is determined by the combination of Impact and Likelihood: Severity Level │ Impact: Critical │ Impact: High │ Impact: Medium │ Impact: Low Likelihood: High │ Critical │ High │ Medium │ Low Likelihood: Medium │ High │ High │ Medium │ Low Likelihood: Low │ Medium │ Medium │ Low │ Informational Likelihood Definitions High: Very easy to exploit or highly incentivized. Medium: Exploitation is possible under certain conditions. Low: Difficult to exploit or requires very specific conditions. Smart Contract Impact Definitions Critical: Any governance voting result manipulation; direct theft of any user funds (at-rest or in-motion, other than unclaimed yield); permanent freezing of assets. High: Theft of unclaimed yield; permanent freezing of unclaimed yield; protocol insolvency. Medium: Temporary freezing of RToken ERC20 functionality; temporary freezing of funds; griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol). Low: Contract fails to deliver promised returns, but does not lose value; theft of gas; unbounded gas consumption that does not cause a more severe bug. KYC Requirements Reserve has a KYC requirement for bug bounty payouts. Anyone who receives $600 or more will need to provide either a US taxpayer W-9 form, or a W-8BEN declaring that they are not a US taxpayer subject to withholding. KYC information is only required on confirmation of the validity of a bug report. If you discover a vulnerability in any component not explicitly listed but which poses a risk to user funds, user data, or system integrity, you may submit it for consideration. Our team will review such submissions on a case-by-case basis. Other Terms By submitting a report, you grant ABC Labs the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of Reserve Protocol. The terms, conditions, and scope of this Program may be revised at any time. Participants are responsible for reviewing the latest version before submitting a report. Note: Actual reward amounts are determined at Reserve Protocol's sole discretion. Factors influencing payout include report quality, completeness, and severity/exploitability.