All smart contracts of pNetwork can be found at [https://github.com/provable-things](https://github.com/provable-things) and [https://github.com/pnetwork-association](https://github.com/pnetwork-association). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.


pNetwork is an open-source multi-chain routing protocol that enables the movement and interoperability of assets, NFTs and data across more than 15 blockchains. These cross-blockchain functionalities enable, for example, the release of “wrapped” tokens called pTokens that rely on maintaining a 1-to-1 peg in-between the native blockchain and the host blockchain (e.g.

Any governance voting result manipulation

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Miner-extractable value (MEV)

Protocol Insolvency

Ability to execute system commands

Extract Sensitive data/files from the server such as /etc/passwd

Taking Down the application/website

Stealing User Cookies

Bypassing Authentication

Signing transactions for other users

Redirection of user deposits and withdrawals

Wallet interaction modification resulting in financial loss

Subdomain takeover resulting in financial loss (applicable for subdomains with addresses published)

Tampering with transactions submitted to the user’s wallet

Direct theft of user funds

Submitting malicious transactions to an already-connected wallet

Theft of unclaimed yield

Temporary freezing of funds

Permanent freezing of unclaimed yield

Spoofing content on the target application (Persistent)

Subdomain Takeover without financial loss (applicable for subdomains with no addresses published)

Users Confidential information disclosure such as Email

Privilege escalation to access unauthorized functionalities

Smart contract unable to operate due to lack of token funds

Block stuffing for profit

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Unbounded gas consumption

Theft of gas

Changing details of other users without direct financial impact (CSRF)

Third-Party API keys leakage that demonstrates loss of funds or modification on the website

Redirecting users to malicious websites (Open Redirect)

Contract fails to deliver promised returns, but doesn't lose value

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

All web/app bug reports must come with a PoC in order to be considered for a reward.

Critical vulnerabilities are further capped at 10% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum of __USD 10 000__ for Critical bug reports. 

The following is a known issue that is considered as out of scope. There is an "unhandled exception" (which is on the list of vulnerabilities) in the ERC777; Namely that the ERC777 tokens received hook combined with a tag for automatic peg-in on sends can fail if the user ABI encodes the other information incorrectly. This will revert but with no reason because there's no way to catch the error to add a message.

pNetwork requires KYC to be done for all bug bounty hunters submitting Critical bug reports and wanting a reward. The information needed is an ID photo together with a selfie. Reports for other severity levels do not require any KYC. 

Payouts are handled by the __pNetwork__ team directly and are denominated in USD. However, payouts are done in __PNT__ or __USDC__, up to the discretion of the team.

pNetwork

Resources & Documentation