Polkadot Bridge: Program info

Parity Bridges Common is a collection of components for building bridges. These include Substrate pallets for syncing headers and passing arbitrary messages, as well as libraries for building relayers to provide cross-chain communication capabilities.

Familiarize yourself with the bug bounty program requirements.

In case that your finding is valid you might be asked for extra KYC verification to proceed with payments

Rules of the road

Submission timing

Only submissions received by the official start date are considered. If you suspect that the flaw you found may be fatal for the items in the scope, please do not take further action. Instead, describe your assumptions as detailed as possible in the report.

Report critical flaws

If you identify a significant vulnerability, please stop at the point of recognition, gather the minimum amount of evidence necessary to demonstrate the issue, and report the vulnerability.

Duplicate submissions

Duplicate submissions within 72 hours of each will split the bounty. If duplicate submissions are of unequal quality, the split will be at the level of the lesser report, and the greater report will receive a prorated additional bounty on top of the split. Despite striving to be transparent as much as possible, we do not disclose other participant’s names in such cases.

Accidental access

Notify us immediately at [email protected] if you inadvertently access, modify, delete, or store user data by accident, and delete any stored data after notification.

Respect our infrastructure

Our security team will investigate and potentially increase the bounty if the impact is greater than initially assessed. Please refrain from attempts that could break the systems, as many participants share the bounty program resources.

Rules of conduct

Zero tolerance

Threats or extortion towards members of the Polkadot/Kusama ecosystem, including withholding security issues, releasing vulnerabilities or data to the public or third parties, or engaging in disruptive behavior, will lead to immediate disqualification.

Safe and supportive environment

We reserve the right to disqualify individuals acting in a malicious, disrespectful, or disruptive manner. Such actions undermine the shared goal of creating a safe and supportive space for all.

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization
• No vulnerability disclosure, including partial is allowed for the moment.
• Please do NOT publish/discuss bugs

We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through hackenproof.com
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must not be a former or current employee of us or one of its contractor.
• ONLY USE YOUR HackenProof ADDRESS (in case of violation, no bounty can be awarded)
• Provide detailed but to-the point reproduction steps