
Cosmos
External Program
Submit bugs directly to this organization
Within the Cosmos ecosystem, we believe that proactively finding and fixing bugs is a vital part of building strong, resilient blockchain protocols. This program exists as a public good to actively reward the people who discover bugs in the Cosmos Stack that is built by decentralized development teams.
Our stack includes distributed systems protocols, cryptography, a smart contract platform, a consensus algorithm, and an interoperability protocol. As such, this program is not the right place to search for web application vulnerabilities like XSS, CSRF, and header misconfigurations.
The focus of this program is on surfacing vulnerabilities in the protocols, modules, and infrastructure that make up the Cosmos Stack. Assets in scope include source code for integral components of Cosmos, and do not include third-party services or IT assets.
Bounty rewards are based on multiple factors including impact, risk, likelihood of exploitation, and report quality. We use an impact/likelihood framework to assess criticality, available here.
While there is no maximum program reward at this time, we value creative findings and high-severity bugs, and we maintain a robust program budget to reward them accordingly.
We evaluate each report and are responsible for rating the severity of submitted issues. At our discretion, we may reward exceptionally high-quality reports or creative lower-severity findings at a higher tier.
Informational reports are not eligible for bounty rewards.
Rewards for eligible bugs are paid out according to issue severity:
If duplicate reports are received, a bounty (if applicable) will be awarded to the first valid reporter.
When an issue is on track to be mitigated or remediated, we will coordinate with researchers to credit the finding in advisories and release notes, and to support disclosure of valid issues reported through this program.
We are committed to working in good faith with anyone who believes they have discovered a vulnerability in the Cosmos Stack.
This policy, as hosted on HackerOne, is the official Coordinated Vulnerability Disclosure policy for the Cosmos Stack and the teams and infrastructure it supports. It supersedes all previous security policies used by individual teams or projects within scope.
For the most up-to-date version of this policy, please consult the HackerOne program page.
When working with us under this policy, you can expect us to:
When participating in this program in good faith, we ask that you:
Repeated submissions that do not meet program guidelines will result in a ban from the program.
Participants who violate these expectations may have their reports closed, deemed ineligible for bounty rewards, or be permanently banned from the program.
We are interested in a full range of vulnerabilities with demonstrable security impact, ranging from issues proven with unit tests to those requiring full cluster deployments and complex transaction flows.
Examples include (but are not limited to):
Only released code is eligible for bounty rewards.
To be considered valid and in scope:
main, master, or other development branches is not in scopeThe Release Family Policy is defined here:
https://github.com/cosmos/security/blob/main/POLICY.md
x/group, x/circuit, x/crisis, and x/nft modules are no longer in scope.Gaia is included only as a reference implementation of the Cosmos Stack.
All Hub-specific features, third-party modules, or non-core functionality in the Gaia repository are out of scope for bounty rewards.
All submissions must include a Proof of Concept demonstrating real-world impact and exploitability. The proof of concept must be code that can be read and run by the security team. Descriptions of attacks do not count as valid PoCs and will result in submissions being closed as "Not Applicable".
Submissions must be original work authored by humans. Reports generated or significantly assisted by AI tools (including but not limited to ChatGPT, Claude, Copilot, etc.) are prohibited and will result in immediate closure and potential program ban. All submissions must demonstrate genuine human understanding, manual testing, and original analysis.
To be eligible for consideration under our bug bounty program, researchers must meet the following criteria:
Submissions from researchers who do not meet these requirements will be closed as Spam. Repeated submissions that fail to meet these criteria may result in removal from the program and/or a platform ban.
To be eligible for a bounty reward:
All communication regarding submitted issues must occur exclusively on HackerOne.
External communication, out-of-band disclosures, or premature publication may void eligibility for bounty rewards and future participation.
Email reports are accepted for disclosure purposes only and are not eligible for bounty rewards.
Public disclosure is supported only after an issue is marked Resolved on HackerOne.
Researchers may request attribution in advisories or release documentation once disclosure is approved.
Researchers must act respectfully and in good faith at all times. Misconduct—including threats, harassment, extortion, or false accusations—will result in report closure and permanent exclusion from the program.
Research conducted in accordance with this policy is considered:
Safe Harbor applies only to claims under the control of participating organizations.