Alchemix
Security bounty for Alchemix
About this program#
Alchemix v3 is a unified DeFi platform for saving, earning, borrowing, and fixed-term, fixed-yield opportunities. It builds on Alchemix's original self-repaying-loan design with a more flexible multi-chain architecture. Researchers should review the v3 contract codebase at https://github.com/alchemix-finance/v3/tree/master/src, the user documentation at https://docs.alchemix.fi/, and the developer documentation at https://docs.alchemix.fi/dev/alchemist/alchemist-contract.
Deployed across Ethereum, Arbitrum, Optimism, and Base.
Rewards are denominated in USD and paid in USDC on Ethereum, Arbitrum, or Optimism. Critical rewards are 10% of directly affected funds, with a $20,000 minimum and a $150,000 maximum, measured when the report is submitted. If an affected contract can be paused or upgraded, only the initial repeatable attack is counted.
A working proof of concept demonstrating the reported impact is required for every severity. Test only against local forks — never against deployed mainnet or public-testnet code, live pricing oracles, or third-party systems. KYC is not required for payouts.