Bug Bounty and Audits
Security at Curvance
Curvance uses code review, automated testing, independent audits, and a public bug bounty to reduce smart contract risk. These measures do not guarantee that the protocol is free from vulnerabilities.
Smart Contract Bug Bounty
Curvance rewards the first complete, reproducible report of a previously unknown vulnerability that affects an in-scope deployed smart contract and produces an in-scope impact. A report must satisfy both requirements. A suspicious code pattern, tool warning, or hypothetical concern without a reachable production path is not eligible for a bounty.
Assets in scope
Only Curvance contracts with a populated Monad mainnet address on the Monad Contract Addresses page and currently in active use are in scope. Blank or placeholder entries, undeployed source, test or mock contracts, and deprecated or inactive deployments are out of scope.
The following are not in scope unless Curvance lists them expressly:
Undeployed source code, development branches, tests, mocks, fixtures, and configuration files
Deprecated contracts that no longer hold funds or affect active positions
Contracts on unsupported chains or addresses absent from the bounty scope
Third-party tokens, protocols, bridges, or oracle infrastructure, unless a flaw in Curvance’s integration produces an in-scope impact on a listed Curvance contract
The website, application, API, and other offchain systems under this smart contract bounty. Reports about those systems may still be sent through the responsible disclosure channel.
Impacts in scope
A report must demonstrate at least one of the following:
Direct theft or irreversible loss of user or protocol funds
Protocol insolvency or unbacked debt
Permanent freezing of funds
A material temporary freeze of withdrawals, repayments, liquidations, or another core protocol operation
Unauthorized minting, burning, transfer, or modification of protocol-accounted assets
A bypass of collateral, pricing, borrowing, repayment, or liquidation controls that produces one of the impacts above
The presence or absence of a modifier, security pattern, or best-practice control is not an impact by itself.
Required report contents
Every report must include:
Exact target: Chain, deployed contract address, affected function, and source commit or verified implementation.
Attacker model: Required permissions, starting balances, collateral, approvals, and external dependencies.
Complete attack path: Every call in order, including callbacks, repayments, fees, debt creation, collateral changes, and liquidation steps.
Violated invariant: The property that should hold and the before-and-after state proving that it fails.
Net impact: Attacker profit and protocol or user loss after subtracting required capital, fees, repayments, collateral, and recorded debt. Gross borrowed funds are not profit.
Reproduction: A deterministic test against the source corresponding to the in-scope deployed implementation, or a local fork of that deployment, with the command needed to run it and the expected result.
Trace evidence: Relevant call trace, state changes, balances, and assertion output.
Curvance is not responsible for inferring a missing attack path, repairing a broken proof of concept, or adapting a mock that changes the target’s repayment, authorization, accounting, oracle, or market-manager behavior.
Proofs of concept must run locally. Do not test an exploit against mainnet or a public testnet.
Automated tools and AI may assist research, but their output is not evidence. Scanner or model output that does not satisfy the requirements above will be closed as incomplete.
Safe submission format
Send the report in the email body as plain text. Do not send executables, macros, disk images, installers, or compressed, encrypted, or password-protected archives. If the minimal source is too long for email, request an approved transfer channel before sending it.
Do not include private keys, credentials, personal data, or data taken from users.
Out of scope and ineligible reports
The following are not eligible for a bounty:
Known issues, previously reported issues, and findings already documented in an audit
Multiple reports sharing the same root cause when one code change resolves them
Theoretical attacks without a reproducible production path and in-scope impact
Best-practice recommendations, code-quality observations, gas optimizations, style issues, and feature requests
Expected rounding, dust, rate movement, liquidation, or other documented economic behavior without demonstrated loss
Actions available to governance or administrators within their documented authority
Attacks requiring compromised private keys, leaked credentials, malicious governance approval, phishing, or social engineering
External asset depegs, incorrect third-party data, or lack of market liquidity unless the reporter demonstrates a Curvance vulnerability that causes an in-scope impact
Reports that rely on causing damage to users, disrupting production systems, or generating excessive traffic
Repeated restatements of a closed report without new reproducible evidence
Eligibility and disclosure
The first eligible reporter is the first person to submit a complete, reproducible report of the distinct root cause, not the first person to send a placeholder or unsupported allegation.
Do not exploit the issue against live contracts, access another person’s data, or move funds that you do not own. Keep the report confidential until Curvance confirms remediation or agrees to a disclosure date in writing.
Curvance will determine whether the report is in scope, whether the issue is reproducible, its severity, and the final reward. The reporter’s proposed severity is not binding. Curvance will explain the technical basis when closing a report as invalid, incomplete, out of scope, known, or duplicate.
A closed report will be reopened only when new evidence changes the attack path, production reach, violated invariant, or demonstrated impact.
Rewards
Critical
$250,000
High
$50,000
Medium
$5,000
Low or Informational
No guaranteed reward
Rewards depend on confirmed impact, funds at risk, exploitability, required attacker capital, and report quality. Reports that do not meet the program requirements are not eligible for payment.
Submit reports to [email protected].
Audits
Audits reduce risk; they do not guarantee that a protocol has no vulnerabilities. Public Curvance reports are available in the curvance-contracts audit directory:
TrustSec Audit 2, November 22, 2025
TrustSec Audit 1, October 17, 2025
Sherlock Audit, September 29, 2025
Trail of Bits Audit, May 23, 2025
Cantina Public Audit, April 16, 2025
Trail of Bits Invariant Development, March 13, 2024
Last updated
Was this helpful?
