Backend Services hosted in AWS are out of scope unless there is a vulnerability that can lead to loss of client’s funds or something equivalent.

The GeroWallet Chrome Extension is in scope. However, anything else around the Google domain is not in scope. The link is only provided as a means to access the extension. 


GeroWallet is an all-in-one DeFi app designed to be a powerful instrument for experienced and new users alike. GeroWallet delivers a redefined UX by focusing on a user-centric design. Our product features a built-in multi-functional toolkit that boasts  swapping, liquidity lock, staking, dAPP connector and fiat on/off ramp functionality.

Execute arbitrary system commands which can then be used for attacks against user’s funds.

Retrieve sensitive data/files from a running server which can then be used for attacks against user’s funds.

Direct theft of user funds

Taking down the backend system (DDOS attacks not in scope)

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting, making trades, withdrawals, etc.

Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions

Rewards are distributed for critical vulnerabilities only, defined as vulnerabilities that lead __directly__ to a financial loss for users. 

All bug reports must come with a PoC demonstrating direct financial impact in order to be accepted.

Bug reports that do not contain a vulnerability that leads to a direct loss of funds are not accepted in this bug bounty program. Additionally, any vulnerability that involves social engineering is not in-scope. 

Payouts are handled by the __GeroWallet__ team directly and are denominated in USD. Payouts are done in __$GERO__.

GeroWallet

Resources & Documentation