Executive Summary
This report analyzes the bug bounty programs for assets listed on the Aave V3 Protocol. Bug bounties represent a critical, continuous layer of security in the on-chain ecosystem, augmenting traditional audits by incentivizing a global pool of researchers to discover and report vulnerabilities. Given Aave’s position as a foundational DeFi protocol, its security standards significantly influence the broader ecosystem.
Our review of 47 assets on Aave V3 markets with over $5 million in total value supplied reveals a mixed landscape. While most assets (33, representing $19.7 billion in supply on Aave) have adequately sized bounties, a significant portion do not. We identified 10 assets (totaling $19.2 billion in supply on Aave) with either non-existent or vastly insufficient bounty programs. An additional 4 assets (representing $10.8 billion in supply) have programs that meet our minimum criteria but require improvement regarding the bounty amount or coverage.
This analysis underscores the need for more consistent and robust security practices. We recommend that Aave formalize its security expectations by encouraging all listed assets to implement and maintain comprehensive bug bounty programs. This includes establishing minimum financial incentives, ensuring the scope of coverage extends beyond smart contracts to all potential risk vectors, and promoting transparency. By championing these best practices, Aave can leverage its influence to elevate security standards, safeguard its protocol, and foster a more resilient DeFi ecosystem.
Introduction
In the Web2 ecosystem, bug bounty programs have become a standard and vital component of modern software security. Institutionalized by platforms such as HackerOne and Bugcrowd, this framework allows organizations to leverage a global pool of independent researchers to proactively discover vulnerabilities—a practice proven critical by discovering systemic risks like the Heartbleed bug in open-source infrastructure.
This battle-tested model has been adopted and adapted within the on-chain security landscape, where its role is arguably even more vital. Unlike in traditional software, where an exploit might lead to data compromise or service disruption, a vulnerability in a smart contract can result in the immediate and irreversible loss of user funds. In this context, bug bounties are reward schemes funded by protocols to incentivize third-party researchers to identify and report potential flaws. By rewarding these discoveries based on a predefined severity scale, these programs provide a crucial, continuous, and decentralized layer of security.
It is essential to distinguish these ongoing programs from point-in-time security assessments like formal audits and contests. While audits provide an invaluable snapshot of a codebase’s health, they are not a substitute for a continuous security model. Smart contracts may be immutable, but protocol teams often retain administrative permissions to alter parameters, and the broader operational environment is constantly evolving. A bug bounty program, therefore, offers a dynamic and persistent defense mechanism that complements static reviews to safeguard a protocol’s codebase and economic integrity.
This report presents a detailed analysis of the bug bounty landscape for assets listed on the Aave V3 Protocol. Given Aave’s stature as one of the largest and most foundational protocols in Decentralized Finance (DeFi), it holds significant influence to champion and enforce security best practices. This examination, therefore, covers key metrics and the status of existing bounties and considers how Aave can leverage its position to encourage the broader adoption and enhancement of these programs, thereby elevating security standards for the entire ecosystem.
2. Evaluation Framework and Methodology
This analysis presents a snapshot of the bug bounty landscape as of August 19, 2024. The methodology and criteria used for evaluation are outlined below.
2.1. Scope of Analysis
The review focuses on non-frozen assets listed on Aave V3 markets with a total value exceeding $5 million, encompassing 47 assets. An asset is considered to have bug bounty coverage if it is explicitly named within a program’s scope or implicitly protected by a protocol-wide policy. Where such coverage could not be verified through public documentation, the asset is deemed without a formal bounty. This classification is therefore contingent on the accuracy and completeness of publicly available information. For data sourcing, Total Value Locked (TVL) figures were primarily sourced from CoinGecko, with DeFiLlama used as a secondary source where necessary. For wrapped assets, the TVL of the underlying unwrapped asset was considered.
2.2. Criteria for an Effective Bug Bounty Program
A. Comprehensive Scope of Coverage
An effective program must extend beyond the protocol’s smart contract codebase. The scope should be tailored to cover any vector that could expose the protocol to risk, including:
-
Loss of user funds.
-
Exposure of private keys, passwords, and sensitive data.
-
Disclosure of user information.
-
Unauthorized state-modifying actions.
-
Domain takeovers and malicious redirections.
While most programs analyzed provide coverage for smart contracts, many lack explicit inclusion of other critical areas like web applications, domains, and APIs. The risks associated with these off-chain components depend on the protocol’s architecture. For example, a regulated custodial asset faces different threats than a decentralized stablecoin (e.g., GHO). However, both are critically vulnerable to attacks beyond their smart contracts. Therefore, the design of a bug bounty program cannot be standardized; it must be tailored to the holistic risk profile of the specific asset or protocol.
