Starknet Bug Bounty
Report vulnerabilities affecting the listed Starknet rollup, Cairo/OS components, L1 contracts and web assets.
Key Details
- Program launched: 2022-10-19.
- Reports are submitted through Immunefi.
Reward
- Blockchain/DLT: Critical $15,000–$250,000; High $10,000; Medium $2,500. Smart-contract Critical rewards are $15,000–$250,000. Web/app Critical pays $5,000–$10,000 and High $1,250–$2,500.
- Critical blockchain and contract awards are limited by 10% of economic damage, subject to the stated floor and maximum. The team evaluates affected funds and other stated considerations. Awards are denominated in USD and paid in USDC.
Scope
- Three scope categories cover Blockchain/DLT, Smart Contract and Web & App. Listed targets include Starknet OS, Cairo components, Starknet L1 core contracts and associated libraries, interfaces and components.
- The scope table covers permanent fund loss/freezing, total transaction-confirmation failure, chain partition and the listed STWO verifier-soundness impact, with distinct severities. Contract and web findings must match their own accepted impacts.
- The codebase links point to StarkWare libraries and StarkGate contracts. Being present in a repository alone does not establish bounty eligibility. Other StarkWare-managed assets with listed impacts can be submitted for consideration, without a guaranteed award.
Out of Scope
- Sequencer bugs, malicious-operator exploits under the program’s stated decentralization condition, tests/helpers, best-practice critiques and findings already reported on Immunefi or another bounty platform are excluded.
- The scope’s generic exclusions cover oracle-supplied incorrect data, ordinary economic/governance attacks, liquidity shortages, Sybil and centralization risks, leaked credentials, privileged-address attacks and unsupported configuration/test impacts.
Rules
- Smart-contract reports need executable PoC code demonstrating an effect on an eligible asset; explanatory assertions alone do not qualify. The page also requires a PoC at all severities.
- Reward eligibility requires KYC and OFAC screening. StarkWare staff, engaged auditors/contractors, parties with privileged information and associated parties are excluded.
- Use local forks. Do not test live deployments, attack third parties, conduct social engineering or disrupt services.
Submission Process
- Submit through the Starknet Immunefi entry and identify the correct target and impact. Review the linked audits, known issues and asset restrictions before reporting.