'%3e%3cpath%20d='M12.4997%201.33325C10.39%201.33325%208.32772%201.95884%206.5736%203.13091C4.81947%204.30298%203.4523%205.96888%202.64496%207.91796C1.83763%209.86704%201.62639%2012.0118%202.03797%2014.0809C2.44955%2016.15%203.46545%2018.0506%204.95721%2019.5424C6.44897%2021.0342%208.34959%2022.0501%2010.4187%2022.4616C12.4878%2022.8732%2014.6326%2022.662%2016.5816%2021.8546C18.5307%2021.0473%2020.1966%2019.6801%2021.3687%2017.926C22.5408%2016.1719%2023.1663%2014.1096%2023.1663%2011.9999C23.1663%209.17094%2022.0425%206.45783%2020.0422%204.45745C18.0418%202.45706%2015.3287%201.33325%2012.4997%201.33325ZM12.4997%2021.3333C10.6537%2021.3333%208.84922%2020.7859%207.31436%2019.7603C5.7795%2018.7347%204.58322%2017.2771%203.8768%2015.5716C3.17039%2013.8662%202.98555%2011.9896%203.34568%2010.1791C3.70581%208.36859%204.59473%206.70554%205.90002%205.40025C7.20531%204.09496%208.86835%203.20605%2010.6788%202.84592C12.4893%202.48579%2014.3659%202.67063%2016.0714%203.37704C17.7768%204.08346%2019.2345%205.27974%2020.2601%206.8146C21.2856%208.34945%2021.833%2010.154%2021.833%2011.9999C21.833%2014.4753%2020.8497%2016.8492%2019.0993%2018.5996C17.349%2020.3499%2014.975%2021.3333%2012.4997%2021.3333Z'%20fill='white'/%3e%3cpath%20d='M19.167%208.06667C19.042%207.9425%2018.8731%207.8728%2018.697%207.8728C18.5208%207.8728%2018.3519%207.9425%2018.227%208.06667L10.8269%2015.4333L6.82695%2011.4333C6.70495%2011.3016%206.53562%2011.2237%206.35621%2011.2169C6.1768%2011.21%206.00201%2011.2747%205.87028%2011.3967C5.73856%2011.5187%205.66069%2011.688%205.65382%2011.8674C5.64694%2012.0468%205.71162%2012.2216%205.83362%2012.3533L10.8269%2017.3333L19.167%209.01333C19.2294%208.95136%2019.279%208.87762%2019.3129%208.79638C19.3467%208.71514%2019.3642%208.62801%2019.3642%208.54C19.3642%208.45199%2019.3467%208.36485%2019.3129%208.28361C19.279%208.20237%2019.2294%208.12864%2019.167%208.06667Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_2790_31187'%3e%3crect%20width='24'%20height='24'%20fill='white'%20transform='translate(0.5)'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Bug bounty 
| Target | Type | Severity | Reward |
|---|---|---|---|
Prod contract address: BTC.b  Copy  Copied 0x152b9d0fdc40c096757f570a51e494bd4b943e50 | Web3 | Critical | Bounty |
Prod contract address: 1INCH.e Copy Copied 0xd501281565bf7789224523144fe5d98e8b28f267 | Web3 | Critical | Bounty |
Prod contract address: AAVE.e Copy Copied 0x63a72806098bd3d9520cc43356dd78afe5d386d9 | Web3 | Critical | Bounty |
Prod contract address: ALPHA.e Copy Copied 0x2147efff675e4a4ee1c2f918d181cdbd7a8e208f | Web3 | Critical | Bounty |
Prod contract address: BAT.e Copy Copied 0x98443b96ea4b0858fdf3219cd13e98c7a4690588 | Web3 | Critical | Bounty |
Prod contract address: BUSD.e Copy Copied 0x19860ccb0a68fd4213ab9d8266f7bbf05a8dde98 | Web3 | Critical | Bounty |
Prod contract address: COMP.e Copy Copied 0xc3048e19e76cb9a3aa9d77d8c03c29fc906e2437 | Web3 | Critical | Bounty |
Prod contract address: CRV.e Copy Copied 0x249848beca43ac405b8102ec90dd5f22ca513c06 | Web3 | Critical | Bounty |
Prod contract address: DAI.e Copy Copied 0xd586e7f844cea2f87f50152665bcbc2c279d8d70 | Web3 | Critical | Bounty |
Prod contract address: GRT.e Copy Copied 0x8a0cac13c7da965a312f08ea4229c37869e85cb9 | Web3 | Critical | Bounty |
Prod contract address: LINK.e Copy Copied 0x5947bb275c521040051d82396192181b413227a3 | Web3 | Critical | Bounty |
Prod contract address: MKR.e Copy Copied 0x88128fd4b259552a9a1d457f435a6527aab72d42 | Web3 | Critical | Bounty |
