Unless explicitly listed, only pages of the web/app assets in addition to the direct link are considered in-scope of the bug bounty program. Other subdomains are not considered as in-scope. However, for subdomain takeovers that lead to an impact on the in-scope asset, please refer to our page about [Reported Subdomain Takeovers.](https://immunefisupport.zendesk.com/hc/en-us/articles/14352199704593-Reported-Subdomain-Takeovers)

Developer of blockchain technologies intended to provide consumers with a Web 3.0 identity. The company's primary product, Solana Name Service (SNS) provides a human-readable name that maps to an SOL address, thereby removing the barrier to entry and providing an identifiable address that can facilitate payments, efficiency, and overall user experience in the sphere.

Contract fails to deliver promised returns, but doesn't lose value

Changing details of other users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction such as: Iframing leading to modifying the backend/browser state (demonstrate impact with PoC)

Temporarily disabling user to access target site, such as: Locking up the victim from login, Cookie bombing, etc.

Theft of unclaimed yield

Theft of unclaimed royalties

Permanent freezing of unclaimed yield

Permanent freezing of unclaimed royalties

Temporary freezing of funds

Temporary freezing NFTs

Injecting/modifying the static content on the target application without Javascript (Persistent) such as: HTML injection without Javascript, Replacing existing text with arbitrary text, Arbitrary file uploads, etc.

Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as: Email or password of the victim, etc.

Improperly disclosing confidential user information such as: Email address, Phone number, Physical address, etc.

Subdomain takeover without already-connected wallet interaction

Smart contract unable to operate due to lack of token funds

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Injecting/modifying the static content on the target application without Javascript (Reflected) such as: Reflected HTML injection, Loading external site data

Redirecting users to malicious websites (open redirect)

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties

Permanent freezing of funds

Permanent freezing of NFTs

Unauthorized minting of NFTs

Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)

Protocol insolvency

Execute arbitrary system commands

Retrieve sensitive data/files from a running server such as: /etc/shadow, database passwords, blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the NFT URI

Changing the NFT metadata

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds

Malicious interactions with an already-connected wallet such as: Modifying transaction arguments or parameters, Substituting contract addresses, Submitting malicious transactions

Direct theft of user NFTs

Injection of malicious HTML or XSS through NFT metadata

SNS Codebase

SNS Documentation

Payouts are handled by the SNS team directly and are denominated in USD. However, payments are done in FIDA.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price is USD 1.75 per token, then the reward will be 2857.142857 units of that token.