Reserve Protocol Bug Bounty
Maximum reward
$10,000,000
Severity
Max. Reward
Critical$10,000,000
High$100,000
Medium$5,000
Low$1,000
Deposit required
$10
Findings submitted
21
Start date
26 Mar 2026
Please sign in as a researcher to join the bounty.
Log inIn scope
Severity
Min and Max Reward
Critical$100,000 to $10,000,000
High
$5,000 to $100,000
Medium
Up to $5,000
Low
Up to $1,000
In-scope smart contract addresses and source code
reserve-protocol/protocol @ master
Core protocol contracts from the master branch
Name | Description | Asset |
|---|---|---|
| Allowance.sol | Smart contract: Allowance.sol | |
| Array.sol | Smart contract: Array.sol | |
| Fixed.sol | Smart contract: Fixed.sol | |
| Permit.sol | Smart contract: Permit.sol | |
| String.sol | Smart contract: String.sol | |
| Throttle.sol | Smart contract: Throttle.sol | |
| Auth.sol | Smart contract: Auth.sol | |
| ComponentRegistry.sol | Smart contract: ComponentRegistry.sol | |
| Versioned.sol | Smart contract: Versioned.sol | |
| AssetRegistry.sol | Smart contract: AssetRegistry.sol | |
| BackingManager.sol | Smart contract: BackingManager.sol | |
| BasketHandler.sol | Smart contract: BasketHandler.sol | |
| Broker.sol | Smart contract: Broker.sol | |
| Deployer.sol | Smart contract: Deployer.sol | |
| Distributor.sol | Smart contract: Distributor.sol | |
| Furnace.sol | Smart contract: Furnace.sol | |
| Main.sol | Smart contract: Main.sol | |
| RToken.sol | Smart contract: RToken.sol | |
| RevenueTrader.sol | Smart contract: RevenueTrader.sol | |
| StRSR.sol | Smart contract: StRSR.sol | |
| StRSRVotes.sol | Smart contract: StRSRVotes.sol | |
| BasketLib.sol | Smart contract: BasketLib.sol | |
| Component.sol | Smart contract: Component.sol | |
| RecollateralizationLib.sol | Smart contract: RecollateralizationLib.sol | |
| RewardableLib.sol | Smart contract: RewardableLib.sol | |
| TradeLib.sol | Smart contract: TradeLib.sol | |
| Trading.sol | Smart contract: Trading.sol | |
| AppreciatingFiatCollateral.sol | Smart contract: AppreciatingFiatCollateral.sol | |
| Asset.sol | Smart contract: Asset.sol | |
| ERC4626FiatCollateral.sol | Smart contract: ERC4626FiatCollateral.sol | |
| EURFiatCollateral.sol | Smart contract: EURFiatCollateral.sol | |
| FiatCollateral.sol | Smart contract: FiatCollateral.sol | |
| L2LSDCollateral.sol | Smart contract: L2LSDCollateral.sol | |
| NonFiatCollateral.sol | Smart contract: NonFiatCollateral.sol | |
| OracleErrors.sol | Smart contract: OracleErrors.sol | |
| OracleLib.sol | Smart contract: OracleLib.sol | |
| RTokenAsset.sol | Smart contract: RTokenAsset.sol | |
| SelfReferentialCollateral.sol | Smart contract: SelfReferentialCollateral.sol | |
| VersionedAsset.sol | Smart contract: VersionedAsset.sol | |
| ATokenFiatCollateral.sol | Smart contract: ATokenFiatCollateral.sol | |
| IStaticATokenLM.sol | Smart contract: IStaticATokenLM.sol | |
| StaticATokenErrors.sol | Smart contract: StaticATokenErrors.sol | |
| StaticATokenLM.sol | Smart contract: StaticATokenLM.sol | |
| AaveV3FiatCollateral.sol | Smart contract: AaveV3FiatCollateral.sol | |
| MockStaticATokenV3.sol | Smart contract: MockStaticATokenV3.sol | |
| AnkrStakedEthCollateral.sol | Smart contract: AnkrStakedEthCollateral.sol | |
| CBETHCollateral.sol | Smart contract: CBETHCollateral.sol | |
| CBETHCollateralL2.sol | Smart contract: CBETHCollateralL2.sol | |
| CTokenFiatCollateral.sol | Smart contract: CTokenFiatCollateral.sol | |
