Wormhole

Please note that for any valid Critical severity reports, the maximum reward will be up to $5,000,000 USD, paid in W token, with the following tiers:

• Tier 1: Ability to Extract the TVL of all chains: Up to $5,000,000 in W
• Tier 2: Ability to Extract the TVL of a single chain: Up to $2,500,000 in W
• Tier 3: Ability to permanently deny access to the TVL of one or many chains: Up to $1,250,000 in W

All rewards are decided on a case-by-case basis, taking into account the bug's exploitability, the feasibility of the exploit scenario, the impact it causes, and the likelihood of the vulnerability presenting itself, particularly if it is nondeterministic or some of the conditions are not present at the time.

Because of the governor, rewards for critical vulnerabilities are further capped at 10% of extractable value during a 24-hour period. The Governor (https://github.com/wormhole-foundation/wormhole/tree/main/node/pkg/governor) is designed to limit the value that can be transferred out of one chain over time. Rewards for vulnerabilities resulting in the perpetual locking of funds are further capped at the lesser of 1% of destroyable value or $1,250,000 in W. Rewards for critical vulnerabilities relating to NFTs are further capped at $20,000 in W.

Value is calculated based on the current market value and available liquidity for widely used tokens in the Portal Token Bridge, such as ETH and SOL.

In cases where the report achieves more than one of the above objectives, rewards will be tiered to the higher of the two objectives and will not be aggregated (e.g., if you can extract and brick a complete TVL for a chain, you will be awarded a bounty as if you could only extract the complete TVL for that chain).

Rewards for bugs in dependencies and third-party code are at the discretion of the Wormhole team and will be based on the impact demonstrated on Wormhole. If the dependency has its own bug bounty program, your reward for submitting this vulnerability to Wormhole will be lowered by the expected payout of that other program. If the vulnerability is in a connected blockchain rather than the Wormhole code, the locked and wrapped assets on that chain are not included in the impact calculation.

Vulnerabilities known to the Wormhole team at the time of reporting are ineligible for reward. This includes external audit reports, vulnerabilities in Wormhole's dependencies that have been disclosed publicly, and internal company communications. If necessary, the program will provide proof of prior knowledge about the issue.

Wormhole Foundation will maintain full discretion on vulnerability payouts. We encourage bug reporters to submit issues outside of the above-mentioned payout structure, though we want to be clear that we’ll exercise discretion on a case-by-case basis regarding whether an issue warrants a payout and what that ultimate payout would be.