Serai is an actively developed cross-chain, decentralized exchange for Bitcoin, Ethereum, and Monero. Built from scratch in Rust, Serai uses threshold multisignatures to secure coins under its own decentralized network.

Undocumented panic reachable from a public API

Non-constant time implementation with regards to secret data

Incorrect/incomplete formulas

Undocumented transcript collision

Recovery of private keys/shares/nonces

Signing of unintended messages

Ability to forge proofs

Serai Codebase

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Overtime Attack Limitations__

In cases of attacks executed over time for smart contract and blockchain/DLT bugs, an explicit two hour window without human intervention is provided, starting from the first erroneous or malicious action. Only achievements during this window will be counted, regardless of further impact.

__Public Disclosure of Known Issues__

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program. 
- [https://github.com/serai-dex/serai/issues](https://github.com/serai-dex/serai/issues)
- [https://github.com/serai-dex/serai/tree/develop/audits](https://github.com/serai-dex/serai/tree/develop/audits)

__Previous Audits__

Serai has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
- [https://github.com/serai-dex/serai/blob/develop/audits/Cypher%20Stack%20crypto%20March%202023/Audit.pdf](https://github.com/serai-dex/serai/blob/develop/audits/Cypher%20Stack%20crypto%20March%202023/Audit.pdf)

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Blockchain/DLT - Critical

In addition, PoC will be required for the following low impact:
- Undocumented panic

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the Serai team directly and are denominated in USD. However, payments are done in USDC.

__ Exclusion with monero-oxide __

For submissions mutual to Serai DEX and monero-oxide, both programs should be submitted to yet only one will issue a reward (of the submitter's choice).