Sei

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.

Reward Calculation for Critical Level Reports

For critical Blockchain/DLT bugs, the reward is dependent on the ratio between the funds at risk, which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com calculated at the time the bug report is submitted. However, a minimum reward of USD $50,000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

This ratio is known as the “risk ratio”, i.e.: Risk Ratio = Funds at Risk / Sei Foundation Market Cap

The reward is then calculated linearly from 0:1 to 1:1, where 1:1 results in a reward of USD $500,000. In the event of where the funds at risk are greater than the market cap, the maximum reward remains as the hard cap.

For critical Blockchain/DLT bugs w/ no funds affected, Sei Foundation will pay a flat rate of $50,000 USD per bug report. This flat rate will be applied to the following impacts:

• Network not being able to confirm new transactions (Total network shutdown)
• Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

For critical web/apps vulnerabilities, bug reports will be rewarded with USD $100,000, only if the impact leads to:

• A loss of funds involving an attack that does not require any user action at all
• Unauthorized minting of tokens on-chain
• Private key or private key generation leakage leading to unauthorized access to user funds

All other impacts that would be classified as Critical would be rewarded a flat amount of USD $25,000. The rest of the severity levels are paid out according to the Impact in Scope table.

Repeatable Attack Limitations

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 300 blocks the attack needs for subsequent attacks from the first attack, rounded down. For avoidance of doubt, if a second attack would happen at 600 blocks and then a third at 900 blocks, the funds at risk would be counted at 50% and 75% of the reward from the first attack, respectively.

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

Public Disclosure of Known Issues

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program.

• User Would Lose Control Of The Deposit Funds In Limit Order When Unsuccessful Orders Is Returned From The WASM Contract
• Project operation risk in tokenfactory and dex module

Previous Audits

Sei Foundation has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.

• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Cosmos%20v1.0.pdf
• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Tendermint%20v1.0.pdf
• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-19%20Audit%20Report%20-%20Sei%20Chain%20and%20CosmWasm%20v1.0.pdf
• https://drive.google.com/file/d/15yofPol25c05HrhR_MWGuIw01kJPvz1a/view

Proof of Concept (PoC) Requirements

A PoC is required for the following severity levels:

• Blockchain/DLT: Critical
• Blockchain/DLT: High
• Blockchain/DLT: Medium
• Blockchain/DLT: Low
• Web/App: Critical
• Web/App: High
• Web/App: Medium
• Web/App: Low

All PoCs submitted must comply with the Immunefi-wide PoC Guidelines and Rules. Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

For critical reports, we ask that whitehats support a PoC on a local 4-node cluster. You can follow these steps to provide this PoC:

• Spin up the local testnet with make docker-cluster-start
• Connect to node0 with docker exec -it sei-node-0 /bin/bash
• Carry out attack

Reward Payment Terms

Payouts are handled by the Sei Foundation team directly and are denominated in USD. However, payments are done in SEI.

SEI is used, it will be the average of closing price from coingecko over 5 days to determine the quantity of SEI to be given.