Robinhood

The following issues are out of scope and not eligible for rewards.

For generic exclusions, see the Cantina Bug Bounty Out-of-Scope Policy.

L2 / Chain-Specific

• The Arbitrum node software (Nitro and ArbOS) and the sequencer, public RPC, and feed endpoints that run it. Robinhood Chain is an Arbitrum chain; protocol-level bugs in this software are covered by Arbitrum's bug bounty program.
• Validator software and operations (operated by Offchain Labs and Alchemy)
• Internal sequencer infrastructure not reachable from public endpoints
• Generic DDoS (amplification, reflection, flooding) that does not exploit protocol- or implementation-specific weaknesses
• Theoretical transaction censorship by a small group of operators absent a demonstrated financial-impact path
• Improperly configured nodes (node operator responsibility)
• Hardware below recommended specs (node operator responsibility)
• Local attacks against nodes requiring prior access to that node
• Statesync peers are assumed trusted; findings against a malicious statesync peer are out of scope

Third-Party Code (report to the respective program)

• Vulnerabilities in third-party protocols themselves (LayerZero core, etc.)
• The Chainlink Data Streams aggregator and node operators, and incorrect data from third-party oracles in and of itself
• Arbitrum-authored contract code for the canonical bridge / rollup (OCL / Arbitrum's program)
• Core Blockscout software (Blockscout's program)
• Alchemy's RPC, Data API, and account-abstraction (gasless transaction) infrastructure, including its bundler and paymaster.
• Issuer-owned bridged token contracts (for example, USDG from the Global Dollar Network) and the third-party bridge paths that carry them.
• Third-party applications, protocols, and infrastructure built on or integrated with Robinhood Chain, including the partners listed under the Ecosystem section of our About Robinhood Chain page.

Robinhood-Specific

• Any repo, site, service, product, API, or resource not listed in the in-scope groups above
• Robinhood's traditional brokerage / equities platform (this program covers Robinhood Chain and crypto products only)
• Findings on Robinhood assets outside this program's scope belong in Robinhood's main bug bounty program; report them at robinhood.com/us/en/support/articles/report-security-vulnerabilities
• Internal Robinhood infrastructure not reachable from public networks (corporate VPNs, internal monitoring, CI/CD)
• Social engineering, physical attacks, attacks on Robinhood employees
• Vulnerabilities requiring access to a user's device, account credentials, or 2FA
• Findings reported to Robinhood through other channels prior to or concurrent with this program
• Best-practice recommendations with no demonstrated exploit path

Standard out-of-scope items per the Cantina Bug Bounty Out-of-Scope Policy.