Bug Bounty Payouts and Responsible Disclosure Log

Program is hosted on Immunefi with defined scope for core DSS contracts, governance spells, and oracle infrastructure.

Security researchers, whitehats, and protocol engineers.

Review the official Immunefi page for current scope, rules, and reward tiers before submitting.

Core smart contracts including Vat, Dog, Clipper, PSM, End, and governance modules. Specific contract addresses are listed on the Immunefi page.

Auditors, integration engineers, and security teams forking or building on DSS.

Cross-reference deployed contract addresses with the bounty scope to ensure coverage of your integration surface.

Payouts are determined by vulnerability severity (Critical, High, Medium) and asset impact, with rewards paid in DAI or USDS.

Security researchers evaluating ROI of engagement.

Consult the published payout matrix on Immunefi for specific reward ranges; do not assume amounts for any severity class.

Responsible disclosure is required. Public disclosure before a fix is deployed and an executive vote has passed is prohibited.

All researchers and external security teams.

Coordinate with the protocol security team via Immunefi. Do not disclose findings on social media or in public forums before remediation.

KYC may be required for large payouts, consistent with Immunefi's standard terms.

Researchers expecting significant bounties.

Be prepared to complete KYC verification to receive rewards above a certain threshold; verify the current threshold on the program page.

The program has paid out for critical vulnerabilities in core contracts, auction mechanisms, and oracle logic. Specific amounts and vectors are logged.

Risk teams and integrators modeling residual protocol risk.

Review the historical payout log to understand the types of vulnerabilities that have been found and fixed in the codebase you depend on.

Frontend bugs, phishing sites, and vulnerabilities in third-party applications not directly controlled by MakerDAO/Sky governance are typically out of scope.

Wallet teams, frontend developers, and ecosystem app builders.

Verify your finding is in scope before investing time. Out-of-scope issues should be reported to the relevant application team directly.

Validated critical vulnerabilities are patched via a spell crafted by the protocol engineering team and executed through the standard governance process.

Governance delegates, spell crafters, and security council members.

Monitor executive vote calendars for emergency spells related to vulnerability remediation and verify the proposed fix independently.

Logic errors in core accounting, rate accumulation, or settlement that could lead to fund loss or system insolvency.

Vault operators, keepers, exchanges, custody providers, governance spell crafters.

Review audit reports and disclosed vulnerabilities for forked codebases; verify deployed contract versions against the canonical executive vote history.

Malformed calldata, delegatecall misuse, or timing attacks on the Governance Security Module delay that could hijack the upgrade path.

Governance delegates, spell crafters, security reviewers, and any protocol integrating MKR/SKY governance contracts.

Independently verify spell payloads before voting; simulate execution on a fork to validate state transitions; monitor the GSM delay for anomalous scheduling.

Stale prices, manipulated feed values, or compromised oracle nodes leading to incorrect liquidation triggers or bad debt.

Oracle node operators, vault operators, lending protocols consuming Maker price feeds, risk teams.

Validate feed diversity and quorum logic; monitor for stale price events; verify the current oracle security parameters against governance decisions.

Grifting attacks, incorrect tau or buf calculations, and edge cases in the take function allowing keeper profit at the protocol's expense.

Keeper operators, vault operators, protocols forking or integrating Maker liquidation logic.

Audit auction parameter configurations; simulate auction behavior under extreme market conditions; monitor for anomalous keeper profitability.

Rounding errors, fee-on-transfer token incompatibilities, and reentrancy-like risks during high-volume minting and burning.

Exchanges, aggregators, DeFi protocols integrating directly with the PSM for DAI/USDS minting and redemption.

Verify token compatibility before PSM integration; review disclosed rounding and reentrancy vectors; test edge cases with large swap amounts.

Manipulation of pricing for composable assets like stETH or wrapped tokens, leading to undercollateralized borrowing.

Risk teams evaluating collateral onboarding, protocols issuing derivative assets used as Maker collateral.

Assess the pricing methodology for complex collateral types; monitor for governance decisions to offboard or adjust risk parameters for derivative tokens.

Fake frontends requesting proxy approvals or malicious governance vote signatures targeting vault owners and MKR/SKY holders.

Vault operators, governance participants, wallet integration teams.

Verify frontend URLs and contract addresses independently; simulate transaction payloads before signing; monitor for indicators of compromise in governance tooling dependencies.

Compromised dependencies in governance frontends or voting tools creating risk of malicious transaction signing.

MKR/SKY delegates, large token holders, teams building governance tooling.

Verify transaction payloads independently before signing; audit dependency supply chains for governance interfaces; use hardware wallets for high-value governance actions.