Prod contract address: SHIB.e Copy Copied 0x02d980a0d7af3fb7cf7df8cb35d9edbcf355f665 | Web3 | Critical | Bounty |
Prod contract address: SNX.e Copy Copied 0xbec243c995409e6520d7c41e404da5deba4b209b | Web3 | Critical | Bounty |
Prod contract address: SUSHI.e Copy Copied 0x37b608519f91f70f2eeb0e5ed9af4061722e4f76 | Web3 | Critical | Bounty |
Prod contract address: SWAP.e Copy Copied 0xc7b5d72c836e718cda8888eaf03707faef675079 | Web3 | Critical | Bounty |
Prod contract address: UMA.e Copy Copied 0x3bd2b1c7ed8d396dbb98ded3aebb41350a5b2339 | Web3 | Critical | Bounty |
Prod contract address: UNI.e Copy Copied 0x8ebaf22b6f053dffeaf46f4dd9efa95d89ba8580 | Web3 | Critical | Bounty |
Prod contract address: USDC.e Copy Copied 0xa7d7079b0fead91f3e65f86e8915cb59c1a4c664 | Web3 | Critical | Bounty |
Prod contract address: USDT.e Copy Copied 0xc7198437980c041c805a1edcba50c1ce5db95118 | Web3 | Critical | Bounty |
Prod contract address: WBTC.e Copy Copied 0x50b7545627a5162f82a992c33b87adc75187b218 | Web3 | Critical | Bounty |
Prod contract address: WETH.e Copy Copied 0x49d5c2bdffac6ce2bfdb6640f4f80f226bc10bab | Web3 | Critical | Bounty |
Prod contract address: WOO.e Copy Copied 0xabc9547b534519ff73921b1fba6e672b5f58d083 | Web3 | Critical | Bounty |
Prod contract address: YFI.e Copy Copied 0x9eaac1b23d935365bd7b542fe22ceee2922f52dc | Web3 | Critical | Bounty |
Prod contract address: ZRX.e Copy Copied 0x596fa47043f99a4e0f122243b841e55375cde0d2 | Web3 | Critical | Bounty |
Prod EVM Bridge Enclave Address: Avalanche Copy Copied 0xeb1bb70123b2f43419d070d7fde5618971cc2f8f | Web3 | Critical | Bounty |
Prod BTC Bridge Enclave Address: Avalanche Copy Copied 0xf5163f69f97b221d50347dd79382f11c6401f1a1 | Web3 | Critical | Bounty |
Prod EVM Bridge Enclave Address: Ethereum Copy Copied 0x8eb8a3b98659cce290402893d0123abb75e3ab28 | Web3 | Critical | Bounty |
Prod BTC Bridge Enclave Address: Bitcoin Copy Copied bc1q2f0tczgrukdxjrhhadpft2fehzpcrwrz549u90 | Web3 | Critical | Bounty |
Testnet bridge front end for testing Copy Copied https://test.core.app/bridge | Web | Critical | Bounty |
Testnet EVM Bridge Enclave address: Avalanche: Copy Copied 0x93753a9ea4c9d6eeed9f64ea92e97ce1f5fbaede | Web3 | Critical | Bounty |
Testnet Bridge Enclave address: Ethereum (Goerli) Copy Copied 0x0d90114dfddac9892cd2da88412b15b929680fe8 | Web3 | Critical | Bounty |
Testnet Bridge Enclave address: Bitcoin Copy Copied tb1q8nur2k3xphnsqa5zxgjl7djtkj3ya0gfs96nxk | Web3 | Critical | Bounty |
Testnet contract address (subject to change): BTC.b Copy Copied 0x0f2071079315ba5a1c6d5b532a01a132c157ac83 | Web3 | Critical | Bounty |
Testnet contract address (subject to change): DAI.e Copy Copied 0x2f20537c2f5c57231866de9d0ce33d0681a200d4 | Web3 | Critical | Bounty |
Testnet contract address (subject to change): LINK.e Copy Copied 0x1741b9c475e0861a43b03f984928082ac4f3fb95 | Web3 | Critical | Bounty |
Testnet contract address (subject to change): USDC.e Copy Copied 0xdb84a45a28f019970ec46c8acaf2aa8215d6fe4b | Web3 | Critical | Bounty |
Testnet contract address (subject to change): USDT.e Copy Copied 0xa73c78c12c962e987a8b37f7b2e1e2a5f00f1fe8 | Web3 | Critical | Bounty |
Testnet contract address (subject to change): WBTC.e Copy Copied 0x8a11d879ebe06f475580ea22c5e8cc52772a6872 | Web3 | Critical | Bounty |
Testnet contract address (subject to change): WETH.e Copy Copied 0x678c4c42572ec1c44b144c5a6712b69d2a5d412c | Web3 | Critical | Bounty |
