Participating in Marinade’s Bug Bounty Program is straightforward. Follow these steps to report a vulnerability and earn a reward:
Identify a Vulnerability:
Conduct a thorough review of the Marinade protocol to identify potential security issues.
Report the Bug:
Where to submit: Report through our Immunefi program at immunefi.com/bug-bounty/marinade. Immunefi handles triage, tracks your report, and is how rewards are paid.
Ensure your report includes all necessary information for replication and resolution.
For findings outside this scope, such as the web app, docs site, infrastructure, or Marinade programs other than the liquid staking program, see How to Report a Security Vulnerability.
Await Assessment:
Our team will evaluate the severity and impact of the reported vulnerability using the Immunefi Vulnerability Severity Classification System.
Receive Your Reward:
Upon successful validation and resolution of the bug, you will receive the appropriate bounty as per the reward structure.
Rewards by Threat Level
Bounties are distributed based on the impact and severity of the identified vulnerabilities. We utilize the Immunefi Vulnerability Severity Classification System, which is a simplified 5-level scale tailored for websites/apps and smart contracts/blockchains. The classification considers factors such as the consequence of exploitation, required privileges, and the likelihood of a successful exploit.
Reward Structure for Smart Contracts and Blockchain Vulnerabilities:
Threat Level | Reward Amount |
Critical | Up to USD 250,000* |
High | Up to USD 15,000 |
Important Notes:
Critical Vulnerabilities:
Cap: Rewards for critical vulnerabilities are capped at 10% of the economic damage caused by the vulnerability.
Minimum Payout: There is a minimum payout of USD 50,000 for critical bug reports.
Considerations: The final reward amount also takes into account the funds affected, public relations (PR) impact, and brand considerations, at the discretion of the Marinade team.
Payout Details:
Currency: Rewards are primarily denominated in USD.
Distribution: Payouts are made in mSOL and MNDE tokens.
Administration: The Marinade Finance team handles all payouts directly.
Scope of the Bug Bounty Program
Understanding the scope of the Bug Bounty Program is crucial for participants to know what is eligible for rewards and what is not. The scope is divided into Assets in Scope, Impacts in Scope, Prioritized Vulnerabilities, Out of Scope Vulnerabilities, and Prohibited Activities.
A. Assets in Scope
The following asset is within the scope of this bug bounty program:
Smart Contract: The liquid-staking-program. It is the only program currently listed on Immunefi.
Other Marinade programs, including Native Staking Proxy, Validator Bonds and Directed Stake, are not part of the Immunefi scope. Findings in those do not qualify for an Immunefi reward. Report them as described in How to Report a Security Vulnerability.
B. Impacts in Scope
Only the following impacts are accepted within this bug bounty program. All other impacts are considered out of scope, even if they affect assets listed above.
Critical:
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield.
Permanent freezing of funds.
Protocol insolvency.
High:
Theft of unclaimed yield.
Permanent freezing of unclaimed yield.
Temporary freezing of funds, excluding DOS attacks.
C. Prioritized Vulnerabilities
We are particularly interested in receiving and rewarding vulnerabilities of the following types:
Re-entrancy:
Exploits that allow multiple entries into a function before the previous execution completes.
Logic Errors:
Including authentication errors that disrupt the intended logic of the smart contracts.
Trusting Trust/Dependency Vulnerabilities:
Including composability vulnerabilities that arise from dependencies on other contracts or services.
Oracle Failures/Manipulation:
Issues related to the failure or manipulation of oracles that provide external data.
Novel Governance Attacks:
New and innovative methods to attack the governance mechanisms.
Economic/Financial Attacks:
Including flash loan attacks that exploit economic vulnerabilities.
Congestion and Scalability Issues:
Such as running out of gas, block stuffing, and susceptibility to frontrunning.
Consensus Failures:
Problems that disrupt the consensus mechanism of the blockchain.
Cryptography Problems:
Including signature malleability, susceptibility to replay attacks, weak randomness, and weak encryption.
Susceptibility to Block Timestamp Manipulation:
Vulnerabilities that allow manipulation of block timestamps.
Missing Access Controls:
Unprotected internal or debugging interfaces that can be exploited.
D. Out of Scope Vulnerabilities
The following vulnerabilities are excluded from the rewards for this bug bounty program:
Exploited Attacks:
Attacks that the reporter has already exploited themselves, leading to damage.
Leaked Keys/Credentials:
Attacks requiring access to leaked keys or credentials.
Privileged Addresses:
Attacks requiring access to privileged addresses (e.g., governance, strategist).
Incorrect Data from Oracles:
Attacks based on incorrect data supplied by third-party oracles (excluding oracle manipulation/flash loan attacks).
Basic Economic Governance Attacks:
Such as 51% attacks.
Lack of Liquidity:
Issues arising from insufficient liquidity.
Best Practice Critiques:
Suggestions or critiques that do not involve security vulnerabilities.
Sybil Attacks:
Attacks involving the creation of multiple fake identities.
E. Prohibited Activities
The following activities are strictly prohibited under this bug bounty program:
Testing on Mainnet/Public Testnets:
Any testing with mainnet or public testnet contracts. All testing should be conducted on private testnets.
Testing with Pricing Oracles/Third-Party Contracts:
Any testing involving pricing oracles or third-party smart contracts.
Phishing or Social Engineering:
Attempting phishing or other social engineering attacks against our employees and/or customers.
Testing with Third-Party Systems:
Any testing with third-party systems and applications (e.g., browser extensions) as well as websites (e.g., SSO providers, advertising networks).
Denial of Service (DoS) Attacks:
Any form of DoS attacks.
Automated High-Traffic Testing:
Automated testing of services that generate significant amounts of traffic.
Public Disclosure Before Patch:
Public disclosure of an unpatched vulnerability during an embargoed bounty period.