Pendle Boros Bounty
Bounty Range
$500,000 - $500,000
external program
Bounty Range
$500,000 - $500,000
external program
/opportunities/leaderboard[/welcome](Discover Cantina)
[/login](Log in)[/signup](Sign up)
@pendle-finance Live
https://x.com/pendle_fihttps://github.com/pendle-financehttps://www.pendle.finance
Total reward
$500,000
Deposit required
$50
Findings submitted
57
Start date
19 Sep 2025
Please sign in as a researcher to join the bounty.
[/login](Log in)
Pendle Boros is the first protocol that provides a marketplace for on-chain interest rate swaps. The protocol enables users to take long or short positions on variable interest rates with leverage through a hybrid system combining a central limit order book and AMM.
The bug bounty program is focused on smart contract security and is primarily concerned with preventing loss of user funds and protocol insolvency. Further resources regarding Boros can be found at https://boros.pendle.finance/.
We aim for reports with a clear, actionable outcome. A report is eligible for a reward under this program only if all of the following are true:
Pendle has adopted the SEAL (Security Alliance) Whitehat Safe Harbor framework. Safe Harbor is intended for active exploits (i.e., hacks-in-progress), where whitehats may need to intervene to rescue funds and return them with clear pre-authorization and rules of engagement.
Authoritative references (please read these first):
The following Boros core contracts deployed on Arbitrum are in scope:
Address | Contract | https://arbiscan.io/address/0x8080808080daB95eFED788a9214e400ba552DEf6 | Router | https://arbiscan.io/address/0x1080808080f145b14228443212e62447C112ADaD | MarketHub | https://arbiscan.io/address/0x2080808080262c1706598c9DBDD3a0cD3601e5ea | AccessController | https://arbiscan.io/address/0x3080808080Ee6a795c1a6Ff388195Aa5F11ECeE0 | MarketFactory | https://arbiscan.io/address/0x3205e972714B52512c837AE6f5FCFDeB07f0f23C | AMMFactory | https://arbiscan.io/address/0x353C6Ba99500f9F5a7937aF7BF26c8E40817518B | AdminModule | https://arbiscan.io/address/0xD0808080803c59dBF8825290bca8979786C2d65B | MakerIncentiveDistributor | https://arbiscan.io/address/0xD180808080402FE41711Db560B8db5C41e21Df71 | AMMIncentiveDistributor | https://arbiscan.io/address/0xD2808080809a71248620a7ddc25b721d3DBe1058 | ReferralIncentiveDistributor |
Additionally, active markets and related contracts are also in scope:
The list of markets can be obtained at https://api.boros.finance/core/docs#/Markets/MarketsController_getMarkets
For each market, the in-scope contracts include Market, AMM, and FIndexOracle.
For example, for market with ID 2, the following contracts are considered:
Market: https://arbiscan.io/address/0xd490dd635051d609887883d364368b223631653d
AMM: https://arbiscan.io/address/0xb57c34fbcb272510303675397055942b019ee45a
FIndexOracle: https://arbiscan.io/address/0x3011dfd5736aeb5629d5db178a61b0094e2144b9
Matured markets will be considered if the vulnerability has system-wide impact or impacts on active markets.
Rewards are distributed based on vulnerability severity and potential economic impact.
Severity | Maximum Payout | Minimum Payout | Critical | Up to $500,000 USD | $50,000 USD | High | Up to $100,000 USD | $20,000 USD |
Note: Rewards are capped at 10% of economic impact for fund-loss scenarios.
This covers vulnerabilities in smart contract implementation that could lead to theft or loss of funds. These are traditional bugs in the code itself, as opposed to economic design flaws covered in the next section.
Severity is determined by both the amount of funds at risk and likelihood of exploitation:
Likelihood | >=10% TVL | <10% TVL | High | Critical | High | Medium | High | Medium |
For vulnerabilities that result in immediate token extraction out of Boros contracts, the funds at risk are calculated as 100% of exploitable amount.
For vulnerabilities that result in artificially inflated account balances but not immediate token extraction (i.e. still subject to withdrawal cooldown), the funds at risk are calculated as 20% of the exploitable amount (after deducting attack costs). However, a vulnerability that results in an inflated account balance that can be leveraged to cause protocol insolvency will be considered higher severity. This type of vulnerability will be assessed based on the potential total economic damage to the protocol, not just the capped amount.
Note: The adjusted funds at risk are used as the "economic impact" for reward calculation. For vulnerabilities mitigated by the cooldown mechanism, this effectively caps rewards at 2% of the exploitable amount (20% funds at risk × 10% reward cap). The minimum payout still applies.
Economic exploits are vulnerabilities in the protocol's design, as opposed to direct coding bugs, that can lead to systemic financial damage without necessarily involving a direct theft of funds. These include economic design flaws and manipulation strategies that exploit legitimate protocol mechanisms.
Unlike technical exploits where funds at risk can be calculated relatively precisely, economic exploits often have complex, cascading effects that make standardized calculations difficult. Therefore, severity will be determined on a case-by-case basis at Pendle's sole discretion, based on our assessment of the potential total financial damage to the protocol. Factors considered may include direct losses, user funds at risk, market dysfunction duration, confidence impact, and systemic risks. Pendle reserves the right to make final determinations on both the validity and severity of all economic exploit submissions.
Likelihood/Impact | Significant | Moderate | High | High or Critical | High | Medium | High | Medium |
For other vulnerabilities, the Pendle team exercises discretion, together with Cantina, to determine final severity based on the specific context and potential impact of each vulnerability.
Security researchers are still encouraged to report the out of scope issues. Awards for out of scope issues to be determined at the discretion of Pendle Finance.
The Pendle team will be very flexible in assessing all submissions, with the goal of prioritizing the security of the protocol.
Along with a clear description and reproduction steps, reports must include an actionable remediation. A remediation can be either:
A concrete code-level change (patch, pseudo-code, or precise guidance on what to change), or
A concrete operational/design mitigation that we can realistically adopt (e.g., configuration constraints, process controls, monitoring + response, feature removal/disablement). A report may be considered out of scope if:
It does not include a credible remediation or mitigation path, or
The reported impact relies on a condition that we can reasonably avoid through configuration, operational controls, or design choices (i.e., the protocol is not exposed under intended and reasonably expected operation), or
The proposed remediation is not feasible to implement or does not meaningfully reduce the reported risk. We reserve the right to determine whether a mitigation is feasible and "reasonably avoidable" based on intended protocol usage and realistic operational constraints.
Issues that do not have strong impact according to the severity criteria are considered out of scope.
We still encourage researchers to report such issues in good faith, as they can help us improve resilience and user safety. Please see the Goodwill Policy section below.
We still encourage researchers to report issues even if they appear out of scope under this program. Security is our priority, and we’d rather hear about a potential weakness than miss it. Pendle frequently offers goodwill awards for high-quality, well-evidenced reports that identify unusual or previously unknown behaviors affecting the protocol. To date, Pendle has awarded over $20,000 in goodwill to researchers for such reports.
That said, out-of-scope reports are eligible for goodwill awards only at Pendle’s discretion. To keep this channel useful for everyone, we will prioritize submissions that are:
Eligible Participants:
Independent security researchers
White hat hackers
Security firms not previously engaged with Pendle Ineligible Participants:
Current or former Pendle team members or contractors
Auditors who reviewed Boros code
Anyone with privileged access to Boros development
By submitting a report, you grant Pendle the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of Pendle. The terms, conditions, and scope of this Program may be revised at any time. Participants are responsible for reviewing the latest version before submitting a report.