Somnia Audit Contest : Program Info

Somnia is a high-performance, cost-efficient EVM-compatible Layer 1 blockchain capable of processing over 1,000,000 transactions per second (TPS) with sub-second finality. It is suitable for serving millions of users and building real-time mass-consumer applications like games, social applications, metaverses, and more, all fully on-chain.

In scope

Target	Type	Severity
https://github.com/hackenproof-public/somnia Copy Copied Participation: Invite-only - https://discord.gg/g7u4afaYu7 KYC Required	Smart Contract	Critical

Target

https://github.com/hackenproof-public/somnia

Copied

Participation: Invite-only - https://discord.gg/g7u4afaYu7
KYC Required

TypeSmart Contract

Severity

Critical

Focus Area

IN-SCOPE VULNERABILITIES

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Stealing or loss of funds
Unauthorized transaction
Transaction manipulation
Price manipulation
Fee payment bypass
Balance manipulation
Contracts execution flows
Consensus flaws
Peer-to-peer network flaws
Cryptographic flaws

NOTE: its important to run all tests on NETWORK_PRESET=mainnet-small ./ci/run-local-deployment.sh (check setup guide) All non-mainnet issues will be considered as "Out of scope"

OUT OF SCOPE

Network-level DoS
Issues arising solely due to Somnia’s intentional divergence from Ethereum gas cost or call semantics are out of scope.
By design price increases under high load are not in scope
All features or code paths not enabled in the mainnet or mainnet-small configuration
The protocol smart contracts are out of scope

Program Rules

The following activities are prohibited by this contest event:

Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
Any testing with pricing oracles or third party smart contracts
Attempting phishing or other social engineering attacks against Somnia employees and/or customers
Any denial of service attacks
Public disclosure of an unpatched vulnerability in an embargoed bounty
Make every effort not to damage or restrict the availability of products, services, or infrastructure
Avoid compromising any personal data, interruption, or degradation of any service
Localize all tests to your accounts
Perform testing only within the scope
In case you find chain vulnerabilities we’ll pay only for vulnerability with the highest severity.
Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of Somnia Company without appropriate permission

Discussion

We use Discord as official communication channel: https://discord.gg/ Join the channel, and create #support ticket to be added for conversation.

Audit report

Hacken - July 2025

Disclosure Guidelines

Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
No vulnerability disclosure, including partial is allowed for the moment.
Please do NOT publish/discuss bugs

Eligibility and Coordinated Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

The vulnerability must be a qualifying vulnerability
Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
You must not be a former or current employee of us or one of its contractor.
Provide detailed but to-the point reproduction steps

Rewards Distribution

Total Prize Pool: $300k USDC

10k is a pot which will be distributed if at least 1 Low severity issue discovered
40k is a pot which will be distributed if at least 1 Medium severity issue discovered
100k is a pot which will be distributed if at least 1 High severity issue discovered
Additional 150k will be unlocked for critical severity issues discovered: For the purpose of this contest, a critical vulnerability is defined as an issue that enables the theft of substantial user funds or protocol assets.
Note: 10% from each unlocked severity pot will be retained by the platform as a service fee.

Please note:

Minor or theoretical loss vectors — such as small rounding errors — do not qualify as critical, even if they technically result in direct fund movement. This definition is consistent with HackenProof’s Blockchain protocol Vulnerability Classification, and final decisions on severity will be made in collaboration with the project team.

Consensys specification issues

All critical issues related to consensys specification, will be capped by $80k in HAI tokens as a part of DualDefense program

We encourage researchers to submit all impactful findings, but only those meeting the strict “substantial fund theft” threshold will trigger the bonus payout.

Reward Splitting for Duplicate Findings If the same issue is reported by multiple researchers, the reward will be split using the following formula:

Final Reward = Severity Weight × (0.9 ^ (N - 1)) / N

Where:

Severity Weight =
- Low → 20
- Medium → 30
- High → 50
N = number of researchers who submitted the same valid issue
Rewards are normalized against the total contest allocation and severity budget

Example (for a High severity issue with a weight of 50):

1 researcher reports → receives 50 points
2 researchers report → each receives ≈ 22.5 points
3 researchers report → each receives ≈ 15 points

This system encourages early discovery and rewards uniqueness while ensuring all valid reporters are fairly acknowledged.

Setup Guide

Core Dev Installations

The following are installations required to start building and developing on Somnia.

Install Bazelisk. We highly recommend using Bazelisk over standard Bazel to ensure that your system is always on the correct version of Bazel and Clang.

./tools/install_bazelisk.sh

Install additional Bazel buildtools. This is required to run our linter script, among other things.

./tools/install_buildtools.sh

Ensure that "$HOME/.local/bin" is on your path. This should be default on most Linux distributions, but if not you can add the following > line at the end of your ~/.bashrc file:

export PATH="${HOME}/.local/bin:${PATH}"

Install remaining code dependencies.

sudo ./tools/install_dependencies.sh

Run a local mainnet

NETWORK_PRESET=mainnet-small ./ci/run-local-deployment.sh

If you are running on MacOS:

# Install Docker Desktop for Mac
   brew install --cask docker

   # Clone the repository
   git clone <repository-url>
   cd somnia

   # Build and run using Docker with x86_64 emulation
   docker build -f .github/Dockerfile --platform linux/amd64 -t somnia .
   docker run -it --platform linux/amd64 somnia
	 
	 # Inside of container
	 NETWORK_PRESET=mainnet-small ./ci/run-local-deployment.sh

Somnia Audit Contest : Program info