| CTokenNonFiatCollateral.sol | Smart contract: CTokenNonFiatCollateral.sol | |
| CTokenSelfReferentialCollateral.sol | Smart contract: CTokenSelfReferentialCollateral.sol | |
| ICToken.sol | Smart contract: ICToken.sol | |
| CTokenV3Collateral.sol | Smart contract: CTokenV3Collateral.sol | |
| CometHelpers.sol | Smart contract: CometHelpers.sol | |
| CusdcV3Wrapper.sol | Smart contract: CusdcV3Wrapper.sol | |
| ICusdcV3Wrapper.sol | Smart contract: ICusdcV3Wrapper.sol | |
| IWrappedERC20.sol | Smart contract: IWrappedERC20.sol | |
| WrappedERC20.sol | Smart contract: WrappedERC20.sol | |
| CurveAppreciatingRTokenFiatCollateral.sol | Smart contract: CurveAppreciatingRTokenFiatCollateral.sol | |
| CurveAppreciatingRTokenSelfReferentialCollateral.sol | Smart contract: CurveAppreciatingRTokenSelfReferentialCollateral.sol | |
| CurveRecursiveCollateral.sol | Smart contract: CurveRecursiveCollateral.sol | |
| CurveStableCollateral.sol | Smart contract: CurveStableCollateral.sol | |
| CurveStableMetapoolCollateral.sol | Smart contract: CurveStableMetapoolCollateral.sol | |
| CurveStableRTokenMetapoolCollateral.sol | Smart contract: CurveStableRTokenMetapoolCollateral.sol | |
| L2ConvexStableCollateral.sol | Smart contract: L2ConvexStableCollateral.sol | |
| PoolTokens.sol | Smart contract: PoolTokens.sol | |
| CurveGaugeWrapper.sol | Smart contract: CurveGaugeWrapper.sol | |
| StakeDAORecursiveCollateral.sol | Smart contract: StakeDAORecursiveCollateral.sol | |
| SDaiCollateral.sol | Smart contract: SDaiCollateral.sol | |
| RewardableERC20.sol | Smart contract: RewardableERC20.sol | |
| RewardableERC20Wrapper.sol | Smart contract: RewardableERC20Wrapper.sol | |
| RewardableERC4626Vault.sol | Smart contract: RewardableERC4626Vault.sol | |
| USDeFiatCollateral.sol | Smart contract: USDeFiatCollateral.sol | |
| SFraxCollateral.sol | Smart contract: SFraxCollateral.sol | |
| SFraxEthCollateral.sol | Smart contract: SFraxEthCollateral.sol | |
| L2LidoStakedEthCollateral.sol | Smart contract: L2LidoStakedEthCollateral.sol | |
| LidoStakedEthCollateral.sol | Smart contract: LidoStakedEthCollateral.sol | |
| MetaMorphoFiatCollateral.sol | Smart contract: MetaMorphoFiatCollateral.sol | |
| MetaMorphoSelfReferentialCollateral.sol | Smart contract: MetaMorphoSelfReferentialCollateral.sol | |
| IMorpho.sol | Smart contract: IMorpho.sol | |
| MorphoAaveV2TokenisedDeposit.sol | Smart contract: MorphoAaveV2TokenisedDeposit.sol | |
| MorphoFiatCollateral.sol | Smart contract: MorphoFiatCollateral.sol | |
| MorphoNonFiatCollateral.sol | Smart contract: MorphoNonFiatCollateral.sol | |
| MorphoSelfReferentialCollateral.sol | Smart contract: MorphoSelfReferentialCollateral.sol | |
| MorphoTokenisedDeposit.sol | Smart contract: MorphoTokenisedDeposit.sol | |
| USDMCollateral.sol | Smart contract: USDMCollateral.sol | |
| ApxEthCollateral.sol | Smart contract: ApxEthCollateral.sol | |
| RethCollateral.sol | Smart contract: RethCollateral.sol | |
| StargatePoolFiatCollateral.sol | Smart contract: StargatePoolFiatCollateral.sol | |
| StargateRewardableWrapper.sol | Smart contract: StargateRewardableWrapper.sol | |
| YearnV2CurveFiatCollateral.sol | Smart contract: YearnV2CurveFiatCollateral.sol | |
| Governance.sol | Smart contract: Governance.sol | |
| DutchTrade.sol | Smart contract: DutchTrade.sol | |
| GnosisTrade.sol | Smart contract: GnosisTrade.sol | |
| 3_4_0.sol | Smart contract: 3_4_0.sol |
reserve-index-dtf @ main
Folio/DTF contracts from reserve-protocol/reserve-index-dtf
