
Kinesis Bridge on Kadena
This bug bounty program focuses on the Kinesis Bridge, a cross-chain bridge that leverages the Hyperlane protocol. The program primarily covers the bridge's smart contract implementation, cross-chain messaging and validation system, and verification mechanisms for secure asset transfers and bridging operations between supported networks.
PoC Required
KYC required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Network not being able to confirm new transactions (total network shutdown)
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Unintended permanent chain split requiring hard fork (network partition requiring hard fork)
Permanent freezing of funds (fix requires hardfork)
Temporary freezing of funds
Theft of unclaimed yield
Temporary freezing of NFTs
Permanent freezing of unclaimed royalties
Block stuffing
Smart contract unable to operate due to lack of token funds
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Theft of gas
Out of scope
By submitting a Bug Report, as of the date of each such submission, each such Security Researcher hereby represents, warrants and confirms the following:
- Security Researcher has the legal right and authority to submit the Bug Report hereunder, and such submission does not, and will not, breach any agreement which Security Researcher is bound by or party to. The Bug Report is the original work of Security Researcher. Neither the Bug Report nor any element thereof will infringe upon or misappropriate any copyright, patent, trademark, trade secret, right of publicity or privacy, or any other proprietary right of any person, whether contractual, statutory or common law.
- Security Researcher (a) is knowledgeable about, has carefully considered the risks of and performed his, her or their own diligence, analysis and investigation, including consulting with Security Researcher’s legal, tax, financial and other professional advisors, on the technology and other risks associated with the Ecosystem, KDA, and Kadena, and (b) has obtained sufficient information about Kadena and KDA to reach an informed and knowledgeable decision in deciding to accept KDA as payment hereunder. Security Researcher is not relying upon any representation, warranty or agreement of Kadena, nor any of its subsidiaries or affiliates nor any other person. Security Researcher is able to bear all risk related to receiving KDA compensation, including fluctuations in the price of, and liquidity for, KDA. Security Researcher agrees to fully and strictly comply with all federal, state, local and foreign laws, rules and regulations applicable to the KDA received by Security Researcher hereunder, including any applicable securities laws governing any transfer of KDA or Security Researcher’s eligibility to receive KDA.
Miscellaneous Terms
Any KDA is provided on an "as is" basis, without warranties of any kind, either express or implied, including as to fitness for a particular purpose, value, or right or ability to use, trade, exchange or dispose of except in compliance with all applicable laws. Security Researcher’s relationship with Kadena is that of an independent contractor, and neither this Bug Bounty Program nor anything in these Kadena BBP Terms is intended to create, or should be construed as creating, any partnership, agency, joint venture or employment relationship between Kadena and any Security Researcher or any of Security Researcher’s employees, representatives or agents. Security Researcher is solely responsible for, and will file, on a timely basis, all tax returns and payments required to be filed with, or made to, any federal, state or local tax authority with respect to the receipt of any Research Fee(s) under this Bug Bounty Program. No waiver shall be effective unless it is in writing and signed by an authorized representative of Kadena. Any waiver by Kadena of any provision of these Terms shall not be construed as a waiver of any other provision, nor shall such waiver be deemed to be a continuing waiver unless otherwise expressly stated in writing. These Terms are entered into solely between, and may be enforced only by, such Security Researcher and Kadena, and will not be deemed to create any rights in third parties, or to create any obligations of a party to any such third parties. The headings contained in these Terms are included for purposes of convenience only, and do not affect the meaning or interpretation of these Terms. Unless otherwise expressly specified in these Terms: (i) the word “or” is not exclusive and is deemed to have the meaning “and/or”; (ii) words using the singular or plural number shall also include the plural or singular number, respectively; and (iii) all references to “dollars” or “$” will be deemed references to the lawful money of the United States of America.
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers