Sui is a smart contract platform maintained by a permissionless set of validators that play a role similar to validators or miners in other blockchain systems.
Target | Type | Severity | Reward |
---|---|---|---|
https://github.com/MystenLabs/sui/tree/testnet/narwhal Blockchain/DLT - Sui Network Consensus | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/sui-node Blockchain/DLT - Sui Network | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/sui-core Blockchain/DLT - Sui Network | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/sui-types Blockchain/DLT - Sui Network | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/json-rpc Blockchain/DLT - Sui Network | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/json-rpc-types Blockchain/DLT - Sui Network | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/external-crates/move Blockchain/DLT - Sui Move | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/sui-adapter Blockchain/DLT - Sui Move | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/testnet/crates/sui-verifier Blockchain/DLT - Sui Move | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/main/crates/sui-framework Blockchain/DLT - Sui Framework | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/main/crates/sui-bridge | Protocol | Critical | Bounty |
https://github.com/MystenLabs/sui/tree/main/bridge | Protocol | High | Bounty |
https://github.com/MystenLabs/deepbookv3/tree/main/packages/deepbook | Smart Contract | High | Bounty |
Blockchain/DLT - Sui Network Consensus
Blockchain/DLT - Sui Network
Blockchain/DLT - Sui Network
Blockchain/DLT - Sui Network
Blockchain/DLT - Sui Network
Blockchain/DLT - Sui Network
Blockchain/DLT - Sui Move
Blockchain/DLT - Sui Move
Blockchain/DLT - Sui Move
Blockchain/DLT - Sui Framework
Theoretical entries, entries without any working POC and ones generated with ChatGPT/LLM tools will be discarded.Any medium or higher severity vulnerabilities should come with a working POC that can be demonstrated on a local test environment that can be reproduced with the instructions in the appendix.
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Vulnerabilities in Circuit Construction can lead to Loss of funds (Critical)
Issues leading to bugs or attacks resulting in significant loss of funds or Permanent freezing of funds or Permanent DoS/ Interruption on the CLOB that requires a protocol upgrade.
Limitations to number of orders that can be filled (Only fill 100 orders/trade where gas costs increases dramatically with respect to a normal order)
The following vulnerabilities are excluded from the rewards for this bug bounty program:
To maintain integrity, avoid potential conflicts of interest, and ensure an effective bug bounty/auditing program, the following restrictions apply:
Previous audits and known issues can be found at: https://github.com/sui-foundation/security-audits
The exchange rate between the two tokens should stay roughly the same since we will be burning a proportional amount of pool tokens as SUI is withdrawn. However, in the extreme case where a user is unstaking 1 MIST, this rounding error may cause ZERO pool tokens to be burnt, causing the pool token to effectively depreciate. If an attacker has a lot of 1 MIST stakes, they can withdraw them one by one, causing the pool token exchange rate to drop and other takers to “lose” their staking rewards. I put quotation marks around “lose” because the attacker themselves won’t get any of that rewards so this attacker doesn’t actually make economic sense. Rather the rewards stay in the rewards pool and will become dust.
This issue is mitigated by enforcing a minimum staking amount of 1 SUI or 10^9 MIST in this PR: https://github.com/MystenLabs/sui/pull/9961 Related Impact-in-Scope: Critical - Any other issue leading to theft or loss of valuable objects, with severity depending on the consequences of the issue and the preconditions for exploiting it.
Sui has included dev documentation and/or instructions to help in reviewing code and exploring for bugs:
https://docs.sui.io/ https://docs.sui.io/build/sui-local-network https://docs.sui.io/build/devnet https://github.com/MystenLabs/sui/blob/main/SECURITY.md
Hackers are encouraged to submit issues outside of the outlined Impacts and Assets in Scope.
If whitehats can demonstrate a critical impact on code in production for an asset not in scope, Sui encourages you to submit your bug report using the “primacy of impact exception” asset.
We are happy to thank everyone who submits valid reports which help us improve the security. However, only those that meet the following eligibility requirements may receive a monetary reward:
Response Times Critical - Response within 24 hours High - Response within 48 hours Medium and Low - Response within 72 hours
Experimental features are not guaranteed to be deployed to the Sui mainnet. These features are often in early stages of development and may undergo significant changes or even be discontinued. We are eager for whitehats to focus on code that already is live in mainnet, or will be soon.
Experimental features are those specifically mentioned in this exclusion list, as well as any features labeled as experimental in the source code, not in testnet or related documentation. This tag serves to notify researchers that the feature is subject to special rules under the bug bounty program.
All payouts for vulnerabilities identified within the experimental feature will be ineligible for a bug bounty.
zkLogin with Multisig https://github.com/MystenLabs/sui/pull/14145 https://github.com/MystenLabs/sui/pull/15023
zkLogin providers (Apple, Kakao, Slack) https://github.com/MystenLabs/sui/pull/14322
Enums
Researchers are encouraged to report vulnerabilities in experimental features following the same procedure as for standard features.