Name | Description | Asset |
|---|---|---|
| Folio.sol | Smart contract: Folio.sol | |
| FolioDAOFeeRegistry.sol | Smart contract: FolioDAOFeeRegistry.sol | |
| FolioDeployer.sol | Smart contract: FolioDeployer.sol | |
| FolioProxy.sol | Smart contract: FolioProxy.sol | |
| FolioVersionRegistry.sol | Smart contract: FolioVersionRegistry.sol | |
| FolioGovernor.sol | Smart contract: FolioGovernor.sol | |
| GovernanceDeployer.sol | Smart contract: GovernanceDeployer.sol | |
| StakingVault.sol | Smart contract: StakingVault.sol | |
| UnstakingManager.sol | Smart contract: UnstakingManager.sol | |
| Versioned.sol | Smart contract: Versioned.sol | |
| RebalancingLib.sol | Smart contract: RebalancingLib.sol | |
| MathLib.sol | Smart contract: MathLib.sol | |
| FolioLib.sol | Smart contract: FolioLib.sol |
trusted-fillers @ main
Trusted filler contracts from reserve-protocol/trusted-fillers
Name | Description | Asset |
|---|---|---|
| TrustedFillerRegistry.sol | Smart contract: TrustedFillerRegistry.sol | |
| CowSwapFiller.sol | Smart contract: CowSwapFiller.sol | |
| GPv2OrderLib.sol | Smart contract: GPv2OrderLib.sol | |
| ImmutableTokenJar.sol | Smart contract: ImmutableTokenJar.sol |
reserve-protocol/protocol @ 3.4.0-rc1
Core protocol contracts from the 3.4.0-rc1 branch
Name | Description | Asset |
|---|---|---|
| Allowance.sol | Smart contract: Allowance.sol | |
| Array.sol | Smart contract: Array.sol | |
| Fixed.sol | Smart contract: Fixed.sol | |
| Permit.sol | Smart contract: Permit.sol | |
| String.sol | Smart contract: String.sol | |
| Throttle.sol | Smart contract: Throttle.sol | |
| Auth.sol | Smart contract: Auth.sol | |
| ComponentRegistry.sol | Smart contract: ComponentRegistry.sol | |
| Versioned.sol | Smart contract: Versioned.sol | |
| AssetRegistry.sol | Smart contract: AssetRegistry.sol | |
| BackingManager.sol | Smart contract: BackingManager.sol | |
| BasketHandler.sol | Smart contract: BasketHandler.sol | |
| Broker.sol | Smart contract: Broker.sol | |
| Deployer.sol | Smart contract: Deployer.sol | |
| Distributor.sol | Smart contract: Distributor.sol | |
| Furnace.sol | Smart contract: Furnace.sol | |
| Main.sol | Smart contract: Main.sol | |
| RToken.sol | Smart contract: RToken.sol | |
| RevenueTrader.sol | Smart contract: RevenueTrader.sol | |
| StRSR.sol | Smart contract: StRSR.sol | |
| StRSRVotes.sol | Smart contract: StRSRVotes.sol | |
| BasketLib.sol | Smart contract: BasketLib.sol | |
| Component.sol | Smart contract: Component.sol | |
| RecollateralizationLib.sol | Smart contract: RecollateralizationLib.sol | |
| RewardableLib.sol | Smart contract: RewardableLib.sol | |
| TradeLib.sol | Smart contract: TradeLib.sol | |
| Trading.sol | Smart contract: Trading.sol | |
| AppreciatingFiatCollateral.sol | Smart contract: AppreciatingFiatCollateral.sol | |
| Asset.sol | Smart contract: Asset.sol | |
| ERC4626FiatCollateral.sol | Smart contract: ERC4626FiatCollateral.sol | |
| EURFiatCollateral.sol | Smart contract: EURFiatCollateral.sol | |
| FiatCollateral.sol | Smart contract: FiatCollateral.sol | |
| L2LSDCollateral.sol | Smart contract: L2LSDCollateral.sol | |
| NonFiatCollateral.sol | Smart contract: NonFiatCollateral.sol | |
| OracleErrors.sol | Smart contract: OracleErrors.sol | |
| OracleLib.sol | Smart contract: OracleLib.sol | |
| RTokenAsset.sol | Smart contract: RTokenAsset.sol | |
| SelfReferentialCollateral.sol | Smart contract: SelfReferentialCollateral.sol | |
