Bug bounty
What is in scope, what each severity tier pays, and how to report.
Velocity pays bounties for vulnerabilities in its onchain program code and in its web application. Program bugs are paid across all four severity tiers; web application bugs are classified on the same scale but capped at the High tier. The tiers and example impacts follow Immunefi's Vulnerability Severity Classification System v2.3, and they are guidelines rather than a schedule: every submission is assessed on its own facts.
DO NOT CREATE A GITHUB ISSUE to report a security problem. Email security@velocity.exchange instead.
| Severity | Description | Bug bounty |
|---|---|---|
| Critical | Bugs that freeze user funds or drain the contract's holdings or involve theft of funds without user signatures | 10% of the value of the hack, min $10,000, max $100,000 |
| High | Bugs that could temporarily freeze user funds or incorrectly assign value to user funds | $2,000 to $10,000 per bug, assessed on a case by case basis |
| Medium | Denial of service, griefing, or theft of small amounts of funds requiring significant preconditions | $500 to $2,000 per bug, assessed on a case by case basis |
| Low | Other issues that don't qualify for the above tiers | $100 to $500 per bug, assessed on a case by case basis |
Severity tiers
Critical
- Direct theft of a significant amount of user funds without preconditions
- Permanent freezing, even after a program upgrade, of a significant amount of user or protocol funds
- Direct theft of a significant amount of protocol funds, or protocol insolvency
High
- Theft of user funds with preconditions
- Theft of protocol-held assets with preconditions
- Temporary freezing of funds
- Theft or permanent freezing of unclaimed yield, such as funding payments, fee accruals or rebates
- User or protocol funds that remain frozen after a program upgrade when specific preconditions are met
Medium
- Denial of service issues that can be resolved with an upgrade
- Griefing, meaning damage to users or the protocol with no profit motive for the attacker
- Program unable to operate due to insufficient token funds
- Theft of a small amount of funds, or theft requiring significant preconditions
Low
Other issues that do not qualify for one of the tiers above.
Web application
Web application bugs are classified using Immunefi's Websites and Apps impact list, but payouts are capped at the High tier regardless of classification. A finding that would classify as Critical against the web application is paid at the High cap, not the Critical rate.
- Critical, paid at the High tier cap: malicious interactions with an already-connected wallet, such as modifying transaction arguments or recipients; direct theft of user funds; retrieval of sensitive data such as passwords or private keys; execution of arbitrary system commands; or taking state-modifying authenticated actions on behalf of users without interaction
- High: injecting or modifying static content on the application without JavaScript, persistently; improperly disclosing confidential user information; changing sensitive user details without wallet interaction; or subdomain takeover
- Medium: reflected content injection, open redirects, or changing non-sensitive user details without wallet interaction
- Low: taking over broken or expired outgoing links, temporarily disabling user access to the site, or changing user details that require significant user interaction
Submitting a report
Email security@velocity.exchange with a detailed description of the attack vector. For Critical and High severity bugs we require a proof of concept carried out against a privately deployed mainnet program, not against the live deployment.
Bounties are paid in USDC or USDT. Alternative payment methods can be arranged case by case.
Out of scope
The following are not eligible for a bounty:
- Attacks that the reporter has already exploited themselves, leading to damage.
- Attacks requiring access to leaked keys or credentials.
- Attacks requiring access to privileged addresses, such as governance or admin.
- Incorrect data supplied by third party oracles. This does not exclude oracle manipulation or flash loan attacks.
- Lack of liquidity.
- Third party, offchain bot errors, for instance bugs in an arbitrage bot running against the program.
- Best practice critiques.
- Sybil attacks.
- Attempted phishing or other social engineering attacks involving Velocity contributors or users.
- Actively performing denial-of-service attacks against live services, or automated testing that generates significant traffic. Reporting one with a proof of concept in an isolated environment remains in scope under the Medium tier.
- Findings that duplicate the results of an independent security audit. Velocity periodically engages external auditors; submissions overlapping with an in-progress or completed audit's findings are known issues and are not eligible.
- Any submission violating Immunefi's rules.