Inverse Finance
Bounty Range
$1,000 - $100,000
external program
Inverse Finance
[/bug-bounty/](Back to Explore)
Inverse Finance is a decentralized autonomous organization that develops and manages the FiRM fixed rate lending protocol and DOLA, a debt-backed decentralized stablecoin. Originally founded by Nour Haridy in late 2020, the protocol is now governed by Inverse Finance DAO, a collective of crypto enthusiasts. Our code base is open source and maintained by the community.
Arbitrum Base ETH Optimism Defi DAO Lending Stablecoin Token Solidity Typescript
Maximum Bounty $100,000 Live Since 30 November 2023 Last Updated 01 March 2026
PoC Required
Vault program
KYC required
[https://bugs.immunefi.com/dashboard/new-submission?utm_source=immunefi](Submit a Bug)
/bug-bounty/ /bug-bounty/inversefinance/information/#top/bug-bounty/inversefinance/scope/#top/bug-bounty/inversefinance/resources/#top
Funds available
$35,415.84
30d Avg. Funds availability
$36,704.61
Assets in vault
Public vault address
0x85BE5FF8F1871f1593eCd0dF73e80F1F771B6f0E https://etherscan.io/address/0x85BE5FF8F1871f1593eCd0dF73e80F1F771B6f0E?utm_source=immunefi
Inverse Finance provides rewards in DOLA on Ethereum, denominated in USD.
Smart Contract Critical Max: $100,000Min: $15,000
Primacy of Rules
High Flat: $5,000 Primacy of Rules
Medium Flat: $2,000 Primacy of Rules
Low Flat: $1,000 Primacy of Rules
Critical Reward Calculation
Reward amount is 10% of the funds directly affected up to a maximum of:
$100,000 Minimum reward to discourage security researchers from withholding a bug report:
$15,000
Websites and Applications Critical Max: $100,000Min: $15,000
Primacy of Rules
Rewards Body
Rewards are distributed according to the impact of the vulnerability based on the [https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/](Immunefi Vulnerability Severity Classification System V2.3.)
For critical smart contract bugs, the reward amount is 20% of the funds directly affected up to a maximum of USD 100 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 15 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.
Repeatable Attack Limitations
If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attacks within the first hour will be considered for a reward. This is because the project can mitigate the risk of further exploitation by upgrading or pausing the component where the vulnerability exists. The reward amount will depend on the severity of the impact and the funds at risk.
For critical repeatable attacks on smart contracts that cannot be upgraded or paused, the project will consider the cumulative impact of the repeatable attacks for a reward. This is because the project cannot prevent the attacker from repeatedly exploiting the vulnerability until all funds are drained and/or other irreversible damage is done. Therefore, this warrants a reward equivalent to 10% of funds at risk, capped at the maximum critical reward.
Reward Calculation for High Level Reports
High vulnerabilities concerning theft/permanent freezing of unclaimed yield/royalties are considered at the full amount of funds at risk, capped at the maximum high reward. This is to incentivize security researchers to uncover and responsibly disclose vulnerabilities that may have not have significant monetary value today, but could still be damaging to the project if it goes unaddressed.
In the event of temporary freezing, the reward doubles from the full frozen value for every additional 24h that the funds are temporarily frozen, up until a max cap of the high reward. This is because as the duration of the freezing lenghents, the potential for greater damage and subsequent reputational harm intensifies. Thus, by increasing the reward proportionally with the frozen duration, the project ensures stronger incentives for bug disclosure of this nature.
For critical web/apps bug reports will be rewarded with 100 000 USD , only if the impact leads to:
A loss of funds involving an attack that does not require any user action
Unauthorized minting of INV, DOLA, or DBR tokens on-chain
Private key or private key generation leakage leading to unauthorized access to user funds
All other impacts that would be classified as Critical would be rewarded a flat amount of 5 000 USD. The rest of the severity levels are paid out according to the Impact in Scope table.
Reward Payment Terms
Payouts are handled by the Inverse Finance team directly and are denominated in USD. However, payments are done in DOLA.
The calculation of the net amount rewarded is based on the price between at the time the bug report was submitted. No adjustments are made based on liquidity availability.
