The Graph-logo

The Graph

The Graph is an indexing protocol for querying decentralized data from multiple blockchains and storage solutions such as IPFS. It is a decentralized network comprised of multiple stakeholders incentivized to build and offer an efficient and reliable open data marketplace, through GraphQL-based APIs.

Arbitrum
ETH
Blockchain
Infrastructure
Services
Staking
Go
Julia
Rust
Solidity
Typescript
Maximum Bounty
$2,500,000
Live Since
04 August 2021
Last Updated
15 November 2024
  • PoC required

  • Vault program

  • KYC required

VaultImmunefi vault program

Funds available

$373,661.90

30d Avg. Funds availability

$325,776.62

Assets in vault

  • 1.2M  GRT

Public vault address

0x4c0eD9DE84FBA3a005FBCcd1e9E8CE6ABf2B9a04

Rewards

The Graph provides rewards in GRT on Arbitrum, denominated in USD.

Rewards by Threat Level

Blockchain/DLT
Critical
Up to: $2,500,000
Primacy of Rules
High
Up to: $200,000
Primacy of Rules
Medium
Up to: $20,000
Primacy of Rules
Low
Up to: $5,000
Primacy of Rules
Critical Reward Calculation

Reward amount is 10% of the funds directly affected, capped at the maximum critical reward of:

$2,500,000
The reward is dependent on the ratio between the funds at risk, which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com, calculated at the time the bug report is submitted.
Smart Contract
Critical
Up to: $2,500,000
Primacy of Rules
High
Up to: $200,000
Primacy of Rules
Medium
Up to: $20,000
Primacy of Rules
Low
Up to: $5,000
Primacy of Rules
Critical Reward Calculation

Mainnet assets:

Reward amount is 10% of the funds directly affected up to a maximum of:

$2,500,000
Websites and Applications
Critical
Up to: $50,000
Primacy of Rules
High
Up to: $20,000
Primacy of Rules
Medium
Up to: $5,000
Primacy of Rules
Low
Flat: $1,000
Primacy of Rules

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from the consequence of exploitation to privilege required to the likelihood of a successful exploit.

A report will receive a single classification based on the vulnerability disclosed in the report which would yield the highest reward to the hacker. So, for instance, if a report discloses a “Critical - Websites and Applications” vulnerability valued at the maximum $50,000 USD and a “High - Smart Contracts and Blockchain” vulnerability valued at the maximum $200,000 USD, the report will be given the classification of “High - Smart Contracts and Blockchain” because that will yield the highest reward.

Rewards for critical vulnerabilities are capped at 10% of the potential direct economic damage at the time the vulnerability is disclosed, primarily focusing on the USD value of Indexer, Delegator, or Curator assets in any impacted protocol smart contracts at the time of disclosure and the likelihood that such assets could be lost or stolen. The Graph Foundation may also in its discretion, but is not required to, take into consideration other potential economic harms such as potential damage to brand and goodwill. Indirect or speculative potential damage will not be considered.

Final reward amount for a valid report classified as High, Medium, and Low is in the sole discretion of The Graph Foundation. Though this bug bounty program considers the severity classification system, the primary baseline before further consideration is the Impacts in Scope and Assets in Scope tables, though that itself isn’t the final determinant.

To qualify for a reward, bug bounty hunters will need to provide KYC through https://thegraph.typeform.com/to/AXe74zc4 and provide all requested information and documents, including, without limitation:

  • E-mail address;
  • Name;
  • Wallet address the GRT should be sent to. This address must correspond with the same listed in the report.

Additionally, all bug reports must come with log components, reproduction, and data about vulnerabilities to support learnings and bug fixes. This can be satisfied by providing relevant screenshots, docs, code, and steps to reproduce the issue.

Proof of Concept required for Smart Contracts and Blockchain In the case of smart contract bugs, sharing a valid reproducible script as Proof of Concept (PoC) is a strict requirement. All PoCs must be submitted complying with Immunefi’s PoC Guidelines and Rules. Failing to do so will result in a report being deemed invalid by The Graph Foundation, not eligible for any reward.

Payouts are handled by The Graph Foundation and are denominated in USD and payable in GRT based on the prevailing USD/GRT conversion price at the time of payment.

Program Overview

The Graph is an indexing protocol for querying decentralized data from multiple blockchains and storage solutions such as IPFS. It is a decentralized network comprised of multiple stakeholders incentivized to build and offer an efficient and reliable open data marketplace, through GraphQL-based APIs.

The Graph learns what and how to index Blockchain data based on subgraph descriptions, known as the subgraph manifest. The subgraph description defines the smart contracts of interest for a subgraph, the events in those contracts to pay attention to, and how to map data to data that The Graph will index and store in its decentralized network, to be served by Indexers. Indexers are network participants responsible for running their own infrastructure capable of indexing subgraphs and subsequently serve such data.

The network is fully permissionless, meaning that every stakeholder can design, implement and deploy subgraphs, with Indexers choosing which subgraphs to index based on a number of factors such as Curators’ interest (signaling high-quality ones which may result in high query volume). Delegators are another key network participant in this open data economy, who delegate their stake towards Indexers, receiving, in turn, a portion of both network rewards and fees from subsequently served queries. Like Delegators, Curators also receive a portion of the query fees, when staking their own GRT in a subgraph’s bounding curve (signaling).

For more information about The Graph, please visit their website at https://thegraph.com/.

The bug bounty program, managed and funded by The Graph Foundation, is focused on the prevention of negative impacts to the whole ecosystem, such as:

  • Loss of user funds from the protocol smart contracts
  • Exposure of private keys that may lead to changes on deployed smart contracts and/or drainage of user funds
  • Determinism bugs that could lead to incorrect or inconsistent query results by Indexers in the network
  • Vulnerabilities in the Indexer software (eg. Graph Node, Indexer CLI, Indexer Agent, and Indexer Service) that could result in the Indexer being slashed or not running effectively
  • Vulnerabilities that could degrade the indexing or querying service

Bug bounty hunters submit bug reports at their own risk of being rejected as a known issue.

KYC required

The submission of KYC information is a requirement for payout processing.

Proof of Concept

Proof of concept is always required for all severities.

Prohibited Activities

Default prohibited activities
  • Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
  • Any testing with pricing oracles or third-party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks that are executed against project assets
  • Automated testing of services that generates significant amounts of traffic
  • Public disclosure of an unpatched vulnerability in an embargoed bounty
  • Any other actions prohibited by the Immunefi Rules

Feasibility Limitations

The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.

Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.

Severity
Min. - Max.
Critical
$2.5M
High
$200k
Medium
$20k
Low
$5k
Total paid

1.1M

Med. Resolution Time
1 day
30d Avg. Funds Availability
$325,776.62
Total Assets in Scope
49