1inch Aqua bug bounty on Immunefi: up to $100,000
1inch pays up to $100,000 in USDC for bugs in Aqua, its new protocol for custom liquidity positions, and in the Swap VM contracts. The bounty runs on Immunefi.
The 1inch Aqua bug bounty on Immunefi pays researchers for vulnerabilities in Aqua, a protocol for creating and managing custom liquidity positions with flexible strategies. The program went live on 11 June 2026 and was last updated on 15 October 2026.
Critical bugs pay $20,000 to $100,000. High severity bugs pay $5,000 to $20,000, medium bugs $2,000 to $5,000 and low bugs $100 to $2,000. Rewards are paid in USDC on Ethereum.
Because Aqua is not yet deployed on mainnet with user funds, each severity level has a base reward. By default 1inch pays that base amount, and anything above it is at the team's discretion. 1inch says it will review the reward amounts once Aqua is live on mainnet.
The scope covers the Aqua contracts at release v1.0.0 and the Swap VM contracts at release v1.0.2 on GitHub. Bugs already listed in the published audits are not eligible. Every report needs a proof of concept, and KYC is required before payment.
1inch runs six other bug bounties on Immunefi, including one for its main smart contracts, one for Aqua improvements and others for its web, wallet and infrastructure products.
Quick answers
Why might the payout be lower than the maximum?
Aqua is not yet on mainnet with user funds, so each severity has a base reward. 1inch pays the base amount by default and may pay more at its discretion.
Which code versions count?
Only the latest tags and releases. The 1inch sdks repository and the AquaAMM.sol strategy file in the Swap VM repository are out of scope.