Aave bug bounty

Bug bounty campaign

Welcome to our Bug Bounty Program. We want Aave protocol to be the best it can be, so we’re calling on our community to help us find any bugs or vulnerabilities. Submit a bug here and earn a reward of up to USD 250,000$. Please see our Rules & Rewards section for more details.

Rules

  • Public disclosure of a vulnerability would make it ineligible for a reward.
  • Technical knowledge is required for the process.
  • Duplicated issues are not eligible for reward. The first submission would be the eligible one.
  • If you want to add more information to a provided issue, create a new submission giving reference to the initial one.
  • Rewards will be decided on a case by case basis and the bug bounty program, terms, and conditions are at the sole discretion of Aave.
  • Rewards will vary depending on the severity of the issue. Other variables considered for rewards include: the quality of the issue description, the instructions for reproducibility, and the quality of the fix (if included).
  • Determinations of eligibility, score and all terms related to an award are at the sole and final discretion of Aave.
  • Submissions needs to be related with the Bounty Scope. Submissions out of the Bounty Scope won’t be eligible for a reward.
  • Any interference with the protocol, client or platform services, on purpose or not during the process will make the submission process unvalid.
  • Terms and conditions of the bug bounty process may vary over time.
  • Our bug bounty follows a similar approach as Ethereum Bug Bounty. The severity of the issues will be based according to the OWASP risk rating model based on Impact and Likelihood.
  • It is mandatory to read and follow the responsible disclosure policy available in the references. Submissions not following the disclosure policy will not be elegible for a reward.

Rewards

The reward will be received in aUSDC token based on the severity scheme following:

Note = Up to $ 100

Very low = Up to $ 500

Low = Up to $ 1,000

Medium = Up to $ 5,000

High = Up to $ 10,000

Very High = Up to $ 50,000

Critical = Up to $ 250,000

Likelihood

Severity

Almost certain$ 1,000$ 5,000$ 10,000$ 50,000$ 250,000
Likely$ 500$ 1,000$ 5,000$ 10,000$ 50,000
Possible$ 100$ 500$ 1,000$ 5,000$ 10,000
Unlikely$ 100$ 100$ 500$ 1,000$ 5,000
Almost possible$ 100$ 100$ 100$ 500$ 1,000
Very lowLowModerateHighSevere

Likelihood

Severity

Almost certain$ 1,000$ 5,000$ 10,000$ 50,000$ 250,000
Likely$ 500$ 1,000$ 5,000$ 10,000$ 50,000
Possible$ 100$ 500$ 1,000$ 5,000$ 10,000
Unlikely$ 100$ 100$ 500$ 1,000$ 5,000
Almost possible$ 100$ 100$ 100$ 500$ 1,000
Very lowLowModerateHighSevere

Bounty Scope

The bug bounty will be applicable for the following repositories, sources and sites:

https://github.com/aave/aave-protocol

References

Additional references to help during the bug finding process

Vulnerabilities Classification

Critical

An issue that might cause immediate loss of > 10% of the funds, or permanent impairment of the protocol state.

Very High / High

An issue that might cause immediate loss of <10% of the funds, or severely damage the protocol state.

Medium

An issue that might theoretically cause minimal loss of funds, damage the protocol state, or cause severe user dissatisfaction.

Low / Very Low / Note

An issue that might cause user dissatisfaction or minimal failure.

Exclusions

While researching, we’d like to ask you to refrain from:

  • Denial of service
  • Spamming
  • Social engineering (including phishing) of Aave staff or contractors
  • Any physical attempts against Aave property or data centers

Frequently Asked Questions

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Submit a bug

Please report the bug you found via this form. Try to be as specific and clear as possible when you fill out this form. We will be in touch as soon as possible after receiving the form.

Contact us

Feel free to contact us through our live chat, or email at: [email protected]

We are also available in our discord channel.