Immunefi
Immunefi

Rules

Immunefi has a set of rules that govern users' participation in its bug bounty platform and interaction with Immunefi-run spaces and team. These rules exist in addition to the rules for each bug bounty program, which are listed on each bug bounty program page.

Violation of these rules can result in a temporary suspension or permanent ban from the Immunefi platform at the sole discretion of the Immunefi team, which may also result in: 1) the forfeiture and loss of access to all bug submissions, and 2) zero payout. Please note that Immunefi has no tolerance for spam/low-quality/incomplete bug reports, beg bounty behavior, and misrepresentation of assets and severity.

These rules can be changed at any time.

Prohibited Behavior for Whitehats

  • Any testing with mainnet or public testnet contracts. Testing on mainnet or public testnet is grounds for an immediate and permanent ban
  • Misrepresenting assets in scope: claiming that a bug report impacts/targets an asset in scope when it does not
  • Misrepresenting severity: claiming that a bug report is critical when it clearly is not
  • Automated testing of services that generates significant amounts of traffic
  • Exploiting/attacking or threatening to exploit/attack a project on Immunefi - see this article for Immunefi Proof of Concept (PoC) rules
  • Attempting phishing or other social engineering attacks against Immunefi and/or projects on Immunefi
  • Harassment, i.e., excessive, abusive, or bad faith communication
  • 'Beg bounty' behavior, i.e. begging for a bounty reward that is not owed to the whitehat based on the terms of the bug bounty program
  • Requesting gas fees from Immunefi or projects
  • Attacks based on personal characteristics
  • Impersonation of other whitehats
  • Obscene or extremely offensive usernames
  • Threats of violence
  • Threatening to publish or publishing people’s personal information without their consent
  • Extortion/blackmail or threats of extortion/blackmail
  • Posting illegal content
  • Reporting a bug that has already been publicly disclosed
  • Creating multiple accounts on the Immunefi platform
  • Underreporting vulnerabilities
  • Misrepresenting vulnerabilities
  • Publicly disclosing a bug report--or even the existence of a bug in a specific project--before it has been fixed and paid
  • Publicly disclosing a bug report before 30 days have elapsed since the project closed the report as being out of scope or not requiring a fix
  • Publicly disclosing a bug report deemed to be a duplicate or well-known to the project
  • Placeholder bug submissions, i.e., bugs that have a vague title, very few details, and no reproducible steps
  • Submitting a bug report that is not substantially your own (co-submitting with another hacker with their consent is permitted)
  • Submitting spam/very low-quality bug reports and submitting information through our platform that is not a bug report
  • Submitting a bug report with no PoC or an incomplete PoC if it is required by the project's bug bounty program - see this article for Immunefi Proof of Concept (PoC) rules
  • Routing around Immunefi and communicating with a project directly - negotiations outside of the Immunefi dashboard are considered invalid
  • Submitting bugs via email or any channel other than the Immunefi platform
  • Submitting fixes to a project's repository without their express consent
  • Unauthorized disclosure or access of sensitive information beyond what is necessary to submit the report
  • Mediation request abuse
  • Promoting any of the behavior listed above

Prohibited Behavior for Projects

  • Mediation request abuse
  • Routing around Immunefi and communicating with a whitehat directly - negotiations outside of the Immunefi dashboard are considered invalid
  • Claiming a bug report is a well-known or duplicate issue without clear evidence
  • Paying whitehats who submit bug reports via Immunefi outside of Immunefi
  • Publicly disclosing a bug report before you have both fixed the issue and paid the whitehat
  • Soliciting whitehats on Immunefi for commercial projects or private bug bounty programs
  • Attacks based on personal characteristics
  • Bad faith communication
  • Closing a report without providing detailed information and/or evidence as to why it should be closed
  • Promoting any of the behavior listed above

Behavioral Code

  • Be ethical
  • Be respectful and considerate
  • Be professional
  • Be patient
  • Be privacy conscious

Scope and Enforcement

The team will take all reasonable actions to ensure the successful execution of Immunefi's mission and the maximum effectiveness of the project.

All material in official project spaces is subject to the rules, and as such, can be deleted, modified, or rejected by the team if it is found to be in violation of the rules. In repeated or severe cases, the team may exclude users from the Immunefi bug bounty platform and/or its project spaces on a temporary or permanent basis.