All smart contracts of Wormhole can be found at [https://github.com/wormhole-foundation](https://github.com/wormhole-foundation). However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

([https://github.com/wormhole-foundation/wormhole/tree/dev.v2/node/pkg/governor](https://github.com/wormhole-foundation/wormhole/tree/dev.v2/node/pkg/governor)) is designed to limit the value that can be transferred out of one chain over time. Under the threat model of a compromised chain, the ability to transfer all tokens in unlimited amounts to any target chain would constitute a "high" severity vulnerability.


Wormhole is a generic cross-chain messaging protocol that allows smart contracts on various blockchains to communicate with each other. Messages are routed from chain to chain by a decentralised group of guardian nodes who sign attestations of on-chain state.

Forging of wormhole messages (i.e. VAAs) or circumventing VAA verification logic in the smart contracts.

Exploits resulting in the locking, loss, or theft of user funds from the Portal Token Bridge

Permanent Denial of Service attacks (excluding volumetric attacks)

Determinism bugs that could lead to inconsistent bridge states

Governance manipulation

Exposure of production private keys

Vulnerabilities in the node software resulting in invalid behavior

Remote code execution

Any other vulnerabilities that lead to the impacts described in Tier 1-3

Forging of wormhole messages (i.e. VAAs) or circumventing VAA verification logic in the smart contracts

Exposure of production private keys and/or PII

Bugs that allow forging of wormhole messages (i.e. VAAs) or circumventing VAA verification logic in the smart contracts but are outside of the “critical” category

Bugs that are very capital-intensive to carry out but could be critical

Attacks that would be critical if a minority of Guardians was malicious.

Unrestricted bypass of the Governor module: (https://github.com/wormhole-foundation/wormhole/tree/dev.v2/node/pkg/governor)

Unrestricted bypass of the Integrity Checkers (https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0011_accountant.md)

Attacks that would be critical if a minority of Guardians was malicious

Unrestricted bypass of the Integrity Checkers (https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0010_integrity_checkers.md) or Accountant (https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0011_accountant.md)

Denial of Service attacks against the Guardian network (excluding volumetric attacks) resulting in an extended but not permanent total network shutdown

Exploit chains requiring user interaction

Compromising a single guardian node

Cryptographic implementation flaws and flaws in random number generation with limited impact

Bugs that allow forging signed messages from a minority of Guardians

Bugs that are unlikely to occur but would have a large impact if so, e.g. race conditions

Lack of defense-in-depth

Bugs that are likely to occur in future stages of development but do not manifest themselves yet

Denial of Service attacks against the Guardian network (excluding volumetric attacks) resulting in an extended degradation of performance

Lack of defense-in-depth (must send PR with improvements and get it merged)

Denial of Service attacks against the Guardian network (excluding volumetric attacks) resulting in a temporary degradation of performance

The Governor module ([https://github.com/wormhole-foundation/wormhole/tree/dev.v2/node/pkg/governor](https://github.com/wormhole-foundation/wormhole/tree/dev.v2/node/pkg/governor)) is designed to limit the value that can be transferred out of one chain over time. Assuming a smart contract compromise on one chain, the ability to transfer all tokens in unlimited amounts to any target chain would constitute a "high" severity vulnerability.

([https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0011_accountant.md](https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0011_accountant.md)) module under the threat model of a fully compromised chain.

  - __Tier 1:__ Ability to Extract the TVL of all chains: Up to 20,000,000 W
  - __Tier 2:__ Ability to Extract the TVL of a single chain: Up to 10,000,000 W 
  - __Tier 3:__ Ability to permanently deny access to the TVL of one or many chains: Up to 5,000,000 W

All rewards are decided on a case-by-case basis, taking into account the exploitability of the bug, the impact it causes, and the likelihood of the vulnerability presenting itself if it is nondeterministic or some of the conditions are not present at the time. The rewards presented in the payout structure above are the maximum rewards and there are no minimum rewards.

Rewards for critical vulnerabilities are further capped at __10%__ of extractable value during a 24h period (see Governor mechanism: [https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0007_governor.md)](https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0007_governor.md). Rewards for vulnerabilities resulting in the indefinite locking of funds are further capped at __1%__ of destroyable value. Rewards for critical vulnerabilities relating to NFTs are further capped at 80,000 W.

Value is calculated based on the current market value and available liquidity for widely-used tokens in the Portal Token Bridge, e.g. ETH and SOL. 

In cases where the report achieves more than one of the above objectives, rewards will be tiered to the higher of the two objectives and will not be aggregated (eg. if you have the ability to extract and brick a complete TVL for a chain, you will be awarded a bounty as if you were able to only extract the complete TVL for that chain).

Rewards for bugs in dependencies and third party code are at the discretion of the Wormhole team and will be based on the impact demonstrated on Wormhole. If the dependency has its own bug bounty program, your reward for submitting this vulnerability to Wormhole will be lowered by the expected payout of that other program. If the vulnerability is in a connected blockchain itself rather than the Wormhole code, the locked and wrapped assets on that chain are not included in the impact calculation.

Wormhole Foundation will maintain full discretion on the payouts for vulnerabilities. We do encourage bug reporters to submit issues outside of the above-mentioned payout structure, though we want to be clear that we’ll exercise discretion on a case-by-case basis -- whether an issue warrants a payout and what that ultimate payout would be.


Wormhole

Resources & Documentation