Alchemix bug bounty on Immunefi: up to $150,000
Alchemix pays up to $150,000 in USDC for a critical smart contract bug through Immunefi. The program has no closing date.
The Alchemix bug bounty on Immunefi pays researchers who find vulnerabilities in the Alchemix smart contracts. Alchemix is a DeFi platform for saving, earning and borrowing that runs on Ethereum, Arbitrum, Optimism and Base. The program has been live since 26 February 2026, and the information page was last updated on 8 September 2026.
A critical smart contract bug earns 10% of the funds directly affected, with a minimum of $20,000 and a maximum of $150,000. High severity reports pay $5,000 to $20,000. Medium reports get a flat $3,000 and low reports a flat $1,000. Rewards are paid in USDC on Ethereum, Arbitrum or Optimism.
Alchemix says it focuses its review time on researchers at the Intermediate level or higher on Immunefi. Researchers at the Novice or Junior level are asked to build up valid reports on other programs first.
Every report needs a proof of concept that shows the impact and follows the Immunefi PoC rules. Known issues listed on the program page are not rewarded. The program uses Primacy of Impact for smart contract impacts, so a bug with an in scope impact counts even if the affected asset is not listed.
Reports go through the Submit a Bug button on the Immunefi program page. Immunefi triages the reports.