Exactly Bug Bounty
Maximum reward
$25,000
Severity
Max. Reward
Critical$25,000
High$10,000
Deposit required
$50
Findings submitted
10
Start date
12 Nov 2026
KYC
Required to join
Please sign in as a researcher to join the bounty.
Log inIn scope
Severity
Min and Max Reward
Critical$10,000 to $25,000
High
$5,000 to $10,000
Exactly smart contracts deployed on Optimism and Base. Source code: exactly/protocol and exactly/exa.
Though only the proxy contracts are listed as in scope, the current implementation and any further updates to the implementation contracts are also in scope. When reporting a bug, please select the relevant proxy contract as the target.
Primacy of Impact
If a Critical or High impact listed in the Severity Definitions can be caused to any other asset managed by Exactly that is not listed here, you are encouraged to submit it for consideration.
Name | Description | Asset |
|---|---|---|
| Auditor | Auditor (Optimism) | |
| MarketUSDC | MarketUSDC (Optimism) | |
| MarketUSDC.e | MarketUSDC.e (Optimism) | |
| MarketWETH | MarketWETH (Optimism) | |
| MarketWstETH | MarketWstETH (Optimism) | |
| MarketOP | MarketOP (Optimism) | |
| MarketWBTC | MarketWBTC (Optimism) | |
| MarketETHRouter | MarketETHRouter (Optimism) | |
| InterestRateModelUSDC | InterestRateModelUSDC (Optimism) | |
| InterestRateModelWETH | InterestRateModelWETH (Optimism) | |
| InterestRateModelWstETH | InterestRateModelWstETH (Optimism) | |
| RewardsController | RewardsController (Optimism) | |
| DebtManager | DebtManager (Optimism) | |
| InstallmentsRouter | InstallmentsRouter (Optimism) | |
| EscrowedEXA | EscrowedEXA (Optimism) | |
| StakedEXA | StakedEXA (Optimism) | |
| TimelockController | TimelockController (Optimism) | |
| ProposalManager | ProposalManager (Optimism) | |
| ExaPlugin | ExaPlugin (Optimism) | |
| WebAuthnOwnerPlugin | WebAuthnOwnerPlugin (Optimism) | |
| IssuerChecker | IssuerChecker (Optimism) | |
| Refunder | Refunder (Optimism) | |
| VerifiedAuditor | VerifiedAuditor (Base) | |
| MarketUSDC | MarketUSDC (Base) | |
| MarketWETH | MarketWETH (Base) | |
| MarketcbBTC | MarketcbBTC (Base) | |
| MarketcbXRP | MarketcbXRP (Base) | |
| MarketwARS | MarketwARS (Base) | |
| MarketAAPLc | MarketAAPLc (Base) | |
| MarketAMZNc | MarketAMZNc (Base) | |
| MarketGOOGLc | MarketGOOGLc (Base) | |
| MarketMETAc | MarketMETAc (Base) | |
| MarketNVDAc | MarketNVDAc (Base) | |
| InterestRateModelUSDC | InterestRateModelUSDC (Base) | |
| InterestRateModelWETH | InterestRateModelWETH (Base) | |
| InterestRateModelcbBTC | InterestRateModelcbBTC (Base) | |
| InterestRateModelcbXRP | InterestRateModelcbXRP (Base) | |
| InterestRateModelwARS | InterestRateModelwARS (Base) | |
| InterestRateModelAAPLc | InterestRateModelAAPLc (Base) | |
| InterestRateModelAMZNc | InterestRateModelAMZNc (Base) | |
| InterestRateModelGOOGLc | InterestRateModelGOOGLc (Base) | |
| InterestRateModelMETAc | InterestRateModelMETAc (Base) | |
| InterestRateModelNVDAc | InterestRateModelNVDAc (Base) | |
| MarketETHRouter | MarketETHRouter (Base) | |
| InstallmentsRouter | InstallmentsRouter (Base) | |
| DebtRoller | DebtRoller (Base) | |
| FlashLoanAdapter | FlashLoanAdapter (Base) | |
| Firewall | Firewall (Base) | |
| TimelockController | TimelockController (Base) | |
| ExaPlugin | ExaPlugin (Base) | |
| IssuerChecker | IssuerChecker (Base) | |
| ProposalManager | ProposalManager (Base) | |
| Refunder | Refunder (Base) | |
| WebAuthnOwnerPlugin | WebAuthnOwnerPlugin (Base) |
Out of scope
Default Out of Scope
Standard out-of-scope items per the Cantina Bug Bounty Out-of-Scope Policy.
Out of Scope
The following issues are out of scope and not eligible for rewards.
Program-Specific
- Griefing
- Best practice critiques
Smart Contracts
- Incorrect data supplied by third-party oracles (this does not exclude oracle manipulation or flash loan attacks)
- Impacts requiring basic economic and governance attacks (e.g., 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
General
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to, governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in GitHub without proof that they are in use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files
- Impacts requiring phishing or other social engineering attacks against Exactly employees and/or customers