Find vulnerabilities in the active Aave liquidity, governance, treasury and safety-module systems and the specified GHO components.
Key Details
- Program launched: 2023-10-18.
- Reports are submitted through Immunefi.
Reward
- Critical pays $50,000–$1,000,000, calculated at 10% of affected funds and requiring at least $10,000 at risk. High pays $10,000–$75,000; Medium $10,000; Low $1,000. Treasury theft has its own 10% calculation and $5,000 risk threshold.
- Repeatable losses are generally measured over the first 45 minutes. A qualifying withdrawal lock can extend that window. High temporary-lock rewards have duration multipliers, caps and downgrades defined in the program.
- Awards are paid in AAVE plus an eligible stablecoin, using the specified preceding 720-hour pricing. A DAO payment proposal follows remediation, so payment is normally delayed to month end.
Scope
- Active subsystems include Aave v2/v3 liquidity pools, governance, collectors and safety modules, plus the listed GHO token, reserve, FlashMinter, stability modules, bridge integration, stewards and remote facilitators.
- Ethereum Aave v2 accepts only Critical/High; v2 on other networks accepts only Critical. A defect must exist in both the deployed contract and the corresponding listed GitHub file.
- Specified Critical governance, principal-theft and irreversible-freeze impacts use Primacy of Impact, limited to the defined active subsystems. Other impacts use Primacy of Rules. The inherited-contract extension excludes OpenZeppelin base contracts; CCIP coverage is limited to GHO-specific additions.
Out of Scope
- Inactive features, known or already-mitigated instances of the same subsystem flaw, audit findings, generic market/liquidity risks and unsupported manipulation scenarios are excluded.
- Token precision mechanics need a demonstrably new fund-loss attack to qualify. Unaccrued future rewards are not treated as existing lost funds. Market-dynamics losses outside the accepted exploit impact are not counted.
- Official developers and auditors of affected code are ineligible. Independent researchers and occasional contributors can qualify; former official contributors require over 24 months since their last contribution.
Rules
- All contract reports need a runnable PoC. Medium/Low reports do not require KYC under the detailed clause; for higher severities DAO representatives may request identification, potentially in a video call.
- Publication requires approval. Tests must use local forks; live-chain testing, third-party attacks, social engineering and disruptive traffic are prohibited.
Submission Process
- Submit through Aave’s Immunefi entry, identifying the active deployment, subsystem and accepted impact. Review the address book, existing audits and bounty terms before submitting.
Resources and Contact
