All code of Sei Foundation can be found at https://github.com/sei-protocol. Documentation for the assets provided in the table can be found at [https://github.com/sei-protocol/sei-chain/blob/main/whitepaper/Sei_Whitepaper.pdf](https://github.com/sei-protocol/sei-chain/blob/main/whitepaper/Sei_Whitepaper.pdf)

Unless explicitly listed, only pages of the web/app assets in addition to the direct link are considered in-scope of the bug bounty program. Other subdomains are not considered as in-scope. However, for subdomain takeovers that lead to an impact on the in-scope asset, please refer to our page about [Reported Subdomain Takeovers.](https://immunefisupport.zendesk.com/hc/en-us/articles/14352199704593-Reported-Subdomain-Takeovers)

Sei is the fastest Layer 1 blockchain, designed to scale with the industry. Pushing the boundaries of blockchain technology through open source development, Sei stands to unlock a brand new design space for consumer facing applications.

Network not being able to confirm new transactions (Total network shutdown)

Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hard fork)

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as: /etc/shadow, database passwords, blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the application/website

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Changing registration information, Commenting, Voting, Making trades, Withdrawals, etc.

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as: Modifying transaction arguments or parameters, Substituting contract addresses, Submitting malicious transactions

Direct theft of user NFTs

Injection of malicious HTML or XSS through NFT metadata

Unintended chain split (Network partition)

Temporary freezing of network transactions by delaying one block by 500% or more of the average block time of the preceding 24 hours beyond standard difficulty adjustments

Causing network processing nodes to process transactions from the mempool beyond set parameters

RPC API crash affecting projects with greater than or equal to 25% of the market capitalization on top of the respective layer

Injecting/modifying the static content on the target application without Javascript (Persistent) such as: HTML injection without Javascript, Replacing existing text with arbitrary text, Arbitrary file uploads, etc.

Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as: Email or password of the victim, etc.

Improperly disclosing confidential user information such as: Email address, Phone number, Physical address, etc.

Subdomain takeover without already-connected wallet interaction

Increasing network processing node resource consumption by at least 30% without brute force actions, compared to the preceding 24 hours

Shutdown of greater than or equal to 30% of network processing nodes without brute force actions, but does not shut down the network

A bug in the respective layer 0/1/2 network code that results in unintended smart contract behavior with no concrete funds at direct risk

Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as: Changing the name of user, Enabling/disabling notifications

Injecting/modifying the static content on the target application without Javascript (Reflected) such as: Reflected HTML injection, Loading external site data

Redirecting users to malicious websites (Open Redirect)

Shutdown of greater than 10% or equal to but less than 30% of network processing nodes without brute force actions, but does not shut down the network

Modification of transaction fees outside of design parameters

Changing details of other users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction such as: Iframing leading to modifying the backend/browser state (demonstrate impact with PoC)

Taking over broken or expired outgoing links such as: Social media handles, etc.

Temporarily disabling user to access target site, such as: Locking up the victim from login, Cookie bombing, etc.

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Reward Calculation for Critical Level Reports__

For critical Blockchain/DLT bugs, the reward is dependent on the ratio between the funds at risk,  which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com calculated at the time the bug report is submitted. However, a minimum reward of USD $50,000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

This ratio is known as the “risk ratio”, i.e.: Risk Ratio = Funds at Risk / Sei Foundation Market Cap

The reward is then calculated linearly from 0:1 to 1:1, where 1:1 results in a reward of USD $500,000. In the event of where the funds at risk are greater than the market cap, the maximum reward remains as the hard cap.

For critical Blockchain/DLT bugs w/ no funds affected, Sei Foundation will pay a flat rate of $50,000 USD per bug report. This flat rate will be applied to the following impacts:
- Network not being able to confirm new transactions (Total network shutdown)
- Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

For critical web/apps vulnerabilities, bug reports will be rewarded with USD $100,000, only if the impact leads to:
- A loss of funds involving an attack that does not require any user action at all
- Unauthorized minting of tokens on-chain
- Private key or private key generation leakage leading to unauthorized access to user funds 

All other impacts that would be classified as Critical would be rewarded a flat amount of USD $25,000. The rest of the severity levels are paid out according to the Impact in Scope table.  

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 300 blocks the attack needs for subsequent attacks from the first attack, rounded down. For avoidance of doubt, if a second attack would happen at 600 blocks and then a third at 900 blocks, the funds at risk would be counted at 50% and 75% of the reward from the first attack, respectively.

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

__Restrictions on Security Researcher Eligibility__

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
- On OFACs SDN list 
- Official contributor, both past or present
- Employees and/or individuals closely associated with the project 
- Security auditors that directly or indirectly participated in the audit review

__Public Disclosure of Known Issues__

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program. 
- User Would Lose Control Of The Deposit Funds In Limit Order When UnsuccessfulOrders Is Returned From The WASM Contract
- Project operation risk in tokenfactory and dex module

__Previous Audits__

Sei Foundation has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
- [https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Cosmos%20v1.0.pdf](https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Cosmos%20v1.0.pdf)
- [https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Tendermint%20v1.0.pdf](https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-15%20Audit%20Report%20-%20Sei%20Tendermint%20v1.0.pdf)
- [https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-19%20Audit%20Report%20-%20Sei%20Chain%20and%20CosmWasm%20v1.0.pdf](https://github.com/oak-security/audit-reports/blob/master/Sei/2023-05-19%20Audit%20Report%20-%20Sei%20Chain%20and%20CosmWasm%20v1.0.pdf)
- [https://drive.google.com/file/d/15yofPol25c05HrhR_MWGuIw01kJPvz1a/view](https://drive.google.com/file/d/15yofPol25c05HrhR_MWGuIw01kJPvz1a/view)

__Feasibility Limitations__

At Immunefi, we sometimes receive reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. If it’s obviously feasible, then it seems there are no questions about severity or payout amount. But if the bug report is less feasible, or not really feasible at all, suddenly questions arise.

Therefore, Immunefi has developed a set of [feasibility limitation standards ](https://immunefisupport.zendesk.com/hc/en-us/articles/16913132495377-Feasibility-Limitation-Standards)which by default states what a Projects should or should not cite when downgrading a bug report’s impact, severity, and/or payout amount. These standards are continuously being developed and updated  with help of the community and encompasses fair guidelines where the project clearly commits, and the security researcher can be assured that the project cannot arbitrarily downgrade the program based on theoretical counter measures, such as a [chain rollback. ](https://immunefisupport.zendesk.com/hc/en-us/articles/16913153448721-Chain-Rollbacks)

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Blockchain/DLT: Critical
- Blockchain/DLT: High
- Blockchain/DLT: Medium
- Blockchain/DLT: Low
- Web/App: Critical
- Web/App: High
- Web/App: Medium
- Web/App: Low

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

For critical reports, we ask that whitehats support a PoC on a local 4-node cluster. You can follow these steps to provide this PoC:

- Spin up the local testnet with `make docker-cluster-start`
- Connect to node0 with `docker exec -it sei-node-0 /bin/bash`
- Carry out attack


__Reward Payment Terms__

Payouts are handled by the Sei Foundation team directly and are denominated in USD. However, payments are done in SEI.

SEI is used, it will be the average of closing price from coingecko over 5 days to determine the quantity of SEI to be given.

Sei

Resources & Documentation