Rujira bug bounty on Sherlock
Rujira pays up to 25,000 USDC on Sherlock for critical bugs in its THORChain app layer contracts. Live since 29 September 2026.
The Rujira bug bounty on Sherlock pays researchers for vulnerabilities in Rujira, which builds the app layer on THORChain. Rujira describes this as a suite of DeFi apps that work with native assets from all chains connected to THORChain. The program page shows it live since 29 September 2026, with no end date.
Rewards are paid in USDC. Critical findings pay 10% of the funds directly affected, from 500 USD up to 25,000 USD. High findings pay 350 to 2,000 USD and medium findings pay 300 to 1,000 USD. Severity depends on the impact and on the conditions needed for the exploit.
The scope covers FIN (RUJI Trade), bRUNE, Rujira Staking, the Rujira Revenue Converter and the Ghost Vault on the supply side of the RUJI money market. Out of scope are denial of service attacks, faults in external oracles, bugs in THORChain itself and issues that are already known or listed in earlier audits.
Reports go through the Sherlock program page. A coded proof of concept with instructions to run it is required. If the team can pause or upgrade a contract, the damage counted for an exploit is limited to a one hour window.
Quick answers
How is the critical reward set?
It is 10% of the funds directly affected, with a minimum of 500 USD and a maximum of 25,000 USD.