In the DeFi world, even the smallest vulnerability can trigger millions in losses. Just recently, [Hydration awarded a 22 million in potential damage — a timely fix that safeguarded both the protocol and user funds.
At Bifrost, we understand that security is the sword of Damocles hanging over every DeFi protocol, and that whitehats are the indispensable guardians of this decentralized world. That’s why we’re launching a new bounty program — offering up to $500,000 for anyone who can find a protocol-level flaw before it’s too late.
If you can find a vulnerability that allows someone to illegitimately increase the supply of any vToken (e.g., vDOT, vMANTA, vBNC, etc.) without staking or collateral input — you could earn up to $500,000 in a single payout.
This is part of our Immunefi bug bounty, designed to uncover the deepest, most dangerous risks in the Bifrost protocol — before malicious actors do.
vTokens like vDOT and vBNC represent real, staked capital. Their minting is tightly controlled through validator participation, staking queues, and reward distribution.
This bounty program focused on:
| Severity | Reward (Up to) | Description |
|---|---|---|
| 🟥 Critical | $500,000 | Unauthorized vToken minting (vDOT, vKSM, etc.), chain halt, or permanent fund freeze |
| 🟧 High | $25,000 | Chain splits, RPC crashes, mempool abuse |
| 🟨 Medium | $10,000 | Node shutdowns, resource exhaustion |
| 🟩 Low | $1,000 | Fee miscalculations, partial disruption |
| Severity | Reward (Up to) | Description |
|---|---|---|
| 🟥 Critical | $5,000 | Wallet exploit, unauthorized withdrawals, full server access |
| 🟧 High | $2,000 | Subdomain takeover, HTML injection, private info leaks |
| 🟨 Medium | $1,000 | Redirects, non-sensitive user manipulation |
| 🟩 Low | $500 | Broken links, minor UI abuse |
Please check the full scope on Immunefi
Code is law — until it’s not. And in a world where billions move across trustless bridges, where staking powers ecosystems, and where a single vulnerability can unravel everything, we’re not leaving anything to chance. That’s why we’re offering up to $500,000 for a single critical discovery, and inviting the smartest minds in Web3 to test the very foundations of our protocol before the wrong person ever gets the chance.
