Bug Bounty Program 

Out of scope

Only the targets listed under in-scope are part of the Bug Bounty Program. Vulnerabilities that do NOT qualify under the program include:

• ✕Infrastructure bugs—such as webpages, dns, email, etc.^*
• ✕ERC-20 contract bugs^*
• ✕Ethereum Naming Service (ENS) bugs (maintained by the ENS foundation)
• ✕Vulnerabilities requiring the user to have publicly exposed an API, such as JSON-RPC or the Beacon API
• ✕EngineAPI is considered trusted and not meant to be publicly exposed
• ✕Typographical errors
• ✕Tests
• ✕High-effort (sustained, CPU or bandwidth intensive, and/or requires more than 1 packet or onchain transaction) single-peer DoS attacks
• ✕Any publicly known issues (includes forum posts, PRs, github issues, commits, blog posts, public discord messages, etc.)
• ✕Anything that does not currently have a direct impact on Ethereum mainnet.

^*These are not included, however, we can sometimes help reach out to affected parties

Bug hunting rules

The bug bounty program is an experimental and discretionary rewards program for our active Ethereum community to encourage and reward those who are helping to improve the platform. It is not a competition. You should know that we can cancel the program at any time, and awards are at the sole discretion of Ethereum Foundation bug bounty panel. In addition, we are not able to issue awards to individuals who are on sanctions lists or who are in countries on sanctions lists (e.g., North Korea, Iran, etc). Local laws require us to ask for proof of your identity. You are responsible for all taxes. All awards are subject to applicable law. Finally, your testing must not violate any law or compromise any data that is not yours and must take place on local running testnets.

1. 1Issues without a POC or that have already been submitted by another user or are already known to spec and client maintainers are not eligible for bounty rewards.
2. 2Public disclosure of a vulnerability or reporting it to other parties without prior agreement makes it ineligible for a bounty.
3. 3Employees and contractors of the Ethereum Foundation, Ethereum Foundation grantees, or client teams in scope of the bounty program may participate in the program only in the accrual of points and will not receive monetary rewards.
4. 4Ethereum bounty program considers a number of variables in determining rewards. Determinations of eligibility, score and all terms related to an award are at the sole and final discretion of the Ethereum Foundation bug bounty panel.