![CoW Protocol-logo](/_next/image/?url=https%3A%2F%2Fimages.ctfassets.net%2Ft3wqy70tc3bv%2F2SCCBIzc5z3ZxUhwhW1NSK%2Fc6616b0b6f3bbacfebd5a6ea18f929dd%2FCoW-Protocol-icon-circle-light-purple.png&w=128&q=75)
CoW Protocol
The CoW team, for and on behalf of and at the expense of CoW DAO, is running a bug bounty program focused on CoW Protocol, a fully permissionless protocol that leverages batch auctions to provide MEV protection, plus integrates with on-chain liquidity sources to offer traders the best prices.
PoC required
Resources & Documentation
We only accept reports for issues that can be reproduced in the smart contracts deployed at the following addresses: 0x9008d19f58aabd9ed0d60971565aa8510560ab41
-
Ethereum: https://etherscan.io/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41#code
-
Gnosis Chain: https://gnosis.blockscout.com/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41?tab=contract 0x9e7ae8bdba9aa346739792d219a808884996db67
-
Ethereum: https://etherscan.io/address/0x9e7ae8bdba9aa346739792d219a808884996db67#code
-
Gnosis Chain: https://gnosis.blockscout.com/address/0x9e7ae8bdba9aa346739792d219a808884996db67?tab=contract 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110
-
Ethereum: https://etherscan.io/address/0xc92e8bdf79f0507f65a392b0ab4667716bfe0110#code
-
Gnosis Chain: https://gnosis.blockscout.com/address/0xc92e8bdf79f0507f65a392b0ab4667716bfe0110?tab=contract 0x2c4c28ddbdac9c5e7055b4c863b72ea0149d8afe
-
Ethereum: https://etherscan.io/address/0x2c4c28ddbdac9c5e7055b4c863b72ea0149d8afe#code
-
Gnosis Chain: https://gnosis.blockscout.com/address/0x2c4c28ddbdac9c5e7055b4c863b72ea0149d8afe?tab=contract
This corresponds to commit 6ebbd810ff2da635fb6f88e9a15fde196f8c852a in the official repository.
For the Initializable, ReentrancyGuard, SafeCast, SafeMath, IERC20, and IVault smart contracts, this bug bounty program only accepts bug reports for the changes that were performed compared to the original, as well as any improper use of them that leads to actual issues in the contracts previously mentioned to be in scope. Any bug that is reproducible in the original vendored contract is out of scope.
Any vulnerabilities mentioned in this audit report are considered as out-of-scope.