Welcome to the Ethereum Foundation Bug Bounty Program

Required burn: —
Minimum severity: Low

Before submitting

Check the scope

Only targets listed on bounty.ethereum.org are eligible. Anything else is ignored.
Include a reproducible proof of concept
- A Kurtosis devnet, or a state test (EVM/goevmlab)
- Unit tests alone are not accepted
Compiler bugs are an exception Solidity/Vyper
- No devnet or state test needed
- The source that miscompiles
- The affected versions, plus one that works

Getting started: Kurtosis testnet guide Ethereum package.

Due to a large increase in reports, response time is likely to be multiple days.

Contact

Do not include personal identifiable information that is unrelated to the vulnerability.

Full name

Email address

Wallet address

Address to receive potential reward.

Leaderboard name

Shown publicly; a pseudonym is fine.

GitHub username

Linked from the leaderboard.

Target

What the bug affects, and how severe it is.

Target

Severity

Vulnerable version or commit

Release, tag, commit SHA, or client version where the issue was confirmed.

Bug report title

Report

Markdown is supported. Switch any field to Preview to check how it will render.

Short description

One sentence description of the vulnerability.

Attack scenario

In what scenario would this be an issue?

Impact

Describe the effect this may have in a production setting.

Components

Point to the files, functions, and/or specific line numbers where the bug occurs.

Proof of concept

A clear proof of concept is required. Without a clear reproducible attack, the issue will be ignored, and there is no refund. A Kurtosis-based PoC is preferred as it makes the bug clear and easily reproducible, but a state test (EVM/goevmlab) is also accepted.

Suggested fix optional

Additional information optional

Any details not covered above.

Welcome to the Ethereum Foundation Bug Bounty Program

Before submitting

Contact

Target

Report

Burn & submit

Select wallet

Thank you for your report