B. Adequacy of Financial Incentives To quantify an incentive’s financial significance, this report analyzes the maximum bounty payout relative to the value it secures. This is expressed as the bounty value per million dollars of Total Value Locked (TVL), calculated against the asset’s total supply on Aave V3 and its protocol-wide TVL.
We consider that a minimum bounty of $50,000 is necessary to attract skilled security researchers, regardless of the value at risk. As a protocol’s TVL increases, this incentive must scale to remain a compelling alternative to black-hat exploitation. For protocols with TVL above $250 million, a maximum payout exceeding $1 million represents a sufficiently capitalized program. This amount signals a serious commitment to security and provides a powerful incentive for top-tier researchers.
2.3. Program Management Models
The operational framework for bug bounty programs is largely standardized, involving submission, triage, validation, and reward disbursement. Two principal models govern their administration: self-management by the protocol’s internal team or management via a specialized third-party platform (e.g., Immunefi, HackerOne).
Our analysis indicates a strong preference for platform-managed programs. A primary advantage is the enhanced credibility and trust conferred by a reputed intermediary, which gives researchers greater confidence in the payout process. These platforms can also provide operational support, such as professional triage services, and generate powerful network effects by centralizing program discovery, creating a competitive marketplace that attracts a large and diverse pool of security talent.
3. Analysis of Findings
Our review found that while most assets listed on Aave benefit from a bug bounty program, the quality and scale of these programs vary significantly.
Source: LlamaRisk, August 19, 2025
3.1. Overall Landscape
Of the 47 assets analyzed:
-
33 assets (totaling $19.7 billion in supply on Aave) have bug bounty programs that we consider adequately sized to their TVL. This means they met our minimum $50,000 coverage, with the amount proportionate to the TVL they secure.
-
4 assets (totaling $10.8 billion in supply on Aave) have bounties that meet our minimum criteria but could be improved to reflect the value they secure.
-
10 assets (totaling $19.2 billion in supply on Aave) have no public bug bounty program or one vastly insufficient.
A recurring observation was that many programs limit their scope to smart contracts, which we view as a shortsighted approach that neglects other significant attack vectors.
3.2. Assets with Inadequate or Non-Existent Bounties
The lack of a bug bounty removes a critical layer of security, weakening incentives for ethical hackers and limiting risk identification to internal teams and periodic audits. The following assets were identified as having insufficient or no coverage:
-
Circle (USDC, EURC): With a maximum bounty of only $5,000, this is vastly insufficient for a prominent stablecoin issuer securing nearly $70 billion in assets.
-
Tether (USDT): A maximum bounty of only $10,000 is extremely low relative to a TVL exceeding $160 billion.
-
BitGo wrapped bitcoin (WBTC): The bounty of $20,000 is low compared to its TVL.
-
Etherfi (eBTC): The BTC-backed liquid restaking token has no active bounty, despite its complex structure with multiple dependencies.
-
Monerium (EURe): No public bug bounty program could be found.
-
Gnosis (GNO): While a Gnosis chain bounty is live on Immunefi, the scope and docs indicate it only applies to bridge contracts
-
Ripple (RLUSD): The maximum bounty amount is undisclosed. Transparency could also be improved, as participation is invitation-based with discretionary rewards.
-
PayPal (PYUSD): No public bug bounty program could be found.
-
Agora (AUSD): No public bug bounty program is active, although the team committed to establishing one by Q1 2025 during its Aave onboarding.
3.3. Assets that could use Bounty Improvement
The following assets have bounty programs that, while present, are not commensurate with their TVL or could be improved in scope and transparency.
-
Etherfi (weETH): The maximum bounty of $200,000 could be improved, considering over $11 billion in TVL, most of which is on Aave V3.
-
KelpDAO (rsETH): The bounty is low compared to its TVL. However, its scope is commendable, including websites and smart contracts.
-
Wrapped AVAX (WAVAX): The bounty is low compared to its TVL.
-
Binance (WBNB): The $100,000 maximum bounty is insufficient for an asset of its scale. Furthermore, critical infrastructure such as webpages, DNS, and email are explicitly out of scope.
3.4. Special Considerations
-
Centralized Issuers (USDC, USDT, PYUSD): Circle, Tether, and PayPal operate as centralized, full-reserve issuers. The comparatively low or non-existent bounties for their assets can be partly attributed to the robust legal and compliance frameworks governing their operations. These responsibilities as licensed custodians, combined with their typically lower on-chain complexity, offset some security risks that large bug bounties would otherwise address. However, while legal and compliance frameworks provide a reactive path for recourse and asset recovery, they cannot prevent exploits across the entire attack surface. This surface extends far beyond the smart contract to include critical infrastructure, private key management, and human operators susceptible to social engineering. Since a compromise in any of these areas could trigger immediate on-chain chaos that reactive legal remedies cannot prevent, a robust bug bounty program remains a critical proactive defense layer, even for fully-reserved and regulated issuers.
