Join Sui Overflow, Sui's first global hackathon →
Find Bugs. Earn up to $500K by finding protocol bugs and vulnerabilities
As the Sui ecosystem evolves, the potential for bugs and vulnerabilities arises. The bug bounty program incentivizes white hat hackers to report issues, helping maintain a secure and stable platform while rewarding responsible disclosure.
Impacts in Scope The following impacts are accepted within this bug bounty program--refer to
Sui's HackenProof Bug Bounty Program Page for an official and up-to-date listing. All other impacts are considered out-of-scope and ineligible for payout.
Exceeding the maximum supply of 10 billion SUI + allowing the attacker to claim the excess funds Loss of Funds which includes: Violating BFT assumptions, acquiring voting power vastly disproportionate to stake, or any other issue that can meaningfully compromise the integrity of the blockchain’s proof of stake governance does not include the following: Network not being able to confirm new transactions (total network shutdown) requiring a hard fork to resolve Arbitrary, non-Move remote code execution on unmodified validator software Temporary total network shutdown or unintended chain split (duration greater than 10 minutes) A bug that results in unintended and harmful smart contract behavior with no concrete funds at direct risk Unintended, permanent burning of SUI under the max cap. Shutdown of greater than or equal to 30% of network processing nodes without brute force actions, but does not shut down the network Sending a transaction that triggers invariant violation error code in unmodified validator software A remote call that crashes a Sui full node
Frequently asked questions Where can I find more information on the bug bounty program?
How do I join the program?
If you find a bug or vulnerability, report it using the HackenProof dashboard . You should receive an acknowledgement of your report within 48 hours for critical vulnerabilities and 96 hours for all other vulnerabilities.
Where can I get technical questions answered?
Sui and HackenProof will be conducting Office Hours to answer questions. A date will be announced on Twitter by @SuiNetwork . If you are not able to attend, you can email questions to [email protected]
Who is behind this program?
The program is funded and managed by the Sui Foundation, in partnership with HackenProof.