| VersionedAsset.sol | Smart contract: VersionedAsset.sol | |
| ATokenFiatCollateral.sol | Smart contract: ATokenFiatCollateral.sol | |
| IStaticATokenLM.sol | Smart contract: IStaticATokenLM.sol | |
| StaticATokenErrors.sol | Smart contract: StaticATokenErrors.sol | |
| StaticATokenLM.sol | Smart contract: StaticATokenLM.sol | |
| AaveV3FiatCollateral.sol | Smart contract: AaveV3FiatCollateral.sol | |
| MockStaticATokenV3.sol | Smart contract: MockStaticATokenV3.sol | |
| AnkrStakedEthCollateral.sol | Smart contract: AnkrStakedEthCollateral.sol | |
| CBETHCollateral.sol | Smart contract: CBETHCollateral.sol | |
| CBETHCollateralL2.sol | Smart contract: CBETHCollateralL2.sol | |
| CTokenFiatCollateral.sol | Smart contract: CTokenFiatCollateral.sol | |
| CTokenNonFiatCollateral.sol | Smart contract: CTokenNonFiatCollateral.sol | |
| CTokenSelfReferentialCollateral.sol | Smart contract: CTokenSelfReferentialCollateral.sol | |
| DEPRECATED_CTokenWrapper.sol | Smart contract: DEPRECATED_CTokenWrapper.sol | |
| ICToken.sol | Smart contract: ICToken.sol | |
| CTokenV3Collateral.sol | Smart contract: CTokenV3Collateral.sol | |
| CometHelpers.sol | Smart contract: CometHelpers.sol | |
| CusdcV3Wrapper.sol | Smart contract: CusdcV3Wrapper.sol | |
| ICusdcV3Wrapper.sol | Smart contract: ICusdcV3Wrapper.sol | |
| IWrappedERC20.sol | Smart contract: IWrappedERC20.sol | |
| WrappedERC20.sol | Smart contract: WrappedERC20.sol | |
| CurveAppreciatingRTokenFiatCollateral.sol | Smart contract: CurveAppreciatingRTokenFiatCollateral.sol | |
| CurveAppreciatingRTokenSelfReferentialCollateral.sol | Smart contract: CurveAppreciatingRTokenSelfReferentialCollateral.sol | |
| CurveRecursiveCollateral.sol | Smart contract: CurveRecursiveCollateral.sol | |
| CurveStableCollateral.sol | Smart contract: CurveStableCollateral.sol | |
| CurveStableMetapoolCollateral.sol | Smart contract: CurveStableMetapoolCollateral.sol | |
| CurveStableRTokenMetapoolCollateral.sol | Smart contract: CurveStableRTokenMetapoolCollateral.sol | |
| L2ConvexStableCollateral.sol | Smart contract: L2ConvexStableCollateral.sol | |
| PoolTokens.sol | Smart contract: PoolTokens.sol | |
| CurveGaugeWrapper.sol | Smart contract: CurveGaugeWrapper.sol | |
| StakeDAORecursiveCollateral.sol | Smart contract: StakeDAORecursiveCollateral.sol | |
| SDaiCollateral.sol | Smart contract: SDaiCollateral.sol | |
| RewardableERC20.sol | Smart contract: RewardableERC20.sol | |
| RewardableERC20Wrapper.sol | Smart contract: RewardableERC20Wrapper.sol | |
| RewardableERC4626Vault.sol | Smart contract: RewardableERC4626Vault.sol | |
| SFraxCollateral.sol | Smart contract: SFraxCollateral.sol | |
| SFraxEthCollateral.sol | Smart contract: SFraxEthCollateral.sol | |
| L2LidoStakedEthCollateral.sol | Smart contract: L2LidoStakedEthCollateral.sol | |
| LidoStakedEthCollateral.sol | Smart contract: LidoStakedEthCollateral.sol | |
| MetaMorphoFiatCollateral.sol | Smart contract: MetaMorphoFiatCollateral.sol | |
| MetaMorphoSelfReferentialCollateral.sol | Smart contract: MetaMorphoSelfReferentialCollateral.sol | |
| IMorpho.sol | Smart contract: IMorpho.sol | |
| MorphoAaveV2TokenisedDeposit.sol | Smart contract: MorphoAaveV2TokenisedDeposit.sol | |
| MorphoFiatCollateral.sol | Smart contract: MorphoFiatCollateral.sol | |
| MorphoNonFiatCollateral.sol | Smart contract: MorphoNonFiatCollateral.sol | |
| MorphoSelfReferentialCollateral.sol | Smart contract: MorphoSelfReferentialCollateral.sol | |
