XOXNO bug bounty on Immunefi
XOXNO pays up to $20,000 in USDC for critical bugs in its Stellar lending contracts, through Immunefi. Open on a rolling basis.
The XOXNO bug bounty on Immunefi pays security researchers for bugs in XOXNO lending contracts. XOXNO describes the protocol as collateralized lending on Stellar Soroban. Suppliers provide liquidity and borrowers open debt against collateral. The program has been live since 16 September 2025 and was last updated on 1 October 2026.
Rewards are paid in USDC on Ethereum and denominated in USD. Critical bugs pay from $5,000 to $20,000, at 10% of the funds directly affected. High bugs pay from $3,500 to $5,000. Medium bugs pay from $2,000 to $3,500. The price used for payment is the average of CoinMarketCap and CoinGecko at the time of the report.
If the vulnerable contract can be upgraded or paused, only the first attack counts toward the reward. Otherwise later attacks count less: the first is 100%, then 25% less for every 300 blocks. Temporary freezing of funds pays more for every extra 24 hours, up to the high cap.
A proof of concept is required. KYC is required for a payout, including full name, date of birth, proof of address, and a passport or other government ID. People on the OFAC SDN list, official contributors, employees and people closely associated with the project, and auditors who took part in the review are not eligible.
Testing is allowed only on local forks. For critical, high, and medium smart contract impacts the program uses Primacy of Impact. Payouts are handled by the XOXNO team.
Quick answers
How much does it pay?
Up to $20,000. It is paid as prizes to the winning entries.
When is the deadline?
There is no fixed deadline. Applications are reviewed as they arrive.
Who can apply?
Security researchers. A proof of concept is required. KYC is required, including full name, date of birth, proof of address, and a passport or government ID. People on the OFAC SDN list, official contributors, employees and closely associated people, and auditors who worked on the review cannot take part. Applicants from anywhere in the world can enter, unless the eligibility rules say otherwise.
How do I apply?
Through the official page at immunefi.com. The link is at the top of this page.