SSV Network Bug Bounty
Find smart contract vulnerabilities in SSV Network, a distributed-validator infrastructure network for Ethereum staking.
Key Details
- Program launched: 2023-09-11.
- Reports are submitted through Immunefi.
Reward
- Critical rewards are 10% of directly affected funds, with a $50,000 minimum and $250,000 maximum. High pays $30,000, Medium $10,000 and Low $1,500.
- Awards are USD-denominated and settled in SSV using the average CoinMarketCap and CoinGecko price at report submission. Liquidity and slippage do not adjust the conversion.
- The cumulative program pool is capped at 150,000 SSV. A payout cannot exceed the remaining tokens, even when an individually calculated USD award is larger. Token price changes affect the pool’s dollar value.
- For repeatable attacks, only the initial attack is rewarded, regardless of whether the contract can be upgraded, paused or disabled.
Scope
- The listed targets are SSV Network and SSV Network View. Critical impacts cover principal theft, permanently inaccessible funds and insolvency. High covers lost or frozen yield and temporarily inaccessible funds; Medium includes block stuffing, griefing and gas theft; Low includes failure to deliver returns without principal loss.
- Primacy of Impact applies to all four listed smart-contract severity levels, including qualifying impacts on other project-owned assets. Separate projects and test/mock files do not inherit that coverage.
Out of Scope
- Unfixed audit findings and issues already documented in SSV documentation or any branch of the specified repository are ineligible.
- The page identifies accepted design issues involving effective-balance root timing, removed-operator fee indices, permissionless deposits invalidating cluster state, theoretical accounting overflow and liquidation-liveness dependence.
- Generic economic/governance attacks, insufficient liquidity, Sybil and centralization risks, leaked credentials and privileged-address assumptions are excluded under the published scope rules.
Rules
- A functional PoC is mandatory at every severity. KYC follows validation and requires government ID and current address evidence.
- Public disclosure needs express SSV DAO Grants Committee approval. Testing must use local forks, without attacks on live deployments, third parties, service availability or users.
Submission Process
- Use the SSV Network Immunefi submission entry. Supply a compliant PoC and select the relevant listed asset or Primacy of Impact placeholder. Rewards are administered by the SSV Network Grants Committee.