| MorphoTokenisedDeposit.sol | Smart contract: MorphoTokenisedDeposit.sol | |
| RethCollateral.sol | Smart contract: RethCollateral.sol | |
| DO_NOT_USE_StargatePoolETHCollateral.sol | Smart contract: DO_NOT_USE_StargatePoolETHCollateral.sol | |
| StargatePoolFiatCollateral.sol | Smart contract: StargatePoolFiatCollateral.sol | |
| StargateRewardableWrapper.sol | Smart contract: StargateRewardableWrapper.sol | |
| YearnV2CurveFiatCollateral.sol | Smart contract: YearnV2CurveFiatCollateral.sol | |
| Governance.sol | Smart contract: Governance.sol | |
| DutchTrade.sol | Smart contract: DutchTrade.sol | |
| GnosisTrade.sol | Smart contract: GnosisTrade.sol | |
| 3_4_0.sol | Smart contract: 3_4_0.sol |
Out of scope
Items explicitly excluded from the bounty. See also: https://docs.cantina.xyz/evaluations-and-standards/severity-classifications/bug-bounty-finding-severity#out-of-scope
Name | Description | Asset |
|---|---|---|
| Any 3rd party contracts not deployed by the Reserve Protocol team | Third-party contracts outside Reserve Protocol's control | - |
| All websites & APIs | Web interfaces and API endpoints | - |
| Known issues — ImmutableTokenJar Jan 2026 (Trust Security) | Previously reported and known issues | |
| Known issues — Reserve DTF Competition Jan 2025 (Cantina) | Previously reported and known issues | |
| Known issues — Reserve DTF Security Review Jun 2025 (Pashov) | Previously reported and known issues | |
| Known issues — Reserve Folio 2.0.0 Apr 2025 (Trail of Bits) | Previously reported and known issues | |
| Known issues — Reserve Folio 4.0.0 Jun 2025 (Trail of Bits) | Previously reported and known issues | |
| Known issues — Reserve DTF v1 Dec 2024 (Trust Security) | Previously reported and known issues | |
| Known issues — Reserve Protocol Aug 2022 (Trail of Bits) | Previously reported and known issues | |
| Known issues — Reserve Protocol Fix Review Aug 2022 (Trail of Bits) | Previously reported and known issues | |
| Known issues — Reserve Audit 4.2.0 (Trust Security) | Previously reported and known issues | |
| Known issues — Reserve Audit 3.2.0 (Trust Security) | Previously reported and known issues | |
| Known issues — Reserve Audit 3.1.0 (Trust Security) | Previously reported and known issues | |
| Known issues — Reserve 3.4.0 Spell (Trust Security) | Previously reported and known issues | |
| Known issues — Reserve Protocol Audit (Solidified) | Previously reported and known issues | |
| Known issues — Reserve Protocol 3.4.0 (Solidified) | Previously reported and known issues | |
| Known issues — Reserve Protocol Apr 2024 (Solidified) | Previously reported and known issues | |
| Known issues — Reserve PR 4.0.0 v1 | Previously reported and known issues | |
| Known issues — Reserve June Plugins v1 | Previously reported and known issues | |
| Known issues — Reserve Protocol Smart Contract Audit (Halborn) | Previously reported and known issues | |
| Known issues — Reserve Protocol 1.1 (Ackee) | Previously reported and known issues | |
| Known issues — Reserve Release 2.1.0 (Code4rena) | Previously reported and known issues | |
| Known issues — Reserve Release 3.0.0 Collaterals (Code4rena) | Previously reported and known issues | |
| Known issues — Reserve Release 3.0.0 Core (Code4rena) | Previously reported and known issues | |
| Known issues — Reserve Release 4.0.0 (Code4rena) | Previously reported and known issues | |
| All unlisted assets | Any repo, site, service, product, API, or resource not mentioned in the in-scope targets | - |