-
Bridged and Layer-2 Assets: When a standard L2 bridging contract is used (e.g.,
StandardArbERC20The asset inherits the security coverage of the L2 chain’s bug bounty program. This applies to chains like Arbitrum and extends more broadly across the OP Stack ecosystem (e.g., Optimism, Base), where protocols using standard contracts benefit from the underlying network’s bounty. This shared security model leverages established and battle-tested code, with the network assuming responsibility for resolving vulnerabilities and paying rewards.
4. Legal Implications
The relationship between bug bounty programs and formal security audits remains nuanced within existing regulatory frameworks, justified by current sector guidance, which recognizes both as complementary security measures rather than substitutes. The European Banking Authority report identifies bug bounty platforms and continuous code review as emerging DeFi security best practices. Current regulatory approaches for centralized stablecoin issuers operate primarily through reactive compliance mechanisms, emphasizing post-incident remedies such as asset freezes, recoveries, and disclosure obligations rather than mandating specific preventive technical controls against smart contract vulnerabilities. Importantly, legal and regulatory compliance frameworks do not relieve issuers of their duty of care to implement robust technical risk controls, and regulators increasingly expect both reactive governance safeguards and proactive security measures to function in parallel.
Neither the European Union’s Markets in Crypto-Assets Regulation (MiCA) nor the current United States federal regulatory frameworks impose explicit requirements for centralized stablecoin issuers to maintain bug bounty programs as operational or licensing prerequisites. However, the regulatory landscape creates practical expectations approaching mandatory standards. Under MiCA, fiat-referencing e-money tokens must be issued by authorized credit institutions or electronic money institutions, which fall under the Digital Operational Resilience Act (DORA) as of January 17, 2025. DORA’s regulatory technical standards on ICT risk management legally require these institutions to establish procedures for responsible vulnerability disclosure to clients and the public. While this creates a binding obligation to operate formal vulnerability disclosure programs, it does not mandate monetary bounty payments. However, many EU-regulated issuers implement bounty layers to operationalize vulnerability intake and triage effectively.
In the United States, stablecoin issuers operating under various regulatory regimes—including FinCEN oversight, SEC jurisdiction, state money transmission licensing, or NYDFS BitLicense frameworks—must maintain effective security programs proportionate to operational risks. Still, specific technical measures remain at the issuer’s discretion. U.S. regulators increasingly expect regular code audits, penetration testing, and comprehensive incident reporting without prescribing mandatory bug bounty programs.
Bug bounty programs represent recognized best practices and strong risk mitigation measures, but their absence currently cannot constitute definitive compliance failures for centralized issuers in either jurisdiction. These programs are rapidly becoming de facto industry standards that will likely receive regulatory scrutiny during licensing reviews or post-incident investigations.
5. Recommendations and the Role of Aave
As a risk service provider, we consistently encourage teams seeking to list on an Aave market to establish a robust bug bounty program commensurate with their on-chain TVL. Bug bounties do not replace audits but add a vital dimension of continuous, outsourced security monitoring that protects protocol operations and user funds.
For Aave, a considered asset security framework is essential for any potential asset utilization on its markets. To strengthen the security of the protocol and the wider ecosystem, we propose the following actions:
-
Establish Clear Onboarding Standards: Aave should encourage the implementation of a bug bounty program as a standard consideration for new asset listings. This ensures that security is a proactive, rather than reactive, measure.
-
Engage with Existing Listed Assets: For assets already onboarded that lack an adequate bounty, Aave should engage with their respective teams to encourage the integration of a program that meets industry best practices.
-
Promote Comprehensive Coverage: Aave should advocate for bounty programs that are both financially sufficient and comprehensive in scope, covering all potential attack surfaces beyond just smart contracts.
By formalizing these expectations, Aave can ensure that the overall protocol security level is maintained and enhanced even as new assets are introduced.
6. Conclusion
To encourage more comprehensive security practices, we will be making a call to action for all asset issuers to either implement adequate bug bounty programs or improve existing ones in line with our market assessment. Bug bounties are a dynamic and indispensable tool for risk management in DeFi. As a market leader, the Aave protocol is uniquely positioned to champion higher security standards, thereby protecting its users and fostering a more secure and resilient ecosystem.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.