> For the complete documentation index, see [llms.txt](https://docs.shiftdefi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.shiftdefi.com/security/bug-bounty.md). # BUG BOUNTY ### Summary During the test period, Shift DeFi is running a Bug Bounty program to identify and address potential security vulnerabilities in the protocol. The program is intended to provide an additional layer of security review through independent security researchers. Bounties may be awarded according to the severity of reported vulnerabilities. Rewards may be offered for the following types of findings: On-chain Critical, On-chain High, On-chain Medium, Frontend & Backend Critical (Loss of Funds), and Frontend & Backend High (DoS). ### Scope The following Shift DeFi components are in scope for this Bug Bounty program: **Smart contracts** * * * * * * * **Frontend & Backend** * Shift DeFi web application: app.shiftdefi.com * Shift DeFi API: api.shiftdefi.com ### Severity criteria **On-chain Critical** * Unauthorized theft of user funds exceeding $1k, excluding unclaimed yield * Permanent freezing or irreversible loss of access to user funds resulting in at least $1k of funds being frozen **On-chain High** * Unauthorized theft of unclaimed yield exceeding $1k * Permanent freezing of unclaimed yield exceeding $1k * Temporary freezing of user funds exceeding $1k **On-chain Medium** * Temporary suspension of critical protocol functionality * Incorrect accounting or calculation that does not result in a direct loss of funds * Denial of service affecting non-critical protocol functionality **Frontend & Backend Critical (Loss of Funds)** * Unauthorized theft of user funds exceeding $1k resulting from a frontend or backend vulnerability * Exposure or compromise of sensitive data **Frontend & Backend High (DoS)** * Denial of service resulting in prolonged unavailability of critical protocol functionality ### Eligibility and submission guidelines * **Security vulnerabilities can be reported by email to** [**shiftdefi@proton.me**](mailto:shiftdefi@proton.me)**.** Reports should include sufficient information to reproduce and validate the vulnerability, including a proof of concept (PoC) where necessary to demonstrate exploitability or impact. * Only the first valid report of a vulnerability is eligible for a reward. Reports identifying the same underlying root cause may be considered duplicates, even if they describe different attack paths or impacts. * The severity criteria above provide general guidance and may not cover every possible vulnerability. Given the complexity of protocol security across smart contracts, frontend, and backend components, certain findings may require case-by-case assessment based on their actual impact and exploitability. ### Reward structure | Severity | Potential Reward | | --------------------------- | ---------------- | | On-chain Critical | $5,000 - $10,000 | | On-chain High | $2,000 - $4,000 | | On-chain Medium | $2,000 | | Frontend & Backend Critical | $5,000 - $10,000 | | Frontend & Backend High | $2,000 - $4,000 | ### Bug Bounty Exclusions #### Common Eligibility Exclusions Before submitting a report, researchers are strongly encouraged to verify that the finding does not fall into any of the categories below. #### General Exclusions * Best-practice recommendations without demonstrated security impact * New feature proposals * Theoretical vulnerabilities or impacts without a working proof of concept or demonstrated security impact * Automated scanner reports without demonstrated security impact * Impacts requiring access to leaked keys or credentials, unless the vulnerability itself enables their theft or compromise #### On-chain Exclusions * Impacts that do not result in a realistic risk of loss of funds or other material on-chain impact * Issues caused solely by a lack of liquidity or market depth, without a protocol vulnerability * Gas optimization issues without a material security or functional impact * Minor rounding, precision, or dust issues without a realistic and proven financial impact * Bugs that rely on incorrect data supplied by third-party smart contracts, except for oracle manipulation attacks #### Frontend and Backend Exclusions * Frontend and backend security testing is limited to publicly accessible domains under `*.shiftdefi.com`, including the infrastructure directly supporting the services hosted on them. All other domains, services, clusters, and infrastructure are out of scope * Impacts primarily caused by defects in third-party browsers, plugins, or extensions * Missing or improperly configured security controls without demonstrated security impact. Includes security headers, cookie security flags, CAPTCHA, rate limiting, and similar controls. * Exposure of non-sensitive technical information or credentials without demonstrated security impact, such as IP addresses, server names, software versions, account existence, or non-sensitive API keys (e.g. Etherscan, Infura, Alchemy) * Reflected plain-text injection without demonstrated security impact, including through URL parameters or path components. Reflected HTML/JavaScript injection and persistent injection are not excluded * Impacts limited to the attacker's own interface or session, including self-XSS, without affecting other users or the platform * Impacts requiring access to the victim’s device, data, or local network, or requiring unexpected or non-standard user actions outside normal application workflows, such as opening a malicious file, installing software, manually executing code or payloads, or performing other actions outside the normal application workflow * Availability impacts caused solely by traffic flooding or resource exhaustion, such as DDoS attacks * CSRF vulnerabilities without a meaningful security impact, such as logout CSRF * UI/UX issues that do not materially affect the security, functionality, or usability of the platform