Aptos Network: Program info

Rewards are calculated based on the severity of the impact that the identified vulnerability would have on Aptos users and the Aptos Network. Aptos Foundation retains sole discretion to determine the severity classification of reported vulnerabilities and the amount of any Reward.

• Medium - up to $10,000
• High - up to $50,000
• Critical - up to $1,000,000

DoS issues which may be fixed without hardfork are accepted as Medium severity issue and will be paid in Medium severity range.

Out of scope and ineligible for reward:

• Test / Build Infrastructure Attacks
• Vulnerabilities based on social engineering
• Network Denial of Service (DoS) attacks are considered out of scope and are not eligible for Rewards under this program
• Any DOS that affects a downstream Consensus Observer node and requires a Validator Node

Vulnerabilities that interest us:

• Loss of Funds (Theft or Minting)
• Consensus / Safety Violations
• Non-recoverable network partition (fix requires hardfork)
• Total Loss of Liveness / Network Availability
• Permanent freezing of funds (fix requires hardfork)
• Remote Code Execution on Validator Node
• Cryptographic Vulnerabilities (with proven impact)
• Validator Node Slowdowns
• API Crash

If you identify a security vulnerability impacting the Aptos Network that does not fall under any of the above categories, we encourage you to report it for further analysis and we will consider a Reward as appropriate. Security issues impacting the Aptos Network having a root cause in external code dependencies are also in-scope for the program.

To be eligible for a Reward, you are required to:

• Play by the rules, including following these Rules and any other relevant agreements. If there is any inconsistency or conflict between these Rules and any other applicable terms, the applicable terms of these Rules will prevail;
• Submit an in-scope vulnerability as detailed above;
• Include detailed information and clear steps to reproduce the issue. Vulnerabilities must be reproducible using the code currently in scope for the Program, based on the current mainnet configuration, and must affect features that are either enabled or are set to be enabled via a governance proposal;
• Avoid any testing on live systems serving mainnet, testnet or devnet; all testing must be done locally;
• Report any vulnerability within 24 hours from discovery;
• Avoid disrupting our systems, destroying data, and/or harming users;
• Only use this platform to report and discuss vulnerability information with us;
• Ensure a reasonable amount of time to resolve the issue;
• Limit the data you access to the minimum required to effectively demonstrate a Proof of Concept in circumstances where a vulnerability provides unintended access to private data or secrets;
• Not engage in extortion.

Duplicate Reports When multiple reporters identify the same issue, they will share a single bounty pot. While the first reporter is given priority, the final distribution of the reward is determined by the value-add of each submission. To maximize your share of the pot, we look for:

• High Report Quality: Clear, concise, and professional documentation.
• Ease of Reproduction: Integration with our existing testing frameworks for immediate verification.
• Actionable Fixes: Provision of clean, well-documented patch files.

Note: Any reports submitted after an issue has been fully triaged and resolved are ineligible for a reward.

Do not discuss or disclose any vulnerabilities, even resolved ones, outside of this Program without the Aptos Foundation’s written consent.

You ARE NOT eligible to participate in the Program if you are:

• A "Restricted Person" as defined in the Aptos Foundation Terms of Use. To receive a Bounty, you will be required to complete an identity verification process to confirm that you are not a Restricted Person.
• Under the age of 16. If you are at least 16 years old but are considered a minor in your place of residence, you must obtain your parent's or legal guardian's permission prior to participating in this Program.
• Currently an employee or provide services to the Aptos Foundation or are a former employee or provided services to the Aptos Foundation within the last 12 months of your submitted security report.
• Employed by an entity that does not allow you to participate in the Program.

To receive a Reward, you will have to enter into an Agreement with Aptos Foundation and provide required information, which may include identity verification information and tax information or forms, such as a W-9 or W-8 for U.S. residents or citizens.

Rewards are managed by Aptos Foundation and are denominated in United States Dollars (USD). Rewards may be paid partially or fully in digital assets at the sole discretion of Aptos Foundation. If you receive digital assets as part of your Reward, the value of the digital assets in USD will be determined at the time you execute your Agreement with Aptos Foundation and after you have satisfied all eligibility criteria. Token-based rewards may be subject to a lock-up period.

Getting Started

• The Aptos Blockchain Whitepaper
• Aptos Blockchain Deep Dive
• Move - A Web3 Language and Runtime
• Engage with the Aptos community