Sei

Sei is the fastest Layer 1 blockchain, designed to scale with the industry.

For more information about Sei Foundation, please visit https://www.sei.io/.

Sei Foundation provides rewards in USDC. For more details about the payment process, please view the Rewards by Threat Level section further below.

Sei Foundation has a Know Your Customer (KYC) requirement for bug bounty payouts.

Please refer to the following for KYC requirements:

• Full Name
• Date of birth
• Proof of address (either a redacted bank statement with address or a recent utility bill)
• Copy of passport or other government issued ID

Responsible Publication

Sei Foundation adheres to category 2. This Policy determines what information whitehats are allowed to make public from their submitted bug reports. For more information about the category selected, please refer to our Responsible Publication page.

Primacy of Impact vs Primacy of Rules

Sei Foundation adheres to the Primacy of Impact for the following impacts:

• Web/App: Critical: Execute arbitrary system commands
• Web/App: Critical: Retrieve sensitive data/files from a running server such as:
  • /etc/shadow
  • database passwords
  • blockchain keys
• Web/App: Critical: Taking down the application/website
• Web/App: Critical: Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:
  • Changing registration information
  • Commenting
  • Voting
  • Making trades
  • Withdrawals, etc.
• Web/App: Critical: Subdomain takeover with already-connected wallet interaction
• Web/App: Critical: Direct theft of user funds
• Web/App: Critical: Malicious interactions with an already-connected wallet such as:
  • Modifying transaction arguments or parameters
  • Substituting contract addresses
  • Submitting malicious transactions

If an impact is covered within the Primacy of Impact, it means that even if the impacted asset is not in-scope but is owned by the project, then it would be considered as in-scope of the bug bounty program. When submitting a report, just select the Primacy of Impact asset placeholder. If the team behind this project has multiple projects, those other projects are not covered under the Primacy of Impact of this program. Instead, check if those other projects have a bug bounty program on Immunefi.

Testnet and mock files are not covered under the Primacy of Impact.

All other impacts are considered under the Primacy of Rules, which means that they are bound by the terms of the bug bounty program.

Sei Foundation adheres to the Primacy of Impact for the following severity levels:

• Blockchain/DLT: Critical

If a category’s severity level is covered within the Primacy of Impact, it means that even if the impacted asset is not in-scope but is owned by the project, then it would be considered as in-scope of the bug bounty program as long as it involves an impact under that respective severity level. When submitting a report, just select the Primacy of Impact asset placeholder. If the team behind this project has multiple projects, those other projects are not covered under the Primacy of Impact of this program. Instead, check if those other projects have a bug bounty program on Immunefi.

Testnet and mock files are not covered under the Primacy of Impact.

All other severity levels not listed here are considered under the Primacy of Rules, which means that they are bound by the terms of the bug bounty program.

Known Issue Assurance

Sei Foundation commits to providing Known Issue Assurance to bug submissions through their program. This means that Sei Foundation will either disclose known issues publicly or at the very least privately via a self-reported bug submission in order to allow for a more objective and streamlined mediation process to prove that an issue is known. Otherwise, assuming the bug report itself is valid, it would result in the bug report being considered in-scope and due 100% of the reward with respect to the bug bounty program terms.

Immunefi Standard Badge

Sei Foundation has satisfied the requirements for the Immunefi Standard Badge, which is given to projects that adhere to our best practices.

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.

Reward Calculation for Critical Level Reports

For critical Blockchain/DLT bugs, the reward is dependent on the ratio between the funds at risk, which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com calculated at the time the bug report is submitted. However, a minimum reward of USD $50,000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

This ratio is known as the “risk ratio”, i.e.: Risk Ratio = Funds at Risk / Sei Foundation Market Cap

The reward is then calculated linearly from 0:1 to 1:1, where 1:1 results in a reward of USD $2,000,000. In the event of where the funds at risk are greater than the market cap, the maximum reward remains as the hard cap.

For critical Blockchain/DLT bugs w/ no funds affected, Sei Foundation will pay a flat rate of $75,000 USD per bug report. This flat rate will be applied to the following impacts:

• Network not being able to confirm new transactions (Total network shutdown)
• Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

For critical web/apps vulnerabilities, bug reports will be rewarded with USD $100,000, only if the impact leads to:

• A loss of funds involving an attack that does not require any user action at all
• Unauthorized minting of tokens on-chain
• Private key or private key generation leakage leading to unauthorized access to user funds

All other impacts that would be classified as Critical would be rewarded a flat amount of USD $25,000. The rest of the severity levels are paid out according to the Impact in Scope table.

