Integral

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, admin, owners of contracts, etc.)
• Attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
• Attacks on test files and configuration files unless stated otherwise in the bug bounty program
• Incorrect data supplied by third party oracles
• Manipulation and flash loan attacks on third-party oracles
• Loss of slippage through sandwich attacks.
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty

Eligibility

To be eligible for a reward under this Program, you must:

• Be the first to disclose the unique vulnerability in compliance with the disclosure requirements above.
• Provide sufficient information to enable our team to reproduce and fix the vulnerability.
• Not engage in any unlawful conduct when disclosing the bug including through threats, demands, or any other coercive tactics.
• Make a good faith effort to avoid privacy violations, destruction of data, interruption or degradation of Integral.
• Submit only one vulnerability per submission, unless you need to chain vulnerabilities to provide impact regarding any of the vulnerabilities.
• Not submit a vulnerability caused by an underlying issue that is the same as an issue on which a reward has been paid under this Program.
• Be at least 18 years of age.
• Not be subject to US, UK, and EU sanctions or reside in a US, UK, or EU-embargoed country.
• Comply with all the eligibility and disclosure requirements of the Program.
• The vulnerability must not already be known by the Integral team.