Immunefi Vulnerability Severity Classification System - v1.2
Being Phased Out
Severity Classification System v1.2 is being phased out and is no longer in use by new projects. Please see the Immunefi Severity Classification Systems page to find active and updated classification systems.
At Immunefi, we classify bugs on a simplified 5-level scale:
- Critical
- High
- Medium
- Low
- None
This scale encompasses all the aspects of a bug, from the consequence of a successful exploit, to the level of access required to exploit it, to the probability that an exploitation attempt will be successful.
For example:
-
A bug that results in loss of contract funds is more severe than a bug that temporarily prevents token holders from transferring their tokens.
-
A bug that can be triggered by any token holder is more severe than a bug that requires a pricing oracle to go rogue.
-
A bug that can be triggered by a third party invoking a particular function/method is more severe than a bug that requires the affected token holder to invoke that same function/method.
The table below is mostly concerned with the consequence of a successful exploit. Keep in mind that if the exploit requires elevated privileges or uncommon user interaction, the level of the bug may be downgraded to reflect that.
Blockchain/DLT
| Level | Examples | |||
|---|---|---|---|---|
| 5. Critical | - Network not being able to confirm new transactions (Total network shutdown) - Unintended permanent chain split requiring hard fork (Network partition requiring hard fork) - Direct loss of funds - Permanent freezing of funds (fix requires hardfork) - RPC API crash | |||
| 4. High | - Unintended chain split (Network partition) - Transient consensus failures | |||
| 3. Medium | - High compute consumption by validator/mining nodes - Attacks against thin clients - DoS of greater than 30% of validator or miner nodes and does not shut down the network | |||
| 2. Low | - DoS of greater than 10% but less than 30% of validator or miner nodes and does not shut down the network - Underpricing transaction fees relative to computation time | |||
| 1. None | - Best practices |
Smart Contracts
| Level | Examples | |||
|---|---|---|---|---|
| 5. Critical | - Empty or freeze the contract's holdings (e.g. economic attacks, flash loans, reentrancy, MEV, logic errors, integer over-/under-flow) - Cryptographic flaws | |||
| 4. High | - Token holders temporarily unable to transfer holdings - Users spoof each other - Theft of yield | |||
| 3. Medium | - Contract consumes unbounded gas - Block stuffing - Griefing denial of service (i.e. attacker spends as much in gas as damage to the contract) - Gas griefing | |||
| 2. Low | - Contract fails to deliver promised returns, but doesn't lose value | |||
| 1. None | - Best practices |
Websites and Apps
| Level | CWE | Examples |
|---|---|---|
| 5. Critical | CWE-78 | - Remote Code Execution - Code Injection - LDAP Injection |
| CWE-611 | XML External Entity (XXE) | |
| CWE-89 | SQL Injection | |
| CWE-91 | XML Injection | |
| CWE-829 | - Server Side Includes Injection (SSI) - Local File Inclusion(LFI) - Directory/Path Traversal | |
| CWE-918 | Server-Side Request Forgery(SSRF) | |
| 4. High | CWE-862 | - Indirect Object Reference(IDOR) - Horizontal Privilege Escalation - Vertical Privilege Escalation |
| CWE-200 | - Confidential Information Exposure - Private Key Leaks | |
| CWE-79 | Cross-Site Scripting (XSS) | |
| CWE-93 | CRLF Injection | |
| CWE-444 | HTTP Request Smuggling | |
| CWE-434 | Unfiltered File Upload with execution | |
| CWE-16 | - Subdomain Takeovers - Dangling DNS Record | |
| 3. Medium | CWE-494 | Cloud Bucket Uploads |
| CWE-352 | Authenticated Cross-Site Request Forgery(CSRF) | |
| CWE-798 | Hardcoded Credentials | |
| CWE-863 | Authentication Bypass | |
| CWE-16 | Broken Link Bypass | |
| 2. Low | CWE-1021 | Clickjacking State-Changing |
| CWE-400 | Denial of Service | |
| 1. None | CWE-16 | SPF/DMARC/DKIM records |
| CWE-601 | Open Redirects |