The Graph
The Graph is an indexing protocol for querying decentralized data from multiple blockchains and storage solutions such as IPFS. It is a decentralized network comprised of multiple stakeholders incentivized to build and offer an efficient and reliable open data marketplace, through GraphQL-based APIs.
PoC required
Vault program
KYC required
Immunefi vault program
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from the consequence of exploitation to privilege required to the likelihood of a successful exploit.
A report will receive a single classification based on the vulnerability disclosed in the report which would yield the highest reward to the hacker. So, for instance, if a report discloses a “Critical - Websites and Applications” vulnerability valued at the maximum $50,000 USD and a “High - Smart Contracts and Blockchain” vulnerability valued at the maximum $200,000 USD, the report will be given the classification of “High - Smart Contracts and Blockchain” because that will yield the highest reward.
Rewards for critical vulnerabilities are capped at 10% of the potential direct economic damage at the time the vulnerability is disclosed, primarily focusing on the USD value of Indexer, Delegator, or Curator assets in any impacted protocol smart contracts at the time of disclosure and the likelihood that such assets could be lost or stolen. The Graph Foundation may also in its discretion, but is not required to, take into consideration other potential economic harms such as potential damage to brand and goodwill. Indirect or speculative potential damage will not be considered.
Final reward amount for a valid report classified as High, Medium, and Low is in the sole discretion of The Graph Foundation. Though this bug bounty program considers the severity classification system, the primary baseline before further consideration is the Impacts in Scope and Assets in Scope tables, though that itself isn’t the final determinant.
To qualify for a reward, bug bounty hunters will need to provide KYC through https://thegraph.typeform.com/to/AXe74zc4 and provide all requested information and documents, including, without limitation:
- E-mail address;
- Name;
- Wallet address the GRT should be sent to. This address must correspond with the same listed in the report.
Additionally, all bug reports must come with log components, reproduction, and data about vulnerabilities to support learnings and bug fixes. This can be satisfied by providing relevant screenshots, docs, code, and steps to reproduce the issue.
Proof of Concept required for Smart Contracts and Blockchain In the case of smart contract bugs, sharing a valid reproducible script as Proof of Concept (PoC) is a strict requirement. All PoCs must be submitted complying with Immunefi’s PoC Guidelines and Rules. Failing to do so will result in a report being deemed invalid by The Graph Foundation, not eligible for any reward.
Payouts are handled by The Graph Foundation and are denominated in USD and payable in GRT based on the prevailing USD/GRT conversion price at the time of payment.
Program Overview
The Graph is an indexing protocol for querying decentralized data from multiple blockchains and storage solutions such as IPFS. It is a decentralized network comprised of multiple stakeholders incentivized to build and offer an efficient and reliable open data marketplace, through GraphQL-based APIs.
The Graph learns what and how to index Blockchain data based on subgraph descriptions, known as the subgraph manifest. The subgraph description defines the smart contracts of interest for a subgraph, the events in those contracts to pay attention to, and how to map data to data that The Graph will index and store in its decentralized network, to be served by Indexers. Indexers are network participants responsible for running their own infrastructure capable of indexing subgraphs and subsequently serve such data.
The network is fully permissionless, meaning that every stakeholder can design, implement and deploy subgraphs, with Indexers choosing which subgraphs to index based on a number of factors such as Curators’ interest (signaling high-quality ones which may result in high query volume). Delegators are another key network participant in this open data economy, who delegate their stake towards Indexers, receiving, in turn, a portion of both network rewards and fees from subsequently served queries. Like Delegators, Curators also receive a portion of the query fees, when staking their own GRT in a subgraph’s bounding curve (signaling).
For more information about The Graph, please visit their website at https://thegraph.com/.
The bug bounty program, managed and funded by The Graph Foundation, is focused on the prevention of negative impacts to the whole ecosystem, such as:
- Loss of user funds from the protocol smart contracts
- Exposure of private keys that may lead to changes on deployed smart contracts and/or drainage of user funds
- Determinism bugs that could lead to incorrect or inconsistent query results by Indexers in the network
- Vulnerabilities in the Indexer software (eg. Graph Node, Indexer CLI, Indexer Agent, and Indexer Service) that could result in the Indexer being slashed or not running effectively
- Vulnerabilities that could degrade the indexing or querying service
Bug bounty hunters submit bug reports at their own risk of being rejected as a known issue.
KYC required
The submission of KYC information is a requirement for payout processing.
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.