[/bug-bounty/inversefinance/scope/#impacts]( View impacts in scope)
Inverse Finance is a decentralized autonomous organization that develops and manages the FiRM fixed rate lending protocol and DOLA, a debt-backed decentralized stablecoin. Originally founded by Nour Haridy in late 2020, the protocol is now governed by Inverse Finance DAO, a collective of crypto enthusiasts. Our code base is open source and maintained by the community.
Inverse Finance's main products are:
FiRM, a fixed-rate lending market.
DOLA, a stablecoin pegged to the US Dollar.
DBR, a new DeFi primitive that enables holders to service DOLA loans on FiRM.
The INV governance token governs on-chain DAO voting and is traded on leading exchanges.
For more information about Inverse Finance, please visit https://www.inverse.finance/?utm_source=immunefi
Inverse Finance provides rewards in DOLA, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section below.
Primacy of Impact vs Primacy of Rules
Inverse Finance adheres to the Primacy of Impact for the following impacts:
Smart Contract - Critical
Smart Contract - High
Smart Contract - Medium
Smart Contract - Low
Primacy of Impact means that the impact is prioritized rather than a specific asset. This encourages security researchers to report on all bugs with an in-scope impact, even if the affected assets are not in scope. For more information, please see [https://immunefisupport.zendesk.com/hc/en-us/articles/12340245635089-Best-Practices-Primacy-of-Impact?utm_source=immunefi](Best Practices: Primacy of Impact )
When submitting a report on Immunefi’s dashboard, the security researcher should select the Primacy of Impact asset placeholder. If the team behind this project has multiple programs, those other programs are not covered under Primacy of Impact for this program. Instead, check if those other projects have a bug bounty program on Immunefi.
If the project has any testnet and/or mock files, those will not be covered under Primacy of Impact.
All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms and conditions set within this program.
Proof of Concept (PoC) Requirements
A PoC, demonstrating the bug's impact, is required for this program and has to comply with the [https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules?utm_source=immunefi](Immunefi PoC Guidelines and Rules.)
Public Disclosure of Known Issues:
Bug reports covering previously-discovered bugs (listed below) are not eligible for a reward within this program. This includes known issues that the project is aware of but has consciously decided not to “fix”, necessary code changes, or any implemented operational mitigating procedures that can lessen potential risk.
[Public Disclosure Issue 1] - potential for griefing through the manipulation of the delegator parameter in the delegateBySig function (MultiDelegator, XINV, etc)
[Public Disclosure Issue 2] - subdomain misconfigurations (gitbook etc)
[Public Disclosure Issue 3] - DMARC issue related to emails
[Public Disclosure Issue 4] - Note for whitehats on Escrow contract implementations: Submissions related to a missing initialization on the implementation contract are not valid because the contract is cloned and correctly initialized per user at the first deposit. The contracts deployed are proxy reference implementations, all proxies are properly initialized on creation.
[Public Disclosure Issue 5] - Some active contracts listed in this program interact with older Inverse Finance contracts, including legacy systems such as Anchor and Frontier. While these active contracts are in scope, they may interface with deprecated components that are no longer maintained, no longer hold value, accrue interest, or otherwise function in a non-critical capacity. Submissions that rely on assumptions about the behavior of deprecated contracts may appear valid on the surface but do not represent real security risks. Whitehats are encouraged to verify whether all components involved in a potential exploit path are active, in-scope, and currently used by the protocol.
[Public Disclosure Issue 6] - Any method requiring the user to be or go on a different domain than inverse.finance is out of scope (clickjacking, phishing emails etc).
[Public Disclosure Issue 7] - It's known that in a scenario where bad debt exceeds the total slashable amount from junior tranche, the users won't be able to withdraw as there won't be funds for it (besides the new deposits or accruing rewards).
[Public Disclosure Issue 8] - Extreme slashing scenarios where repeated slashing and deposits cause shares to deflate are known. These scenarios are considered a failure of risk parameterisation of the protected FiRM markets. The slashing is considered extreme if all available funds are slashed and/or if several slashing actions compound to create extreme share deflation (share/deposit ratio exceeds 1000000x, ie, there are >=1_million_e18 shares for 1e18 of the underlying asset). If the issue requires such an extreme slashing as a precondition and cannot happen without it, then the issue is considered Medium at max, as it's an extensive constraint.
