Skip to Content
LearnSecurity ModelBug Bounty

Bug Bounty

Lombard runs a public bug bounty program with Immunefi. Critical smart contract vulnerabilities are eligible for rewards of up to $500,000. Full details are on the Immunefi program page .

ImmunefiPlatform
$500,000Max Reward
Sep 2024Since

Reward Tiers

Rewards are based on the severity of the discovered vulnerability, assessed according to Immunefi’s classification system .

Smart Contract Vulnerabilities

Critical$50,000 - $500,000
High$10,000 - $50,000
Medium$2,500
Low$1,000

Critical rewards are 10% of the funds directly affected, with a minimum of $50,000 and a maximum of $500,000. High rewards depend on the funds at risk.

Websites and Applications

Critical$15,000 - $30,000
High$10,000
Medium$2,000

Contracts in Scope

The following primary contracts are covered by the bug bounty program:

ContractAddress
LBTC Token0x8236a87084f8B84306f72007F36F2618A5634494
Consortium Governance0xed6D647E2F81E5262101aFf72c4A7bcDcfd780e0
Proxy Upgrade Timelock0x055E84e7FE8955E2781010B866f10Ef6E1E77e59

For the full and current scope of covered contracts and assets, refer to the Immunefi program page .

How to Submit

1
Discovera vulnerability in a contract or application within scope
2
Documentthe issue with a clear description, proof of concept, and potential impact assessment
3
Submitthrough the Immunefi platform, do not disclose publicly
4
Collaboratewith the Lombard security team during triage and remediation
5
Receiveyour reward after the vulnerability is verified and classified

Requirements

  • Submit all reports through Immunefi
  • A proof of concept is required for every severity
  • Test only on local forks. Testing on mainnet or public testnets is prohibited
  • KYC is required to receive a payout
  • Rewards are paid in USDC on Ethereum

Not Eligible

  • Issues already known, previously reported, or listed in published audits
  • Third-party contracts, pricing oracles and third-party websites
  • Phishing, social engineering and denial-of-service attacks
  • Any public disclosure before a fix is deployed

Audits

Lombard’s audit reports are available in the evm-smart-contracts repository .

Next Steps

Last updated on
AuditsTransparency