Mirror Vulnerability Disclosure

generated: '2026-07-20'
method: searched
probe: true
source: https://docs.mirror.finance/security
policy: [https://docs.mirror.finance/security]
contact: [security@mirror.finance]
bug_bounty:
  self_managed: true
  reward_range_usd: "500 - 150000"
  determination: Reward severity/exploitability assessed at Mirror's sole discretion.
  historical_platform: >-
    Mirror also announced an Immunefi-hosted bounty (up to $100,000) in late 2021;
    the canonical published policy at docs.mirror.finance/security describes a
    self-managed program with a $500-$150,000 range.
scope:
  in_scope:
    - Vulnerabilities affecting the on-chain Mirror Protocol deployed to Terra Mainnet (contract addresses listed in the developer documentation).
    - Vulnerabilities in the Mirror interface that could result in exploitation of user accounts (secondary scope).
  out_of_scope:
    - Third-party contracts built on top of the protocol.
    - Vulnerabilities requiring ownership of an admin key.
    - Test contracts and staging servers (Tequila and other testnets) unless they also affect mainnet protocol/interface or risk user funds.
submission: >-
  Disclosures to security@mirror.finance with clear, concise reproduction steps
  in written or video format.
evidence:
  - {source: https://docs.mirror.finance/security, kind: security-policy-page}
  - {source: https://raw.githubusercontent.com/Mirror-Protocol/docs/master/security.md, kind: security-policy-source}