Exodus Movement, Inc., founded in 2015, develops the Exodus Wallet, a beautifully designed, non-custodial multi-asset software wallet available on desktop, mobile, and browser platforms that supports over 100,000 asset pairs while keeping users’ private keys encrypted and stored locally on their own devices.


Price manipulation results in the alteration of the perceived value of cryptocurrencies by either tampering with price feeds or tampering marketplace prices to acquire items at lower costs.

Execute arbitrary system commands

Retrieve sensitive data/files from a running server, such as:
- /etc/shadow
- database passwords
- blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Direct theft of user funds

Improperly disclosing confidential user information without any user interaction such as: Email address, Phone number, SSN, DOB

Subdomain takeover with already-connected wallet interaction

Taking state-modifying authenticated actions on behalf of other users without any interaction by that user, such as: Changing sensitive information, Deleting wallet, Displaying an attacker-controlled wallet address on user accounts as the designated deposit wallet

Injecting/modifying the static content on the target application with Javascript without unrealistic user interaction such as:  Initiating malicious transaction, Stealing secret phrase, Client side RCE, Retrieving sensitive information such as user’s email address, SSN

Changing sensitive details of other users (including modifying browser local storage) with up to one click of user interaction

Sitewide disruption of core services

Subdomain takeover without already-connected wallet interaction

Injecting/modifying the static content on the target application without Javascript such as: Stored/Reflected HTML, Loading external site data, Redirecting to malicious website (Without requiring user to manually enter website on the in-app browser)

Taking over broken or expired outgoing links

Bypass in-app passlock without bruteforcing or installing malicious app

Any impact involving a publicly released CVE related to In-App Browser and Wallet Connect

Codebase

Documentation

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). 

__Reward Calculation for Critical Level Reports__

For critical web/apps bugs, reports will be rewarded with Max Critical only if the impact leads to:

- A loss of funds involving an attack that does not require any user action
- Private key or private key generation leakage leading to unauthorized access to user funds 

All other impacts that would be classified as Critical would be rewarded a flat amount of minimum reward as per the table below. The rest of the severity levels are paid out according to the Impact in Scope table and according to the rewards table below per the asset that was impacted.  

Each of the assets have their own specific rewards which will be used instead of the reward table.
Here is the information formatted as a clean Markdown table:

| Asset                  | Low    | Medium | High   | Critical          |
| ---------------------- | ------ | ------ | ------ | ----------------- |
| Passkey Wallet         | $1,500 | $3,750 | $7,500 | $12,000 – $18,000 |
| `*.exodus.io`          | $300   | $1,125 | $3,750 | $7,500 – $10,000  |
| `*.exodus.com`         | $300   | $1,125 | $3,750 | $7,500 – $10,000  |
| Exodus Desktop Wallet  | $300   | $1,125 | $3,750 | $7,500 – $10,000  |
| `exodusmovement.ex...` | $300   | $1,125 | $3,750 | $7,500 – $10,000  |
| `*.a.exodus.io`        | $500   | $2,250 | $6,250 | $10,000 – $15,000 |

__Reward Payment Terms__

Payouts are handled by the Exodus team directly and are denominated in USD. However, payments are done in USDC on Ethereum.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.