CoW Protocol

Any vulnerabilities mentioned in CoW Swap’s official audits are considered out-of-scope. Audits can be found in the official contracts repository.

Any vulnerability that has already been reported to the CoW team or the CoW DAO, whether publicly or privately, is not eligible for a bounty. We recommend checking if the reported vulnerability is discussed in the issue tracker of the CoW Swap contracts repository.

Some known vulnerability may not (yet) have been publicly reported but are already privately known to the CoW team or have already been discovered by other parties and communicated to the CoW Team, but not yet fixed. Any such reports are not eligible.

The decision of eligibility of any submitted bug reports and their assessment is at the sole discretion of the Cow Team.

The following are also considered as out-of-scope:

• Migration methods.
• Services that build and submit the settlement transaction (e.g., denial of service, exploiting settlement transactions to extract value via sandwich attacks).
• Gas efficiency improvements.
• Any issues relating to networks other than the Ethereum Mainnet.
• Steal funds from the settlement contract as a solver.
• Price manipulation from the solver, for example:
  • Choosing the prices in a settlement so as to receive a premium from an order.
  • Reusing the same token twice in a settlement to give different prices to different orders.

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Running out of gas

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Attempting phishing or other social engineering attacks against the CoW Team and/or customers
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty