Immunefi
Contact Our Team
SolutionBy sector

Lending

Your deposits stay exposed long after the auditors leave

A bug bounty keeps independent researchers on the code that holds your deposits, and Managed Triage takes the noise off your engineers.

Contact our team

94% of bug bounty programs running five years or more on Immunefi have surfaced a confirmed critical

1 in 3 critical bugs found on lending bug bounty programs came a year or more after the program went live

149 critical bugs found and confirmed on lending bug bounty programs on Immunefi

99.3% of the reports our triage closed stayed closed after review

25 lending bug bounty programs run live on Immunefi, including Aave, Sky, Spark and Compound.

SolutionThree paths

Where is your team today?

  1. Path A

    Audited, with no bug bounty yet

    Your audits reviewed the code on the day they ran, and your deposits have sat in it every day since. A bug bounty keeps Immunefi's researchers looking at that code for as long as it holds funds.

    See why audited code stays a target

  2. Path B

    Running your own bounty, and drowning in reports

    Reports to Immunefi programs rose 135% in 2025. If yours land in a shared inbox, on a GitHub page or on another platform, moving the program to Immunefi puts Managed Triage in front of every report, so your engineers only see the reports that need their review. When millions are at stake, who's finding your criticals matters.

    See how Spark cut the reports reaching its team

  3. Path C

    Launching a new market, feature or version

    A new market, feature or version holds deposits from its first day. An audit competition puts hundreds of researchers on the new code before launch, and your bug bounty covers it once it is live.

    See how to review it before launch

Solution01/ 05Audited code

Code holding deposits stays a target, changed or not

Every market, collateral type, oracle or upgrade you add is new code holding deposits, and code you have not touched stays a target too.

Case study

Five reviews, then the bounty caught a critical

Alchemix, the self-repaying loans protocol, relaunched as V3 in April 2026 after five security reviews, one of them an Immunefi audit competition. In June, a researcher reported a critical bug in one of V3's vault strategies that put user funds at risk of theft. Immunefi's triage escalated it to Alchemix about three hours later, Alchemix confirmed it about two weeks after that, and the researcher was paid the program's top reward of nearly $300,000.

89% of reports to Alchemix were closed by our triage before they reached the team, in the 12 months to October 2026.

“Immunefi is always very responsive with any issues that pop up, and their triaging services have saved us hundreds of hours.”
Alchemix

Solution02/ 05Report noise

The critical report arrives buried in the rest

Valid reports are rising, and they now arrive among AI-written reports that look plausible at first read. Every one your engineers open is time away from shipping, and the critical one waits in the same pile as the rest.

Case study

85% fewer reports reaching Spark's engineers

Spark, the lending market of the Sky ecosystem, covers 188 assets on 10 chains. As AI-written reports grew, its team wrote to us:

“there is an uptick in submission spam likely due to AI… I'm getting multiple emails per day sometimes.”

Spark then started a trial of our highest level of Managed Triage, where each report is checked against Spark's code and only the reports that need the team's review reach it, each as a brief it can act on. After the trial, Spark made it the standard setup.

85% fewer reports reached Spark's team each month, comparing the three months after the change with the three months before.

When millions are at stake, who's finding your criticals matters.

Contact our team

Solution03/ 05Launching

New code is safest to review before it holds deposits

A new market, feature or version is code no one outside your team has tested. Find its bugs while they are still a code change, not an incident.

Run an audit competition before you launch

An audit competition is a crowdsourced audit: hundreds of researchers review the new code for a fixed window before launch. You set the scope, the reward pool and the dates, and your bug bounty covers the code from launch day.

One cross-chain lending market ran one on its new token-transfer contracts before they went live, and researchers found 3 high-severity bugs, one of which could have permanently frozen incoming transfers.

Tier-1 private audits found a critical in 1 of 6 engagements.

Immunefi audit competitions found one in more than 1 of 2.

Contact our team

Solution04/ 05How it works

You keep the decisions. We run the program.

You decide

  • what is in scope
  • the reward for each severity, and the rules behind it
  • which reports are valid, and what each one pays

Immunefi runs

  • the program launch and researcher outreach
  • Managed Triage, when you add it
  • mediation when a researcher disputes a decision
  • reward payouts

Rewards go in full to researchers, and you approve every one.

Solution05/ 05Questions

Questions lending teams ask

Q.01Is a bug bounty worth it at our stage?

The more you've built, the more you have to lose

Weigh the price against the deposits in your contracts. In 2024 and 2025, the average onchain hack took $24.5M, and the median bounty paid on Immunefi is about $20,000.

Q.02We built on audited code. Isn't that enough?

Balancer V2 was audited eleven times, then lost $128M

Attackers keep looking long after an audit ends. In November 2025, an attacker took $128M from Balancer V2, through a rounding bug in its pools. Your oracle setup, collateral and upgrades then add new code on top.

Q.03What if AI-written reports keep growing?

Managed Triage screens every report before you see it

It removes spam, duplicates and out-of-scope reports. At its highest level, it also checks each report against your code, known issues and documentation, verifies the claimed impact, runs the proof of concept where it can and proposes a severity, so your team gets a brief it can act on. 99.3% of the reports our triage closed stayed closed after review.

Q.04Can reports go into our own tools?

Yes

Webhooks send new reports and updates to Slack, or to any system that accepts JSON.

Q.05Who decides whether a report is valid?

Your team does

With Managed Triage, the reports that need your review are escalated to you. Your team decides which reports are valid and approves each reward. If a researcher disputes your decision, Immunefi mediates, and clear severity rules in your program help prevent disputes.

End of fileLendingSolution · By sector

Keep your deposits covered and your engineers free

Whether you are audited with no bounty yet, running your own and drowning in reports, or about to launch, we set up the program with you, launch it to our researchers, and Managed Triage takes the noise off your team.

If your priority is the lowest price, we're probably not the right fit. If it's protecting everything you've built, let's talk.

Contact our team
SolutionLendingContact our team