Prod bridge front end (reporting only - please test on testnet) Copy Copied https://core.app/bridge | Web3 | Critical | Bounty |
Enclave server (please test on testnet only) Copy Copied | Web | Critical | Bounty |
Ava Labs Warden server and blob storage endpoints (please test on testnet only) Copy Copied | Web3 | Critical | Bounty |
Testnet Bridge Enclave Address: Avalanche Copy Copied 0x9a3789061c69e14ca66251afa0e2efca0e04f1a5 | Web3 | Critical | Bounty |
Copied 0x152b9d0fdc40c096757f570a51e494bd4b943e50
Copied 0xd501281565bf7789224523144fe5d98e8b28f267
Copied 0x63a72806098bd3d9520cc43356dd78afe5d386d9
Copied 0x2147efff675e4a4ee1c2f918d181cdbd7a8e208f
Copied 0x98443b96ea4b0858fdf3219cd13e98c7a4690588
Copied 0x19860ccb0a68fd4213ab9d8266f7bbf05a8dde98
Copied 0xc3048e19e76cb9a3aa9d77d8c03c29fc906e2437
Copied 0x249848beca43ac405b8102ec90dd5f22ca513c06
Copied 0xd586e7f844cea2f87f50152665bcbc2c279d8d70
Copied 0x8a0cac13c7da965a312f08ea4229c37869e85cb9
Copied 0x5947bb275c521040051d82396192181b413227a3
Copied 0x88128fd4b259552a9a1d457f435a6527aab72d42
Copied 0x02d980a0d7af3fb7cf7df8cb35d9edbcf355f665
Copied 0xbec243c995409e6520d7c41e404da5deba4b209b
Copied 0x37b608519f91f70f2eeb0e5ed9af4061722e4f76
Copied 0xc7b5d72c836e718cda8888eaf03707faef675079
Copied 0x3bd2b1c7ed8d396dbb98ded3aebb41350a5b2339
Copied 0x8ebaf22b6f053dffeaf46f4dd9efa95d89ba8580
Copied 0xa7d7079b0fead91f3e65f86e8915cb59c1a4c664
Copied 0xc7198437980c041c805a1edcba50c1ce5db95118
Copied 0x50b7545627a5162f82a992c33b87adc75187b218
Copied 0x49d5c2bdffac6ce2bfdb6640f4f80f226bc10bab
Copied 0xabc9547b534519ff73921b1fba6e672b5f58d083
Copied 0x9eaac1b23d935365bd7b542fe22ceee2922f52dc
Copied 0x596fa47043f99a4e0f122243b841e55375cde0d2
Copied 0xeb1bb70123b2f43419d070d7fde5618971cc2f8f
Copied 0xf5163f69f97b221d50347dd79382f11c6401f1a1
Copied 0x8eb8a3b98659cce290402893d0123abb75e3ab28
Copied bc1q2f0tczgrukdxjrhhadpft2fehzpcrwrz549u90
Copied https://test.core.app/bridge
Copied 0x93753a9ea4c9d6eeed9f64ea92e97ce1f5fbaede
Copied 0x0d90114dfddac9892cd2da88412b15b929680fe8
Copied tb1q8nur2k3xphnsqa5zxgjl7djtkj3ya0gfs96nxk
Copied 0x0f2071079315ba5a1c6d5b532a01a132c157ac83
Copied 0x2f20537c2f5c57231866de9d0ce33d0681a200d4
Copied 0x1741b9c475e0861a43b03f984928082ac4f3fb95
Copied 0xdb84a45a28f019970ec46c8acaf2aa8215d6fe4b
Copied 0xa73c78c12c962e987a8b37f7b2e1e2a5f00f1fe8
Copied 0x8a11d879ebe06f475580ea22c5e8cc52772a6872
Copied 0x678c4c42572ec1c44b144c5a6712b69d2a5d412c
Copied https://core.app/bridge
Copied Copied Copied 0x9a3789061c69e14ca66251afa0e2efca0e04f1a5
| Target | Type | Severity | Reward |
|---|---|---|---|
Non Ava Labs Warden servers and other infra Copy Copied | Web3 | None | Bounty |
Copied Focus Area
In Scope Vulnerabilities
- Double minting
- Under-collateralizing on the Ethereum side
- Any kind of smart contract authority changes
- Application level denial-of-service attacks
- Unauthorized access to Wardens and Enclave servers
- Unauthorized write to public readable-only cloud storage endpoints
- Cryptographic vulnerabilities
- Leaked secrets or credentials
- Web 2.0 vulnerabilities that undermines normal bridge operation, modifies the user interface or can lead to stolen funds
Out of Scope Vulnerabilities
- Third-party Warden hosts and infrastructure
- Transaction privacy
- Social engineering, phishing and scams, including Self-XSS
- SGX vulnerabilities (unless remotely exploitable with a POC)
- Discovery of unpublished server IP or service endpoints
Program Rules
Program Rules
- All Avalanche General program rules apply.
