Report smart-contract vulnerabilities affecting Arbitrum One and Arbitrum Nova under their specified mainnet bounty scope.
Key Details
- Program launched: 2021-08-31.
- Reports are submitted through Immunefi.
Reward
- Critical rewards are 10% of economic damage, with a $50,000 minimum and $2,000,000 maximum. High pays $10,000–$30,000, Medium $5,000 and Low $1,000.
- Any vulnerability remediable by the Security Council is capped at High. Arbitrum Nova and its contracts are also capped at High. Awards are USD-denominated and paid in USDC by the Arbitrum Foundation.
Scope
- Coverage is tied to Arbitrum One’s Rollup and Arbitrum Nova’s AnyTrust mainnet deployments. Listed targets span bridge/messaging contracts and other specified protocol components. A defect must affect an enabled feature of one of these chains.
- The scope also includes qualifying upgrades already approved by an on-chain constitutional DAO vote or non-emergency Security Council action while waiting in the relevant timelock or bridge, provided they have not been cancelled.
- Accepted impacts include principal theft/freezing, invalid assertions or BoLD challenge results, insolvency, reorg damage and network-wide outages. Protocol-enforced delays, honest-validator detection and the possibility of an upgrade affect severity.
Out of Scope
- Other chains, non-default configurations, disabled features and issues confined to upgrade windows, replay or archive synchronization are excluded when they do not affect the live canonical chain.
- Validator stakes, challenge bonds and protocol fee accounts are outside the user-fund impact tiers. An unchanged Geth defect is not an Arbitrum-specific finding.
- Tutorials, SDK issues, documentation discrepancies, isolated-node outages, L1 gas-pricing problems and other listed informational findings do not qualify as higher-severity impacts. Reporting the same flaw on One and Nova is a duplicate, not two rewards.
Rules
- Every report needs a PoC. KYC is required for payment. The program uses Primacy of Rules and the exact published asset/impact restrictions.
- Test locally using forks. Live-chain tests, third-party testing, social engineering, denial-of-service attacks and traffic-heavy automation are prohibited.
Submission Process
- Submit through Arbitrum’s Immunefi entry with a PoC tied to the affected public mainnet deployment or eligible pending upgrade. Consult the complete asset list and deployment-address references.
Resources and Contact
