Monad Consensus & Execution Bug Bounty
Bounty Range
$35,000 - $1,000,000
external program
Bounty Range
$35,000 - $1,000,000
external program
Monad Foundation is an organization dedicated to supporting the development, decentralization, security, and adoption of the Monad protocol by providing a wide range of services including community engagement, business development, developer and user education, and marketing services.
No Unauthorized Testing on Production Environments: Do not test vulnerabilities on mainnet or public testnet deployments without prior authorization. Use local test environments or private test setup.
The README.md contains instructions for setting up a local installation with Docker as a recommended environment.
No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.
No Exploitation or Data Exfiltration: Do not exploit the vulnerability beyond the minimum steps necessary to demonstrate the issue. Do not access private data, engage in social engineering, or disrupt service.
No Conflict of Interest: Individuals currently or formerly employed by the Monad Foundation, Category Labs, or who contributed to the development of the affected code, are ineligible to participate. Former auditors ARE permitted to participate so long as 3 months have passed since their audit ended.
Social Engineering: Social engineering attacks are out of scope and not permitted for testing.
Physical security: Testing of physical security is out of scope and not permitted for testing.
Please report vulnerabilities directly to Cantina Platform. Include:
Reports should be submitted as soon as possible—ideally within 24 hours of discovery.
To be eligible for consideration and any reward, a researcher must:
You must also be of legal age in your jurisdiction and not reside in a country under sanctions or restrictions, as required by applicable laws.
Reports claiming DoS via out of memory, CPU consumption, or other hardware specific claims, must demonstrate the impact with at least a local full node setup.
PoCs exercising internal functionality (such as Rust or C++ specific internal functions classes or otherwise) must demonstrate their impact through a full node's publicly accessible entry point. A local full node setup will let us confirm your submission quicker.
Please see the following to run a local devnet (full node) (please note hardware requirements).
Vulnerabilities are classified by Impact and Likelihood. The combination determines the severity and guides the reward amount.
Report issue severity is determined by the issue's impact and likelihood. Findings with higher impact and likelihood result in higher severity. Review the definitions and table below select a severity when making a report.
Impact Definitions
Critical: Leads to severe loss of user funds, permanent system disruption, or widespread compromise. Examples include:
High: Causes notable financial loss or significantly harms user trust, but on a lesser scale than Critical.
Medium: Results in limited financial damage or moderate system impact.
Low / Informational: Minimal direct risk but may indicate areas for improvement.
NOTE: Applies to bugs/issues with the network code itself. Smart contract bugs in applications running on the Monad Network (Defi protocols, DEXes, etc.) are not within the scope of this program.
Likelihood Definitions
| Severity Level | Impact: Critical | Impact: High | Impact: Medium | Impact: Low |
|---|---|---|---|---|
| Likelihood: High | Critical | High | Medium | Low |
| Likelihood: Medium | High | High | Medium | Low |
| Likelihood: Low | Medium | Medium | Low | Informational |
| Severity | Max. Reward |
|---|---|
| Critical | $1,000,000 |
| High | $150,000 |
| Medium | $35,000 |
The team's primary concerns for the Monad protocol are focused on the following components:
Consensus Safety: The stability of the MonadBFT consensus mechanism is paramount.
Networking Layer (RaptorCast): The custom message delivery protocol is a potential attack surface.
Parallel Execution and State Integrity: Parallel execution is a core innovation and a critical area of concern.
Transaction and Fee Model: The custom gas model requires scrutiny.
MonadDB Integrity: The custom database (MonadDB) is essential for state management.
JIT VM and Interpreter: The Just-In-Time (JIT) compiler is a highly sensitive component.