Kamino bug bounty on Sherlock: up to 1,000,000 USDC

The Kamino bug bounty on Sherlock pays researchers for vulnerabilities in Kamino, a protocol for lending, liquidity and vaults on Solana. The maximum reward is 1,000,000 USDC. The program page shows it live since 16 October 2026, with the same time as the last update. There is no end date.

Smart contract theft pays 10% of the funds at risk, up to $1,000,000 per vulnerability. Irreversible loss or permanent freezing pays 5%, up to $100,000. Web and app theft pays 10% of funds at risk, up to $100,000. Other critical web and app findings are capped at $100,000 and high findings at $50,000. Temporary freezing or outages can earn up to $10,000 at Kamino's choice. One underlying bug receives one reward.

The scope covers five programs on Solana mainnet: Kamino Liquidity, KLend, KFarms, KVault and Scope. It also covers app.kamino.finance and kamino.com. Only markets and vaults that are officially listed in the normal Kamino interface count. Test and unlisted instances are out of scope.

Reports need a working proof of concept on a local Solana validator or a test environment such as LiteSVM. The starting accounts must match mainnet data. Critical and high findings must show real funds at risk. Do not exploit live systems or harm users.

You submit through the Report a bug link on the Sherlock page. Keep the details private until Kamino has verified the issue, deployed a fix and allowed disclosure. Before payment you must pass KYC with your full name, date of birth, proof of address and a government ID.

Quick answers

How is a smart contract reward worked out?

Theft of funds pays 10% of the funds at risk, capped at $1,000,000. Irreversible loss or permanent freezing pays 5%, capped at $100,000. There are no guaranteed minimums.

Does Primacy of Impact apply?

No. Only the listed program addresses and the two web domains are covered.

How are rewards paid?

Rewards are set in USD and paid in USDC on Solana through Sherlock.