Repeatable Attack Limitations

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 300 blocks the attack needs for subsequent attacks from the first attack, rounded down. For avoidance of doubt, if a second attack would happen at 600 blocks and then a third at 900 blocks, the funds at risk would be counted at 50% and 75% of the reward from the first attack, respectively.

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

Restrictions on Security Researcher Eligibility

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:

• On OFACs SDN list
• Official contributor, both past or present
• Employees and/or individuals closely associated with the project
• Security auditors that directly or indirectly participated in the audit review

Public Disclosure of Known Issues

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program.

• User Would Lose Control Of The Deposit Funds In Limit Order When UnsuccessfulOrders Is Returned From The WASM Contract
• Project operation risk in tokenfactory and dex module

Previous Audits

Sei Foundation has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.

• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Cosmos%20v1.0.pdf
• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Tendermint%20v1.0.pdf
• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-19%20Audit%20Report%20-%20Sei%20Chain%20and%20CosmWasm%20v1.0.pdf
• https://drive.google.com/file/d/15yofPol25c05HrhR_MWGuIw01kJPvz1a/view

Feasibility Limitations

At Immunefi, we sometimes receive reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. If it’s obviously feasible, then it seems there are no questions about severity or payout amount. But if the bug report is less feasible, or not really feasible at all, suddenly questions arise.

Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what a Projects should or should not cite when downgrading a bug report’s impact, severity, and/or payout amount. These standards are continuously being developed and updated with help of the community and encompasses fair guidelines where the project clearly commits, and the security researcher can be assured that the project cannot arbitrarily downgrade the program based on theoretical counter measures, such as a chain rollback.

Proof of Concept (PoC) Requirements

A PoC is required for the following severity levels:

• Blockchain/DLT: Critical
• Blockchain/DLT: High
• Blockchain/DLT: Medium
• Blockchain/DLT: Low
• Web/App: Critical
• Web/App: High
• Web/App: Medium
• Web/App: Low

All PoCs submitted must comply with the Immunefi-wide PoC Guidelines and Rules. Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

Reward Payment Terms

Payouts are handled by the Sei Foundation team directly and are denominated in USD. However, payments are done in USDC.

All code of Sei Foundation can be found at https://github.com/sei-protocol. Documentation for the assets provided in the table can be found at https://github.com/sei-protocol/sei-chain/blob/main/whitepaper/Sei_Whitepaper.pdf

Unless explicitly listed, only pages of the web/app assets in addition to the direct link are considered in-scope of the bug bounty program. Other subdomains are not considered as in-scope. However, for subdomain takeovers that lead to an impact on the in-scope asset, please refer to our page about Reported Subdomain Takeovers.

These impacts are out of scope for this bug bounty program.

All Categories

• Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
• Impacts caused by attacks requiring access to leaked keys/credentials
• Impacts caused by attacks requiring access to privileged addresses (governance, strategist) except in such cases where the contracts are intended to have no privileged access to functions that make the attack possible
• Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
• Best practice recommendations
• Feature requests
• Impacts on test files and configuration files unless stated otherwise in the bug bounty program

Blockchain/DLT

• Incorrect data supplied by third party oracles (not to exclude oracle manipulation/flash loan attacks)
• Impacts requiring basic economic and governance attacks (e.g. 51% attack)
• Lack of liquidity impacts
• Impacts from Sybil attacks
• Impacts involving centralization risks
• Best practice recommendations

Web/App

• Theoretical impacts without any proof or demonstration
• Impacts involving attacks requiring physical access to the victim device
• Impacts involving attacks requiring access to the local network of the victim
• Reflected plain text injection (e.g. url parameters, path, etc.)
  • This does not exclude reflected HTML injection with or without JavaScript
  • This does not exclude persistent plain text injection
• Any impacts involving self-XSS
• Captcha bypass using OCR without impact demonstration
• CSRF with no state modifying security impact (e.g. logout CSRF)
• Impacts related to missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”) without demonstration of impact
• Server-side non-confidential information disclosure, such as IPs, server names, and most stack traces
• Impacts causing only the enumeration or confirmation of the existence of users or tenants
• Impacts caused by vulnerabilities requiring un-prompted, in-app user actions that are not part of the normal app workflows
• Lack of SSL/TLS best practices
• Impacts that only require DDoS
• UX and UI impacts that do not materially disrupt use of the platform
• Impacts primarily caused by browser/plugin defects
• Leakage of non sensitive API keys (e.g. Etherscan, Infura, Alchemy, etc.)
• Any vulnerability exploit requiring browser bugs for exploitation (e.g. CSP bypass)
• SPF/DMARC misconfigured records
• Missing HTTP Headers without demonstrated impact
• Automated scanner reports without demonstrated impact
• UI/UX best practice recommendations
• Non-future-proof NFT rendering