Inverse Finance bug bounty on Sherlock
Inverse Finance pays up to 100,000 USD in DOLA on Sherlock for critical bugs in its FiRM lending and DOLA contracts. Live since 12 October 2026.
The Inverse Finance bug bounty on Sherlock pays researchers for vulnerabilities in the Inverse Finance contracts. Inverse Finance is a DAO that runs the FiRM fixed rate lending market and DOLA, a stablecoin pegged to the US dollar. The program page shows it live since 12 October 2026, with no end date.
Critical findings pay 10% of the funds at risk, from 15,000 USD up to 100,000 USD. High findings pay 5,000 USD. Medium findings pay 2,000 USD and low findings pay 1,000 USD. Rewards are paid in DOLA on Ethereum and are counted in US dollars.
Critical issues include a clear and large loss of funds, funds frozen for more than a year, unauthorised minting of INV, DOLA or DBR, and leaks of private keys that give access to user funds. The page also lists known issues that will not be rewarded, such as delegator griefing, vault share inflation and some extreme slashing cases. Read that list before you start.
Reports go through the Sherlock program page. A coded proof of concept is required for every severity. If the team can pause or upgrade a contract, the damage counted for an exploit is limited to a one hour window.
Quick answers
How is the critical reward set?
It is 10% of the funds at risk, with a minimum of 15,000 USD and a maximum of 100,000 USD. Funds at risk are counted at the time the report is submitted.
Is a proof of concept required?
Yes. A coded proof of concept with instructions to run it is required for all severities.