Welcome to the Polymesh Bug Bounty Program. Polymesh is the software that powers the nodes of the Polymesh blockchain. We want Polymesh to be robust and be the best it can be. This is where we need your help, to assist us in finding bugs and vulnerabilities. Confirmed bugs or vulnerabilities will get monetary rewards (bounty). Please see our Rules & Rewards section for more details.
You can also submit the bug reports on our Bug Bounty program on Immunefi.
The bug bounty will be applicable for the following repositories, sources and sites:
Following are out of scope:
- Rewards will be decided on a per case basis. This bug bounty program's terms and conditions are at the sole discretion of the Polymesh Association.
- Rewards will vary depending on the severity of the issue.
- Disclose the bug only on the platforms approved by us (Federacy/Immunefi). Do not disclose a bug or vulnerability anywhere else to the public. Doing such would disqualify it from being considered for a reward.
- The bugs being considered for the reward are based on first come first serve basis, duplicate bugs will not be considered.
- If you want to add more information to a provided issue, edit the original report, do not create a new submission.
- Other variables considered for rewards include: the quality of the issue description, the instructions for reproducibility, and the quality of the fix (if included).
- Determinations of eligibility, score and all terms related to an award are at the sole and final discretion of the Polymesh Association.
- Submissions needs to be related with the Bounty Scope. Submissions out of the Bounty Scope won't be eligible for a reward.
- Any interference with the protocol, client or platform services, on purpose or not during the process will make the submission process invalid.
- It is mandatory to read and follow the responsible disclosure policy available in the references. Submissions not following the disclosure policy will not be eligible for a reward.
- By participating in the Polymesh Bug Bounty program, you agree to abide by the terms and condition of the program.
We may modify the terms or terminate this program at any time.
Vulnerability Classification and Rewards
|Severity||Description / Example||Reward|
(CVSS 9.0 - 10.0)
|Transaction manipulation /censorship, double-spending,|
POLY/POLYX minting, unauthorized token minting, staled
or undermined consensus/network, governance
censorship or compromise, manipulation of signing
keys or master keys to gain unauthorised access to
|USD 6000 - 10000|
(CVSS 7.0 - 8.9)
|Ability to use an extrinsic panic unexpectedly |
without proper handling, block the on-chain governance
system from it's expected behaviour, block other users
from their ability to perform expected tasks (griefing).
|USD 2000 - 6000|
(CVSS 4.0 - 6.9)
|Ability to put chain data into an unexpected state which |
otherwise doesn't cause any disruption, forcing the
emission of events which are incorrect.
|USD 500 - 1500|
(CVSS 00 - 3.9)
|DoS'ing of the operator nodes, incorrect data being |
logged through events.
|USD 200 - 600|
While researching, please refrain from:
- Denial of service in general and of Public RPC nodes
- Attacks that consume a substantial amount of Goerli ETH, Goerli POLY or Testnet POLYX and which would otherwise be cost-prohibitive on Mainnet
- Social engineering (including phishing) of Polymesh Association's staff
- Any physical attempts against Polymesh Association's property or data centres
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
However, please understand that if your security research involves the networks, systems, information, applications, products, or services of a third party, that third party is not bound by the rules of this program and may determine, at their sole discretion, whether to pursue legal action. The Polymesh Association cannot and does not authorize security research on other entities.
Submitting a bug
Once you find a bug, please report it to us via Federacy.
Additionally, Immunefi is also running our Bug Bounty program, you can report it there too.
Please try to be detailed, specific, and clear when you fill out this form. Once we receive your report, we'll be in touch soon.
Terms and Conditions
The Polymesh Bug Bounty Program is governed by our Terms and Conditions defined here.
By participating in the program, you agree by these Terms and Conditions.