The Graph & Immunefi Bug Bounty Program

Details

The Graph Foundation is offering a record $2.5 million bug bounty to incentivize developers and ethical hackers to recognize vulnerabilities and shortcomings in the protocol. At present, this is the biggest active bug bounty program in the world. For this monumental endeavor, The Graph collaborates with Immunefi, which has an extensive knowledge pool in testing and securing Web3 protocols.

In this article, they provide the bounty details, highlighting the varieties of risks and vulnerabilities that the program is trying to address. Besides elaborating the program’s modalities, team discuss its rewards and overall scope. But before getting into all that, let’s introduce The Graph and Immunefi briefly, especially for the uninitiated.

What is Immunefi?

Immunefi is one of the most popular bug bounty platforms in Web3, where white hat hackers and security analysts review and rectify a project’s vulnerabilities. In doing so, these ethical hackers get handsomely rewarded for detecting threats and helping secure the participating projects. Immunefi is a pioneer in innovative blockchain-related bug bounties and has an enviable team of security experts.

Over the years, Immunefi has saved over $1 billion of users’ funds from being stolen or misused. In the process, ethical hackers have earned over $3 million in bounties. At present, the platform has bug bounties worth $26,251,214 locked in various projects.

As a platform, Immunefi has immense scope for both ethical hackers and project owners. Hackers can select bounty programs that match their skill, review the code, submit the bugs, and get paid. Simultaneously, projects can enhance their security with the help of experts at Immunefi. Because of these factors, among others, several leading names in the industry trust the platform. Binance, Chainlink, SushiSwap, PancakeSwap, Compound and Synthetix, for instance, have worked with Immunefi.

Why A Bug Bounty Program?

One might wonder, why do team needs a bug bounty program in the first place? Is it not enough and more feasible to have independent third-party audits? Not really. Bug bounties make protocols more robust than a run-of-the-mill code verification because bounties incentivize entire communities of code reviewers, rather than typical audits which engage a single audit firm.

Despite widespread use of audits, DeFi hacks have amounted to over $285 million since 2019. In light of this, Mitchell Amador, Founder and CEO of ImmuneFi, has said, “Last year more than $200 million were stolen by hackers through DeFi exploits and hacks that indeed question the effectiveness of traditional security methods.”

He went on to add, “Team at Immunefi strive to protect projects against smart contract hacks by helping create, run, and promote best practice bug bounty programs. They’re excited about this historic collaboration with The Graph.”

Bug Bounty Program Overview

Having discussed the basics, let us now elaborate on the primary aspects of the bounty program. The Graph Foundation is funding this program to ensure better security and reliability for the network’s global community.

The program goes live today, with a maximum reward of $2,500,000 to be paid in GRT tokens. 

The Bounty Program Rewards

White hat hackers get rewarded in accordance with the severity of the detected bug and the intensity of potential damage. This is based on a 5-stage scale outlined in the Immunefi Vulnerability Severity Classification System. Following is the scale and the associated rewards:

• Critical: Freeze contract holdings or empty funds like flash loan attacks, reentrancy (up to $2,500,000)

• High: Temporary suspension to transfer funds from token holders’ wallets ($200,000)

• Medium: Huge gas consumption and denial of service ($20,000)

• Low: Contract doesn’t return the promised returns ($5,000)

The rewards for critical security breaches are capped at 10% of the total economic damages that may result from coding vulnerabilities.

How To Register?

The process for registration is straightforward. In order to be eligible for bounties, bug bounty hunters will first need to register through The Graph Foundation’s KYC platform. Then, they can submit their bug reports with the necessary logs and data to Immunefi to receive a reward. Submissions should include the documents and coding to reproduce the vulnerabilities, as well as pointers for fixing the bugs.

Learn more about how to participate in the bug bounty at bugs.immunefi.com.

Which Scenarios are In-Scope Under the Bounty Program?

• Loss of funds due to bugs in smart contracts, gateway, or Indexer software
• Faulty query fees and indexing rewards payouts
• Economic attack where all stakeholders lose funds
• Impersonating network participants and consequent malicious activities
• Stolen private data due to bugs in the smart contract, Indexer software, or remote code execution
• Ineffective Indexer functionality
• Abnormal network load without sufficient GRT fees
• Inaccurate query data
• Griefing attack
• Sybil attacks
• Non-deterministic syncing of subgraph data (for graph-node only)

Which Scenarios are Not In-Scope?

There are no rewards for the following situations:

• Attacks or bugs exploited by the hacker
• Already identified bugs in third-party audits
• Frontrunning and sandwich attacks
• Liquidity shortage
• Governance attacks (eg, 51% attack)
• Wrong data by third-party oracles
• Attacks due to social engineering or leaked keys/credentials
• Critiques based on generally known security best practices

What Ethical Hackers Cannot Do

• Do not exploit the bugs or take advantage of them
• Do not violate the privacy of any stakeholders of The Graph
• Do not attack or defraud The Graph Foundation or any other ecosystem participants

How To Report Bugs?

They request hackers submit their bug reports responsibly to prevent any attack on The Graph. Thus, they must give The Graph Security Team enough time to fix the problems before making the vulnerabilities public.

Participants must note that only the first person to report the bug will be entitled to the relevant reward. They must submit the vulnerabilities with all the relevant links, documents, and codes. Only one form will be accepted for submission for any given vulnerability. However, bounty hunters are free to submit multiple forms for multiple vulnerabilities.

Any attempt to publicly disclose the vulnerability before resolving it will lead to the cancellation of the reward. The Graph Foundation and Immunefi reserve the right to disqualify anyone who doesn’t adhere to the rules and regulations of the bounty program. Finally, under no circumstances will The Graph Foundation negotiate for payments under any threat or coercion.

Learn more about how to participate in the bug bounty at bugs.immunefi.com.

What The Future Holds

A small step in bolstering crypto security, team believes, marks a giant leap forward for the entire domain. The $2.5 million bug bounty is historical; it is a first, but it need not be the last.

As the community around blockchains and cryptocurrencies becomes more mature, there’s strengthening demand for better security and reliability. In the long run, this would lay a robust foundation for Web3, liberating individuals in the process.

The Graph, for one, shall not restrain itself from incentivizing promising talents to bring out their best. Only then can the domain’s broader vision be realized. In the journey to the future, innovation is critical, and so is security. The two pillars, however, are related — a realization that underlies the bounty program. Participate in securing the web’s future and earn handsome rewards in the process. Remember, though, that the clock is ticking.