Ref Finance Smart Contracts bug bounty on HackenProof: up to $250,000
Ref Finance pays up to $250,000 for critical bugs in its DEX and farming contracts on NEAR. The HackenProof program opened on October 25, 2026.
The Ref Finance Smart Contracts bug bounty is a new program on HackenProof. Ref Finance is a DeFi protocol on NEAR Protocol for trading, liquidity and yield farming. The program started on October 25, 2026 and is listed as live with no end date.
Rewards depend on severity. Critical bugs pay $30,000 to $250,000, high $5,000 to $30,000, medium $1,000 to $5,000 and low $100 to $1,000. Critical findings include theft or permanent freezing of user funds, governance manipulation and protocol insolvency.
The scope covers the DEX contracts in the ref-contracts repository and the boost-farm repository, both rated critical. The code is Rust on NEAR.
Reports go through HackenProof. Researchers need at least 150 reputation points, a proof of concept and a $7 fee per report. You must be the first to report a bug and must report it within 24 hours of finding it. Public disclosure is not allowed.
Quick answers
Can I test against the live contracts?
No. Testing on deployed targets on mainnet or public testnets is not allowed.
How are rewards paid?
In USDT, USDC, NEAR, wNEAR or RHEA on NEAR Protocol. The team chooses the token.