![The Graph-logo](/_next/image/?url=https%3A%2F%2Fimages.ctfassets.net%2Ft3wqy70tc3bv%2F2L62ScwrnMTV5zczetmm3N%2F3441bc33007755cf6d8865db69d0d50e%2Fthe-graph-grt-logo_copy.png&w=128&q=75)
The Graph
The Graph is an indexing protocol for querying decentralized data from multiple blockchains and storage solutions such as IPFS. It is a decentralized network comprised of multiple stakeholders incentivized to build and offer an efficient and reliable open data marketplace, through GraphQL-based APIs.
PoC required
Vault program
KYC required
Resources & Documentation
Note on Smart Contracts: The Graph protocol is in the process of migrating to Arbitrum, as the preferred L2. For this reason, there are Smart Contracts deployed in multiple chains. Not all are equal, so bug bounty hunters are encouraged to check the code on both chains. Once fully migrated, this bug bounty program will be updated too, removing unnecessary ones. Assets in our testnet environment are intentionally excluded.
Occasionally, the Graph Foundation may, but is not required to, make an exception and reward disclosure of an out-of-scope impact that would have a material negative impact on the brand or goodwill of The Graph. Whether to make such an exception, as well as the size of the reward for such an exception, is in The Graph Foundation’s sole and final discretion.
Below, “User” includes Indexers, Delegators, Curators, Data Consumers, and Gateway Operators.
Notes related to the impact "A bug related to data determinism when syncing subgraphs and Substreams-powered subgraphs, resulting in POI (Proof of Indexing) divergence on the network (different Indexers not reaching consensus for the same indexing work)":
- The baseline reward for such valid bugs will always be $2.5k, up to $5k in GRT.
- In addition to the standard Proof of Concept mandatory with every report, Hackers must find the root cause of the issue (not just a reproducible PoC).
- This applies to the assets in the scope above (Graph Node, Firehose, and Substreams). Should the origin of the bug be external RPC clients Graph Node connects to during subgraph syncing (geth, Erigon, etc.), the report will still be considered valid, providing a well-detailed PoC, and root cause analysis is attached ("Informational").