[Public Disclosure Issue 9] - It's known that due to extreme slashing will brick deposits (users won't be able to deposit) regarding share deflation up until the total share limit. However, if the issue requires extreme slashing, but is not connected to reaching the max total shares, then it's not considered known, but can be viewed as Medium at max (due to extensive constraints).
Previous Audits
Inverse Finance’s completed audit reports can be found at https://www.inverse.finance/audits?utm_source=immunefi Any unfixed vulnerabilities mentioned in these reports are not eligible for a reward.
Immunefi Standard Badge
By adhering to Immunefi’s best practice recommendations, Inverse Finance has satisfied the requirements for the [https://immunefisupport.zendesk.com/hc/en-us/articles/15006865432209?utm_source=immunefi](Immunefi Standard Badge. )
Auditor | Link | Completed at
| Code4rena Contest | https://code4rena.com/reports/2022-10-inverse?utm_source=immunefi | 20 December 2022 | Nomoi | https://www.inverse.finance/audits/firm-nomoi.pdf?utm_source=immunefi | 11 May 2023 | yAudit | https://www.inverse.finance/audits/sDOLA-yAudit.pdf?utm_source=immunefi | 23 January 2024 | Sherlock | https://www.inverse.finance/audits/junior-sherlock.pdf?utm_source=immunefi | 16 October 2025 | Sherlock | https://www.inverse.finance/audits/junior-sherlock-contest.pdf?utm_source=immunefi | 10 November 2025 |
Auditor Code4rena Contest
Link https://code4rena.com/reports/2022-10-inverse?utm_source=immunefi
Completed at 20 December 2022
Auditor Nomoi
Link https://www.inverse.finance/audits/firm-nomoi.pdf?utm_source=immunefi
Completed at 11 May 2023
Auditor yAudit
Link https://www.inverse.finance/audits/sDOLA-yAudit.pdf?utm_source=immunefi
Completed at 23 January 2024
Auditor Sherlock
Link https://www.inverse.finance/audits/junior-sherlock.pdf?utm_source=immunefi
Completed at 16 October 2025
Auditor Sherlock
Link https://www.inverse.finance/audits/junior-sherlock-contest.pdf?utm_source=immunefi
Completed at 10 November 2025
The submission of KYC information is a requirement for payout processing.
Participants must adhere to the Eligibility Criteria.
Proof of concept is always required for all severities.
Category 2: Notice Required
Default prohibited activities
Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
Any testing with pricing oracles or third-party smart contracts
Attempting phishing or other social engineering attacks against our employees and/or customers
Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
Any denial of service attacks that are executed against project assets
Automated testing of services that generates significant amounts of traffic
Public disclosure of an unpatched vulnerability in an embargoed bounty
[https://immunefi.com/rules/](Any other actions prohibited by the Immunefi Rules)
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.
[https://immunefisupport.zendesk.com/hc/en-us/articles/19430444320401-Pre-Impact-Bug-Monitoring?utm_source=immunefi](Pre-Impact Bug Monitoring)
[https://immunefisupport.zendesk.com/hc/en-us/articles/17243068885265-Attack-Investment-Amount?utm_source=immunefi](Attack Investment Amount)
[https://immunefisupport.zendesk.com/hc/en-us/articles/17454897136401-Attacks-With-A-Financial-Risk-To-The-Attacker?utm_source=immunefi](Attacks With A Financial Risk To The Attacker)
[https://immunefisupport.zendesk.com/hc/en-us/articles/17455102268305-When-Is-An-Impactful-Attack-Downgraded-To-Griefing?utm_source=immunefi](When Is An Impactful Attack Downgraded To Griefing?)
[https://bugs.immunefi.com/dashboard/new-submission?utm_source=immunefi](Submit a Bug) 30d Avg. Funds Availability$36,704.61
[/bug-bounty/inversefinance/scope/#assets](Total Assets in Scope119 )