Avalanche Bridge: Program info

In Scope Vulnerabilities

• Double minting
• Under-collateralizing on the Ethereum side
• Any kind of smart contract authority changes
• Application level denial-of-service attacks
• Unauthorized access to Wardens and Enclave servers
• Unauthorized write to public readable-only cloud storage endpoints
• Cryptographic vulnerabilities
• Leaked secrets or credentials
• Web 2.0 vulnerabilities that undermines normal bridge operation, modifies the user interface or can lead to stolen funds

Out of Scope Vulnerabilities

• Third-party Warden hosts and infrastructure
• Transaction privacy
• Social engineering, phishing and scams, including Self-XSS
• SGX vulnerabilities (unless remotely exploitable with a POC)
• Discovery of unpublished server IP or service endpoints

Program Rules

• All Avalanche General program rules apply.
• For the Avalanche Bridge, you are welcome to report any vulnerabilities you come across during normal interactions with the production Bridge at https://core.app/bridge. However, you must only perform security testing and develop PoCs on the testnet Bridge https://test.core.app/bridge .
• Please note: In cases where a size the the reward exceeds an equivalent of 10,000 USD, Avalanche is entitled to make the payment in one-year locked AVAX at the rate calculated based on a weighted average price of AVAX during 90 calendar days preceding the date of the respective validated report.