A

Alchemix

Bug Bounty

Security bounty for Alchemix

Chains
Multi Chain
Triage byCertiK
Max bounty
$150k

About this program#

Alchemix v3 is a unified DeFi platform for saving, earning, borrowing, and fixed-term, fixed-yield opportunities. It builds on Alchemix's original self-repaying-loan design with a more flexible multi-chain architecture. Researchers should review the v3 contract codebase at https://github.com/alchemix-finance/v3/tree/master/src, the user documentation at https://docs.alchemix.fi/, and the developer documentation at https://docs.alchemix.fi/dev/alchemist/alchemist-contract.

Deployed across Ethereum, Arbitrum, Optimism, and Base.

Rewards are denominated in USD and paid in USDC on Ethereum, Arbitrum, or Optimism. Critical rewards are 10% of directly affected funds, with a $20,000 minimum and a $150,000 maximum, measured when the report is submitted. If an affected contract can be paused or upgraded, only the initial repeatable attack is counted.

A working proof of concept demonstrating the reported impact is required for every severity. Test only against local forks — never against deployed mainnet or public-testnet code, live pricing oracles, or third-party systems. KYC is not required for payouts.

Target scope & exclusionsLocked
Proof-of-concept guidanceLocked
Severity-based rewardsLocked
Sign in to check your Vanguard access and view protected program scope.
Alchemix - CertiK Hunt program