Ern maintains an active bug bounty program on Immunefi. The program has been live since March 3, 2026, and covers the smart contracts that govern deposits, yield accrual, and Bitcoin distribution on the Ern protocol.
About Immunefi
Immunefi is a security platform for DeFi protocols that facilitates bug bounty programs between projects and independent security researchers. The platform manages submission intake, triage, severity classification, and reward disbursement. Immunefi handles triage for the Ern program, meaning all incoming submissions are reviewed by Immunefi before being escalated to the Ern team.
Scope and rewards
The program covers five in-scope assets corresponding to Ern's core production contracts. Rewards are denominated in USD and paid in USDC on Ethereum. The maximum reward is $50,000, applicable to critical severity findings. High severity findings are eligible for rewards between $3,000 and $10,000. Medium severity findings receive a flat $2,000 reward. Low severity findings receive a flat $1,000 reward.
Proof of concept is required for all submissions regardless of severity. Testing must be conducted on local forks of mainnet or public testnets. Testing on live mainnet is not permitted under the program terms.
Relationship to existing audits
The contracts covered by the Immunefi program are the same contracts reviewed in the Halborn audit completed in February 2026 and the CREED audit completed in 2025. All audit reports are publicly available at github.com/ernorg/audits.
Contract immutability
The Ern contracts covered by this program are immutable and cannot be upgraded after deployment. Vulnerabilities identified through the program would require the deployment of new contracts to remediate. This is consistent with the broader protocol design, which does not include any upgrade mechanism or admin control over deployed contract logic.
Program details
The full program scope, eligibility criteria, and submission process are available at immunefi.com/bounty/ern