a16z-backed lending crypto protocol Compound Finance unveils $1m in bug bounty

Compound Finance has launched a $1 million bug bounty program on Immunefi to strengthen its protocol’s security.

Cryptocurrency lending protocol Compound Finance has introduced a bug bounty program offering rewards of up to $1 million, in partnership with Immunefi, to identify and address system vulnerabilities.

In a Medium blog announcement on Thursday, Dec. 12, Immunefi said the bug bounty program is open to security researchers who can find issues in the protocol. The blockchain security firm noted that the size of the reward depends on the severity of the bug, with critical bugs can earn up to $1 million, while lower-level issues are rewarded with smaller amounts, starting at $1,000

“All rewards are denominated in USD but paid in COMP tokens, reinforcing Compound’s commitment to a secure and transparent defi ecosystem.”

Immunefi

Founded in 2017 by Robert Leshner and Geoffrey Hayes, Compound Finance is a decentralized finance protocol that allows users to borrow and lend cryptocurrencies. The platform secured backing from such investors as Andreessen Horowitz (a16z), Bain Capital Ventures, and Polychain Capital. Compound is deployed across multiple blockchains, including Ethereum, Polygon, and Arbitrum.

In October 2023, a fork of Compound, called Onyx Protocol, was exploited due to a vulnerability in the code inherited from Compound. The attack exploited a known rounding error in the protocol’s design, which allowed attackers to drain $2.1 million from the system. However, Compound itself has not faced a direct exploit of this nature.