Bug Bounty

Lombard operates a bug bounty program through Immunefi, the leading blockchain security platform. The program incentivizes security researchers to responsibly disclose vulnerabilities in Lombard’s smart contracts and web applications.

Reward Tiers

Rewards are based on the severity of the discovered vulnerability, assessed according to Immunefi’s classification system .

Smart Contract Vulnerabilities

Web/App Vulnerabilities

Contracts in Scope

The following primary contracts are covered by the bug bounty program:

For the full and current scope of covered contracts and assets, refer to the Immunefi program page .

How to Submit

Program Requirements

To be eligible for a reward, submissions must meet the following criteria:

• In scope — The vulnerability must affect a contract or application listed in the program scope
• Original — The issue must not have been previously reported or known
• Reproducible — A clear proof of concept or step-by-step reproduction must be provided
• Responsible disclosure — Findings must be submitted through Immunefi and not disclosed publicly before remediation
• Impact demonstrated — The report must clearly describe the potential impact of the vulnerability

Policies

• No public disclosure — All findings must be reported through Immunefi. Public disclosure before remediation disqualifies the submission
• First reporter — Only the first valid report of a given vulnerability is eligible for a reward
• No exploitation — Researchers must not exploit vulnerabilities on mainnet or cause damage to users or the protocol
• Good faith — The program is intended for security researchers acting in good faith to improve protocol security
• Scope updates — The program scope may be updated as new contracts are deployed; always check the Immunefi page for the current scope

Next Steps

• Immunefi Program Page — View the full scope and submit reports
• Audits — Review completed third-party security audits
• Security Model — Understand Lombard’s full defense-in-depth architecture