Sei

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.

Reward Calculation for Critical Level Reports

For critical Blockchain/DLT bugs, the reward is dependent on the ratio between the funds at risk, which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com calculated at the time the bug report is submitted. However, a minimum reward of USD $50,000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

This ratio is known as the “risk ratio”, i.e.: Risk Ratio = Funds at Risk / Sei Foundation Market Cap

The reward is then calculated linearly from 0:1 to 1:1, where 1:1 results in a reward of USD $1,000,000. In the event of where the funds at risk are greater than the market cap, the maximum reward remains as the hard cap.

For critical Blockchain/DLT bugs w/ no funds affected, Sei Foundation will pay a flat rate of $75,000 USD per bug report. This flat rate will be applied to the following impacts:

• Network not being able to confirm new transactions (Total network shutdown)
• Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

For critical web/apps vulnerabilities, bug reports will be rewarded with USD $100,000, only if the impact leads to:

• A loss of funds involving an attack that does not require any user action at all
• Unauthorized minting of tokens on-chain
• Private key or private key generation leakage leading to unauthorized access to user funds

All other impacts that would be classified as Critical would be rewarded a flat amount of USD $25,000. The rest of the severity levels are paid out according to the Impact in Scope table.

Repeatable Attack Limitations

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 300 blocks the attack needs for subsequent attacks from the first attack, rounded down. For avoidance of doubt, if a second attack would happen at 600 blocks and then a third at 900 blocks, the funds at risk would be counted at 50% and 75% of the reward from the first attack, respectively.

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

Restrictions on Security Researcher Eligibility

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:

• On OFACs SDN list
• Official contributor, both past or present
• Employees and/or individuals closely associated with the project
• Security auditors that directly or indirectly participated in the audit review

Public Disclosure of Known Issues

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program.

• User Would Lose Control Of The Deposit Funds In Limit Order When UnsuccessfulOrders Is Returned From The WASM Contract
• Project operation risk in tokenfactory and dex module

Previous Audits

Sei Foundation has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.

• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Cosmos%20v1.0.pdf
• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Tendermint%20v1.0.pdf
• https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-19%20Audit%20Report%20-%20Sei%20Chain%20and%20CosmWasm%20v1.0.pdf
• https://drive.google.com/file/d/15yofPol25c05HrhR_MWGuIw01kJPvz1a/view

Feasibility Limitations

At Immunefi, we sometimes receive reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. If it’s obviously feasible, then it seems there are no questions about severity or payout amount. But if the bug report is less feasible, or not really feasible at all, suddenly questions arise.

Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what a Projects should or should not cite when downgrading a bug report’s impact, severity, and/or payout amount. These standards are continuously being developed and updated with help of the community and encompasses fair guidelines where the project clearly commits, and the security researcher can be assured that the project cannot arbitrarily downgrade the program based on theoretical counter measures, such as a chain rollback.

Proof of Concept (PoC) Requirements

A PoC is required for the following severity levels:

• Blockchain/DLT: Critical
• Blockchain/DLT: High
• Blockchain/DLT: Medium
• Blockchain/DLT: Low
• Web/App: Critical
• Web/App: High
• Web/App: Medium
• Web/App: Low

All PoCs submitted must comply with the Immunefi-wide PoC Guidelines and Rules. Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

Reward Payment Terms

Payouts are handled by the Sei Foundation team directly and are denominated in USD. However, payments are done in SEI.

SEI is used, it will be the average of closing price from coingecko over 5 days to determine the quantity of SEI to be given.