Bug bounty
Not live yet. The planned scope, severity tiers and rules, published in advance so researchers can see the shape of the programme.
Status
The bug bounty is not live. There is no programme to submit to, no reward pool funded, and no platform listing.
The contracts are not written, no audit has been completed, and nothing is deployed. This page publishes the intended shape of the programme so that researchers can see it before it opens, and so that the commitment is on record rather than improvised at launch.
An Immunefi programme is planned to be live before any mainnet deployment, as step seven of the audit sequence.
Risk
Because the programme is not live, there is currently no safe-harbour agreement and no reward commitment. If you find something in the specification before then, disclose it privately through the contact published in the repository. Everything on this page is a plan, not an obligation.
Planned scope
In scope at launch: the nineteen deployed modules, at the addresses published on Contract addresses, on chain 4663.
FYUSD, MarketCalendar, OracleAdapter, LiquidityOracle, RateFloor, Branch, SortedTroves, StabilityPool, LiquidationEngine, RedemptionRouter, InterestRouter, Backstop, PoolIncentive, PSM, BranchRegistry, sfyUSD, CollateralSale, Router, Closer.
Out of scope, and each for a stated reason:
| Excluded | Why |
|---|---|
| Third-party front ends | Not operated by the protocol, not part of it, and anyone may run one |
| The Stock Token contracts | Belong to the issuer; report to them |
| The Chainlink feeds and the sequencer | Belong to their operators |
| USDG | Belongs to its issuer |
| Uniswap pools and the reference lending market | Third-party protocols |
| Anything requiring the Closer's Safe keys | Trusting the key holder is a documented, disclosed risk, not a vulnerability |
| Documented risks | Everything listed under Risks — issuer default, basket correlation, sequencer censorship, USDG depeg, a locked capacity tier — is a known and disclosed property |
| Economic conclusions from correct code | "The yield is too low", "the caps are too conservative", "open sales take too many positions" are parameter observations, published for a future version, not bugs |
| Gas optimisation, style, missing events | Useful, welcome as a pull request, not a bounty |
| Automated tool output with no proof of exploitability | A Slither warning is not a finding |
Planned severity tiers
Following the Immunefi classification, adapted to what actually matters in this design. Amounts are indicative and are fixed when the programme is funded.
| Severity | What it means here | Examples |
|---|---|---|
| Critical | Direct theft or permanent freezing of user funds; minting fyUSD without corresponding debt; breaking the global supply identity | An open/redeem sequence that mints unbacked fyUSD; a path that seizes collateral from a position above its threshold; a way to block repay or a Stability Pool withdrawal |
| High | Significant loss under realistic conditions, without a full break of the invariants | Extracting the liquidation bonus from a position that is not liquidatable; making the oracle return a price that depends on caller state; bypassing a throughput bucket |
| Medium | Griefing, temporary denial of service, or loss bounded by a parameter | Forcing a branch into CIRCUIT at will; blocking activation of a dormant branch; manipulating d2_eff upward beyond the ratchet |
| Low | Accounting drift beyond the stated wei tolerances, or an incorrect view that a front end would act on | An off-by-one in a cap; previewLiquidation disagreeing with liquidate |
What gets paid the most attention
Findings in these areas are worth more than their severity class alone suggests, because they are the areas where the design has the least margin:
Any violation of the liveness invariant. repay, addCollateral, close, claimSurplus, SP.withdraw, SP.claimCollateral, PSM.swapOut, sfyUSD.redeem, Router.withdrawToUSDG and urgentRedeem must succeed in every oracle state and under every Closer freeze. Any path that makes one of them revert is treated as critical regardless of the amount at stake.
Any residual power. A write function reachable from an unexpected address; a constant that a call sequence can change; a way for the Closer to exceed its bounds or to act after its expiry.
The depth readers. The v3 tick iteration and the v4 StateView reads are the newest and least conventional code in the system, and they determine every debt ceiling.
The calendar. The daylight-saving rule, the Easter algorithm, the observation rules, and the behaviour after 2036.
The multiplier consistency check. It is the only protection against a desynchronisation between the feed and a corporate action.
Rules
- Mainnet exploitation is never authorised. Demonstrate on a fork or on the testnet, chain 46630.
- No testing against real user funds, no denial of service against the chain or the feeds, no social engineering, no phishing.
- Report before disclosing. A public disclosure before a fix forfeits the reward.
- A proof of concept is required for High and Critical: a Foundry test that fails on the deployed bytecode.
- First valid report wins for duplicates.
- Known issues do not qualify, including anything already listed in a published audit report, in Risks, or in the on-chain hypotheses.
The awkward part
In most programmes, a critical finding leads to a patch. Here it cannot.
If a critical bug is found in a live deployment, the response is: freeze the affected branch through the Closer if it is still alive; shut the branch down if the flaw is confirmed, which opens urgent redemptions and lets everyone exit at the last good price; and build a corrected version — a new deployment, a new stablecoin, a PSM bridge — over four to eight weeks (Rule R-12.1.8, Rule R-12.4).
After the Closer expires at day 365, the freeze step is gone. The response is publication, voluntary exit, and the automatic shutdown triggers if the branch's ratio falls far enough.
Guarantee
Whatever the bug, the exits stay open. Repayment, collateral addition, closure, surplus claims,
Stability Pool withdrawal, swapOut and wrapper redemption cannot be blocked by any state, any
key or any freeze. That is what makes voluntary exit a real response rather than a slogan — it is
the property that made Liquity's February 2025 incident end with no user losses (Rule R-4.4.1).
This is also why the bounty matters more than usual, and why it runs before mainnet rather than after: the window in which a finding is cheap closes at deployment.
Last reviewed: 2026-09-07 · Spec v0.4