Compound Finance bug bounty on Immunefi
Compound Finance pays up to $1,000,000 for critical smart contract bugs, through Immunefi. Rewards are paid in COMP.
The Compound Finance bug bounty on Immunefi pays security researchers for bugs in Compound. Compound is an Ethereum protocol for money markets, where suppliers and borrowers earn or pay a floating interest rate set by supply and demand. Compound III lets users supply crypto assets as collateral to borrow a base asset. The first deployment is on Ethereum and the base asset is USDC. The program has been live since 11 December 2024 and was last updated on 9 October 2026.
For critical smart contract bugs, the reward is 10 percent of the funds directly affected, up to USD 1,000,000. The minimum critical reward is USD 50,000. Funds at risk are counted when the report is submitted. High severity reports pay from USD 10,000 to USD 50,000. Medium reports pay a flat USD 5,000. Low reports pay a flat USD 1,000.
Compound DAO pays rewards in COMP. The dollar amount uses the average price on CoinMarketCap and CoinGecko at the time the report is submitted. Validated reports are grouped into one DAO proposal at the end of each calendar month. Payment can wait until the bug is fixed, because a public payout while the bug is still open could reveal it.
A proof of concept is required at every severity. KYC is required before a payout. Testing must stay on a local fork. If the vulnerable contract can be upgraded or paused, only the first attack counts toward the reward. Unfixed issues already listed in Compound audit reports are not eligible. Reports go through the Immunefi submission page.
Quick answers
How is a critical reward calculated?
It is 10 percent of the funds directly affected when the report is submitted, with a floor of USD 50,000 and a cap of USD 1,000,000.
Which token are rewards paid in?
Compound DAO pays in COMP. The dollar amount uses the average price on CoinMarketCap and CoinGecko at the time the report is submitted.
When are payouts made?
Validated reports are grouped into one DAO proposal at the end of each calendar month. Payment can wait until the bug is fixed.