All Wormhole smart contracts can be found at https://github.com/wormhole-foundation. However, only those in the Assets in Scope table are considered in the bug bounty program's scope. In-scope items are those that are live on-chain or within an active Github release preparing for deployment.

Wormhole is a generic cross-chain messaging protocol that allows smart contracts on various blockchains to communicate with each other. Messages are routed from chain to chain by a decentralised group of guardian nodes who sign attestations of the on-chain state.

Bugs that are unlikely to occur but would have a significant impact if so, e.g. race conditions

Lack of defense-in-depth

Bugs that are not currently exploitable but may become exploitable in future stages of development. This could refer to a configuration setting change or a likely code change causing a bug. The WH team determines the feasibility and likelihood of this.

Denial of Service attacks against the Guardian network (excluding volumetric attacks) that would result in an extended (24 hours) degradation of performance

Lack of defense-in-depth (submitter must send PR with improvements and get it merged)

Bugs that are likely to occur in future stages of development but do not manifest themselves yet

Denial-of-service attacks against the Guardian network (excluding volumetric attacks) temporarily degrade performance.

Bugs that allow forging of wormhole messages (i.e. VAAs) or circumventing VAA verification logic in the smart contracts but are outside of the “critical” category. For example, it is possible to spoof a VAA without being able to control the sender's address.

Bugs that are very capital-intensive to carry out but could be critical

Attacks that would be critical if a single Guardian were malicious.

Unrestricted bypass of the Governor module:(https://github.com/wormhole-foundation/wormhole/tree/main/node/pkg/governor)

Unrestricted bypass of the Integrity Checkers (https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0010_integrity_checkers.md) or Accountant (https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0011_accountant.md)

Bugs that allow the forging of wormhole messages (e.g., VAAs) or circumventing VAA verification logic in smart contracts are outside of the “critical” category.

Attacks that would be critical if a minority of Guardians were malicious.

Unrestricted bypass of the Governor module (https://github.com/wormhole-foundation/wormhole/tree/main/node/pkg/governor)

Denial-of-service attacks against the entirety of the Guardian network (excluding volumetric attacks) resulted in an extended but not permanent total network shutdown.

Impacts of critical or high severity but require a feasible amount of Guardian or user interaction to exploit.

Attacks that would be critical if a super minority (6 out of 19) Guardians were malicious, excluding denial of service vulnerabilities.

Compromising a single guardian node

Cryptographic implementation flaws and flaws in random number generation with limited impact

Bugs that allow forging signed messages from a super-minority (6) of Guardians

Denial-of-service attacks against the Guardian network (excluding volumetric attacks) resulted in an extended but not permanent total network shutdown.

Exploit chains requiring user interaction

Bugs that allow forging signed messages from a minority of Guardians

Forging of wormhole messages (i.e. VAAs) or circumventing VAA verification logic

Exploits resulting in the locking, loss, or theft of user funds from the Portal Token Bridge

Permanent Denial of Service attacks (excluding volumetric attacks)

Determinism bugs that could lead to inconsistent bridge states

Unauthorized changes to protocol parameters through governance resulting in direct loss of funds

Theft of funds from exposure of production private keys.

Gaining control of multiple Guardian nodes by exploiting a vulnerability that leads to Remote Code Execution.

Any other vulnerabilities that lead to the impacts described in Tier 1-3

Forging of wormhole messages (i.e. VAAs) or circumventing VAA verification logic in the smart contracts

Governance manipulation

Exposure of production private keys and/or other extremely sensitive information.

Attacks below Critical severity if a single Guardian were malicious

For the impact to be permanent, it must result in an effect that the Wormhole team can’t directly fix and must be perpetual. For instance, making a smart contract on Ethereum completely unusable and un-upgradable. An anti-example is taking down Wormchain or the Guardian network—the Wormhole team controls both codebases and can be updated to remediate the reason for the outage. All other effects of denial of service are considered temporary in this program.

Bugs that are only triggerable against oneself and don’t affect other users, but are reasonable to be done on accident as an end user or application developer will be considered as no higher than low severity on a case-by-case basis. This excludes sending funds to unintended addresses which will not be rewarded.

Native Token Transfer (NTT) is an open, flexible, and composable framework for transferring tokens across blockchains without liquidity pools. Only the listed GitHub repository is in the scope of this bounty program. Any forks or modifications are out of scope. Furthermore, only tagged releases with version v1.x.x are considered in-scope. The severity of NTT-related findings will be dropped by a single category on the payout scale, such as a critical to a high or a medium to a low.

MultiGov is an extension of the OpenZeppelin Governor contracts that allows token holders to maintain their voting rights after bridging their tokens to another chain. Only the listed GitHub repository is in the scope of this bounty program. Any forks or modifications are out of scope. Furthermore, the rewards for MultiGov related findings will be capped at $100,000 USD.

Please note that for any valid Critical severity reports, the maximum reward will be up to $5,000,000 USD, paid in W token, with the following tiers: 

- __Tier 1:__ Ability to Extract the TVL of all chains: Up to $5,000,000 in W
- __Tier 2:__ Ability to Extract the TVL of a single chain: Up to $2,500,000 in W 
- __Tier 3:__ Ability to permanently deny access to the TVL of one or many chains: Up to $1,250,000 in W 

All rewards are decided on a case-by-case basis, taking into account the bug's exploitability, the feasibility of the exploit scenario, the impact it causes, and the likelihood of the vulnerability presenting itself, particularly if it is nondeterministic or some of the conditions are not present at the time.

Because of the governor, rewards for critical vulnerabilities are further capped at 10% of extractable value during a 24-hour period. The Governor (https://github.com/wormhole-foundation/wormhole/tree/main/node/pkg/governor) is designed to limit the value that can be transferred out of one chain over time. 
 Rewards for vulnerabilities resulting in the perpetual locking of funds are further capped at the lesser of 1% of destroyable value or $1,250,000 in W.  Rewards for critical vulnerabilities relating to NFTs are further capped at $20,000 in W.

Value is calculated based on the current market value and available liquidity for widely used tokens in the Portal Token Bridge, such as ETH and SOL. 

In cases where the report achieves more than one of the above objectives, rewards will be tiered to the higher of the two objectives and will not be aggregated (e.g., if you can extract and brick a complete TVL for a chain, you will be awarded a bounty as if you could only extract the complete TVL for that chain).

Rewards for bugs in dependencies and third-party code are at the discretion of the Wormhole team and will be based on the impact demonstrated on Wormhole. If the dependency has its own bug bounty program, your reward for submitting this vulnerability to Wormhole will be lowered by the expected payout of that other program. If the vulnerability is in a connected blockchain rather than the Wormhole code, the locked and wrapped assets on that chain are not included in the impact calculation.

Vulnerabilities known to the Wormhole team at the time of reporting are ineligible for reward. This includes external audit reports, vulnerabilities in Wormhole's dependencies that have been disclosed publicly, and internal company communications. If necessary, the program will provide proof of prior knowledge about the issue. Reports that copy public vulnerability disclosures, or reports that highlight patch gaps between Wormhole's forked repositories and their upstream codebases, are not eligible for a reward.

Wormhole Foundation will maintain full discretion on vulnerability payouts. We encourage bug reporters to submit issues outside of the above-mentioned payout structure, though we want to be clear that we’ll exercise discretion on a case-by-case basis regarding whether an issue warrants a payout and what that ultimate payout would be.