Kamino-logo

Kamino

|

Kamino is a first-of-its-kind DeFi protocol that unifies Lending, Liquidity, and Leverage into a single, secure DeFi product suite.

Solana
Defi
Lending
Maximum Bounty
$1,500,000
Live Since
06 October 2025
Last Updated
06 October 2025
  • Triaged by Immunefi

  • PoC Required

  • KYC required

Select the category you'd like to explore

Assets in Scope

Target
Type
Websites and Applications - Kamino App
Added on
6 October 2025
Target
Type
Smart Contract - KFarms - Kamino Farms Program
Added on
6 October 2025
Target
Type
Smart Contract - KLend - Kamino Lending Program
Added on
6 October 2025
Target
Type
Smart Contract - Kvault - Kamino Lending Vault Program
Added on
6 October 2025
Target
Type
Smart Contract - Kamino's Price Oracle Aggregator
Added on
6 October 2025
Target
Type
Smart Contract - Kamino's Price Oracle Aggregator - Adrena's Perp Interface
Added on
6 October 2025
Target
Type
Smart Contract - Kamino Liquidity Program
Added on
6 October 2025
Target
Type
Smart Contract - Kamino's Price Oracle Aggregator - Securitize's Interface
Added on
6 October 2025
Target
Type
Smart Contract - Kamino Farms Program - KFarms
Added on
6 October 2025
Target
Type
Smart Contract - Kamino's Price Oracle Aggregator - Onchain program
Added on
6 October 2025
Target
Type
Smart Contract - Kamino Lending Program - KLend
Added on
6 October 2025
Target
Type
Smart Contract - Kamino Lending Vault Program - KVault
Added on
6 October 2025

Impacts in Scope

Severity
Critical
Title

Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Severity
Critical
Title

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Severity
Critical
Title

Permanent freezing of funds

Severity
Critical
Title

Protocol insolvency

Severity
Critical
Title

Execute arbitrary system commands

Severity
Critical
Title

Retrieve sensitive data/files from a running server, such as:

  • /etc/shadow
  • database passwords
  • blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)
Severity
Critical
Title

Taking down the application/website

Severity
Critical
Title

Taking and/modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:

  • Changing registration information
  • Commenting
  • Voting
  • Making trades
  • Withdrawals, etc.
Severity
Critical
Title

Subdomain takeover with already-connected wallet interaction

Severity
Critical
Title

Direct theft of user funds

Severity
Critical
Title

Malicious interactions with an already-connected wallet, such as:

  • Modifying transaction arguments or parameters
  • Substituting contract addresses
  • Submitting malicious transactions
Severity
High
Title

Theft of unclaimed yield

Out of scope

Program's Out of Scope information
  • Token 22 issues that do not result in irrecoverable loss of funds. As there are many combinations of t22 with configurations that can change over time by their admin, the smart contract admin (of the market instance, the vault instance, the limit orders, etc) is willingly taking the risk of onboarding tokens with extensions.
  • Vulnerabilities requiring the user to manipulate supply and borrow levels to disturb borrow and supply interest rates
  • Vulnerabilities resulting in loss of fees for the protocol (e.g. bypassing origination, flash borrow fees, etc.)
  • Vulnerabilities related to issues with referral fees (e.g. deadlock or DoS) as referral fees are fully disabled on mainnet and there are no plans to reenable them
  • Vulnerabilities related to issues triggered by the underlying infrastructure (e.g. Solana outages, RPC issues, etc.)
  • Bugs in dependencies — please take them upstream
Default Out of Scope and rules

Smart Contract specific

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Impacts requiring basic economic and governance attacks (e.g. 51% attack)
  • Lack of liquidity impacts
  • Impacts from Sybil attacks
  • Impacts involving centralization risks

All categories

  • Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
  • Impacts caused by attacks requiring access to leaked keys/credentials
  • Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
  • Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
  • Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
  • Best practice recommendations
  • Feature requests
  • Impacts on test files and configuration files unless stated otherwise in the bug bounty program
  • Impacts requiring phishing or other social engineering attacks against project's employees and/or customers