Monad Consensus & Execution Bug Bounty

• Issues previously acknowledged in an audit report, see published audit reports here: https://github.com/category-labs/monad-audits/tree/main/client
• Any GitHub issues or pull requests raised to correct a bug prior to the bug being reported as part of this bounty program, found in the following two repos, are considered out of scope. This also applies to any newly discovered vulnerabilities that are a direct result of the same underlying root cause as a known, open issue.
  • https://github.com/category-labs/monad-bft/issues
  • https://github.com/category-labs/monad/issues
• Issues known to Monad Foundation or Category Labs but not yet made public.

General Known Risks:

• Attacks on the Consensus Trust Model: The security of the Monad protocol relies on a fundamental assumption of a supermajority of stake weight being non-faulty. Therefore, any attack scenario requiring more than 1/3 of the network's stake to be malicious is considered a fundamental, out-of-scope attack on the protocol's trust model and will not be considered a valid finding. This includes, but is not limited to, scenarios resulting in network finality failures, double-spending, or long-range attacks.
• Validator/Proposer Malicious Behavior: Reports related to attack scenarios by a malicious validator or proposer that are not economically rational - i.e. where the attacker cannot profit or the attack would cost more than any potential profit - are out of scope.
• Naive Attacks on Cryptographic Primitives: The utilized cryptographic primitives were selected due to their widely accepted hardness. Attacks requiring their breakage are out of scope unless they provide clear indices how the utilized algorithm outperforms existing attacks.
• Validator/Stake Centralization: This is an inherent social and economic dynamic of a PoS system, not a protocol bug.
• Transaction Censorship: The theoretical collusion of a small number of malicious validators to censor transactions is an acceptable risk and is addressed by social and economic countermeasures, not as a protocol vulnerability.
• Economic Attacks: Any attack that relies on an attacker spending a prohibitively high amount of gas or network resources (e.g., gas price manipulation or DoS via gas griefing) is considered an acceptable economic attack and is out of scope.
• Insecure and/or Inappropriate Node Configuration: Findings related to improperly configured nodes are considered out of scope, as it is the node operator's responsibility to ensure correct setup.
• Open Issues: Any open issues in our public trackers at the start of the contest are considered known risks and will not constitute a valid finding.
• Reporting and Performance Metrics: Telemetry and performance reporting failures are out of scope for bug reports, unless they enable a severe vulnerability like remote code execution (RCE) or a consensus node crash on a default configuration.
• These reports will only be considered in scope for QA submissions.
• General DDoS attacks: such as amplification, reflection, or flooding, that impact node or network availability but do not exploit protocol- or implementation-specific weaknesses.
• UI/UX Security: Security-related bugs in the user interface or user experience, such as sensitive information in logs or password brute force vulnerabilities, are out of scope as this contest is focused on the core protocol's security.
• Insecure Dependencies: Findings concerning insecure dependencies with known vulnerabilities are out of scope. The contest is focused on the custom Monad protocol code, not third-party libraries.
• Missing Best Practices: Findings related to missing general security best practices for API endpoints, such as the lack of security flags for HTTP-based APIs or rate limiting, are out of scope.
• Social Engineering: Any attack that relies on social engineering is out of scope and will not be considered a valid finding.
• Physical Attacks: Any attack that requires physical access to a node or its hardware is out of scope. This contest is limited to the security of the Monad protocol's software implementation.
• Local attacks against nodes: Any attack against the software running on a node that requires the attacker to have prior access to that node. This contest focuses on attacks that are possible against the components exposed over the network.
• Missing Optimisations: Findings that present a potential performance improvement in client code are out of scope, unless that improvement mitigates a viable attack scenario.
• C/C++ Undefined Behavior: Findings related to C/C++ undefined behavior are considered low severity unless a practical, demonstrable impact can be shown in a node’s default configuration. The mere existence of undefined behavior, without a clear and practical exploit, will not be considered a higher than low severity finding.

Monad-Specific Known Risks:

• EVM/EIP Deviation::
  • There are several notable EVM differences. For up to date reference refer to the developer documentation https://docs.monad.xyz/developer-essentials/differences
  • https://docs.monad.xyz/developer-essentials/summary
• RPC Compliance: The RPC is designed to be generally Ethereum-compliant but may have minor deviations due to Monad's unique adaptations. Reports on these deviations will not be considered valid findings.
  • See intentional differences: https://docs.monad.xyz/reference/
• Statesync Peer Trust Model: Statesync peers are assumed to be trusted. Findings demonstrating a malicious statesync peer are therefore out of scope.
• Hardware and Operating System Performance: Monad is a high-performance system designed to run on specific hardware and operating system requirements. Any performance degradation, synchronization issues, or consensus failures that result from a node operating on hardware or an operating system below the recommended specifications are considered out of scope. The security and performance model assumes that node operators will meet or exceed the minimum hardware and operating system requirements outlined in the official documentation. See the the monad docs as the source of truth for reference specs here: https://docs.monad.xyz/node-ops/hardware-requirements
• RaptorCast protocol DoS: findings that rely solely on exhausting cryptographic computation in the RaptorCast transport (e.g., forcing excessive handshakes or signature verifications) and do not exploit a protocol- or implementation-specific flaw are also out of scope.
• Attacks requiring an infeasible amount of MON: MON (Monad’s native token) issuance will be limited and therefore reports requiring large amounts of MON (in the ranges of type(uint256).max) are not in scope.
• Slashing: findings related to malicious validator behavior that would be mitigated by slashing is not in scope.

Files out of scope

Any code not reachable via a running node under default configuration (e.g., test, mock or fuzzing code) is out of scope. Any project, development, build configuration or build, scripting or other miscellaneous development or testing files are out of scope.

Findings concerning known vulnerabilities within third-party dependencies (‘**/third_party/*’) themselves are out of scope. However, a bug is considered a valid finding if it leads to a protocol-level vulnerability.

Any proof of concepts must demonstrate how the report is triggerable by an attacker, outlining the full attack path on a default node configuration, which exploits in-scope code.