Aave V4 bug bounty on Sherlock: up to 2,500,000 USD
Aave DAO pays up to 2,500,000 USD for critical bugs in Aave V4 through Sherlock. The programme is live and takes reports at any time.
The Aave V4 bug bounty programme runs on the Sherlock audit platform. The maximum reward is 2,500,000 USD.
Rewards follow a severity table. Critical reports pay 100,000 USD to 2,500,000 USD, high reports pay 10,000 USD to 25,000 USD, medium reports pay 5,000 USD to 10,000 USD and low reports pay 1,000 USD to 5,000 USD. A report counts as critical only when at least 100,000 USD is at risk.
The scope covers Aave V4, which uses a Hub and Spoke design where the Hub manages shared liquidity and Spokes hold the supply and borrow logic for each asset. The programme page has a scope tab that lists the code in scope.
Every report needs a coded proof of concept with instructions to run it. Theoretical findings without a working proof of concept are not accepted, and the page lists actions that are not allowed during testing.
The programme has been live since July 29, 2026 and the Sherlock page still shows it as live. There is no closing date. Reports go through the Report a bug link on the programme page.