- For the Avalanche Bridge, you are welcome to report any vulnerabilities you come across during normal interactions with the production Bridge at https://core.app/bridge. However, you must only perform security testing and develop PoCs on the testnet Bridge https://test.core.app/bridge .
- Please note: In cases where a size the the reward exceeds an equivalent of 10,000 USD, Avalanche is entitled to make the payment in one-year locked AVAX at the rate calculated based on a weighted average price of AVAX during 90 calendar days preceding the date of the respective validated report.
Rewards '%3e%3cpath%20d='M3%2021H24V24H0V0H3V21ZM6.75%2019.5C6.44587%2019.5006%206.14477%2019.4396%205.8649%2019.3205C5.58502%2019.2015%205.33219%2019.027%205.12167%2018.8075C4.91115%2018.588%204.74731%2018.3281%204.64006%2018.0435C4.5328%2017.7589%204.48436%2017.4555%204.49766%2017.1517C4.51095%2016.8478%204.58571%2016.5498%204.71741%2016.2757C4.84911%2016.0015%205.03502%2015.7569%205.2639%2015.5567C5.49279%2015.3564%205.7599%2015.2046%206.0491%2015.1105C6.3383%2015.0164%206.64358%2014.9818%206.9465%2015.009L9.3645%2010.9785C9.1434%2010.639%209.0181%2010.246%209.00182%209.84115C8.98554%209.43629%209.07888%209.03455%209.272%208.67835C9.46512%208.32215%209.75084%208.02471%2010.099%207.81743C10.4472%207.61016%2010.8448%207.50074%2011.25%207.50074C11.6552%207.50074%2012.0528%207.61016%2012.401%207.81743C12.7492%208.02471%2013.0349%208.32215%2013.228%208.67835C13.4211%209.03455%2013.5145%209.43629%2013.4982%209.84115C13.4819%2010.246%2013.3566%2010.639%2013.1355%2010.9785L15.5535%2015.009C15.6682%2014.9987%2015.7836%2014.9977%2015.8985%2015.006L19.8915%208.019C19.6046%207.59868%2019.4686%207.0935%2019.5058%206.58594C19.543%206.07837%2019.7511%205.59841%2020.0963%205.22442C20.4415%204.85043%2020.9032%204.60449%2021.4062%204.52678C21.9091%204.44906%2022.4236%204.54415%2022.8655%204.79653C23.3075%205.0489%2023.6508%205.44364%2023.8395%205.91631C24.0281%206.38897%2024.051%206.91163%2023.9043%207.39896C23.7576%207.88628%2023.45%208.30948%2023.0317%208.59945C22.6135%208.88942%2022.1093%209.02903%2021.6015%208.9955L17.6085%2015.9825C17.8379%2016.319%2017.9717%2016.7114%2017.9956%2017.118C18.0195%2017.5245%2017.9326%2017.9299%2017.7442%2018.291C17.5558%2018.652%2017.2729%2018.9552%2016.9258%2019.1681C16.5786%2019.381%2016.1802%2019.4957%2015.7729%2019.4999C15.3657%2019.5041%2014.965%2019.3978%2014.6134%2019.1922C14.2619%2018.9865%2013.9728%2018.6893%2013.7769%2018.3323C13.581%2017.9753%2013.4857%2017.5717%2013.5011%2017.1648C13.5165%2016.7578%2013.6421%2016.3627%2013.8645%2016.0215L11.4465%2011.991C11.3158%2012.0031%2011.1842%2012.0031%2011.0535%2011.991L8.6355%2016.0215C8.85679%2016.3611%208.98226%2016.7541%208.99864%2017.159C9.01503%2017.564%208.92172%2017.9659%208.72858%2018.3222C8.53544%2018.6785%208.24963%2018.9761%207.90137%2019.1834C7.5531%2019.3907%207.1553%2019.5001%206.75%2019.5Z'%20fill='%23050505'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_2777_6507'%3e%3crect%20width='24'%20height='24'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Stats 
Types
Hackers (17) View all
