Skip to main content
Drift Protocol prioritizes security through audits, testing, and a bug bounty program.

​
Bug Bounty Program

Drift offers bug bounties for on-chain program code vulnerabilities:
SeverityDescriptionBounty
CriticalFunds drainage or theft without signaturesUp to $500,000
HighFunds freezing or incorrect value assignment10,000−10,000 - 50,000
Medium/LowOther bugs not threatening funds1,000−1,000 - 5,000

​
Submission

Email hello@drift.trade with:
  • Detailed attack vector description
  • Proof of concept (for critical/high severity)
  • Steps to reproduce
Response within 1 business day.

​
Payment

Bug bounties are paid in USDC. Alternative payment methods case-by-case.

​
Out of Scope

  • Already exploited attacks
  • Leaked credentials
  • Privileged address access
  • Oracle data issues (except manipulation attacks)
  • Liquidity issues
  • Third-party bot errors
  • Social engineering
  • DoS attacks
  • Violating Immunefi rules

​
Security Best Practices

The protocol uses oracle guard rails to prevent manipulation:
  • Price staleness checks
  • Confidence interval limits
  • Mark/oracle divergence limits
  • TWAP for manipulation resistance
Size-based margin scaling prevents excessive leverage on large positions.
Per-market position limits prevent market concentration risk.
Progressive liquidation system protects against cascading liquidations.

​
Audits

Drift has been audited by multiple security firms. See AUDIT.md in the repository for details.

​
Severity Classification

Based on Immunefi’s classification system:
  • Critical: Contract drainage, fund theft, permanent freezing
  • High: Temporary freezing, incorrect value assignment
  • Medium/Low: Non-fund-threatening bugs

​
Contact

Do not publicly disclose vulnerabilities before reporting them to the team.

Architecture

Program architecture overview

Bug Bounty Details

Full bug bounty information

Build docs developers (and LLMs) love

Get started for freeTalk to us