BitGo Bug Bounty

The following issues are out of scope and not eligible for rewards under the bug bounty program.

Exceptions apply only if a submission includes a working on-chain proof-of-concept (PoC) that demonstrates real fund loss or unauthorized control on a supported chain deployment.

For generic exclusions, see the Cantina Bug Bounty Out-of-Scope Policy.

Out-of-Scope Chains

• Ethereum Classic (ETC)
• Celo
• Avalanche C-Chain
• Any legacy or non-standard EVM lacking full support for modern Ethereum-compatible opcode semantics (including chain-specific incompatibilities)

Design-Accepted & Trust Assumptions

The following are intentional design choices and are out of scope:

• Centralization or privileged-role risks (e.g., owner-controlled functions in Batcher.sol)
• Trust assumptions involving BitGo-operated multisignature ownership
• Any report assuming malicious behavior by trusted owners, operators, or signers without an authorization bypass

Off-Chain-Enforced Validation

The following validations are enforced off-chain and intentionally omitted on-chain. Reports relying on bypassing these checks are out of scope:

• Zero-address (address(0)) validation
• Wallet signer uniqueness or signer array validation
• Recovery wallet initialization correctness
• Any issue depending on manipulation of BitGo internal systems, APIs, or operational processes

Explicitly Excluded Vulnerability Classes

• Forced ETH deposits via SELFDESTRUCT: Reports demonstrating forced ETH transfers via SELFDESTRUCT and subsequent withdrawals, without an exploitable contract logic flaw enabling theft or privilege escalation.
• Key reuse across multiple wallets: Issues related to the same address being reused as a signer across multiple wallets.

Informational & Non-Exploitable Issues

• Gas optimizations
• Coding style or readability issues
• Best-practice recommendations without exploitability
• Missing or additional event emissions
• Monitoring, alerting, or observability gaps

The following exclusions apply to the EVM Stablecoin Contracts scope above. For generic exclusions, see the Cantina Bug Bounty Out-of-Scope Policy.

Out of Scope

• Third-party dependencies - report upstream unless the way this repo uses them introduces a novel vulnerability
• Issues requiring a compromised private key for any role holder
• Gas-optimization suggestions
• Front-end, off-chain infra, or deployment-secret handling not present in this repository

PoC exception: a report otherwise excluded above will still be considered if the submission includes a working proof-of-concept demonstrating concrete, exploitable impact beyond the stated exclusion (e.g., a third-party dependency issue that is only reachable and exploitable because of how this contract calls it).

Design-Accepted & Trust Assumptions

• Role holders are trusted within their granted powers
• Off-chain reserve backing for mint/burn
• Storage-layout safety is tooling-enforced, not chain-enforced
• Timelock asymmetry is intentional

Known Issues (Excluded)

• Lack of zero amount validations in functions
• Per-transaction mint cap bypass via batched/multicall submission
• Minter/bridge-minter role config desync via renounceRole
• Blacklist not enforced against the minter/burner msg.sender on mint/burn paths

Explicitly Excluded Vulnerability Classes

• Anything listed under Known Issues above
• Issues requiring a compromised or leaked private key for any role
• Denial of service caused solely by a role holder correctly exercising a role's documented permissions (e.g., FREEZER_ROLE pausing the contract) - this is intended emergency functionality, not an exploit
• Griefing that costs the attacker more in gas than the damage inflicted, with no path to profit or persistent harm
• Best-practice/style suggestions with no demonstrated security impact (e.g., missing indexed on event params, non-security NatSpec inaccuracies)

Informational & Non-Exploitable Issues

Findings that are technically correct observations but have no demonstrated path to loss of funds, unauthorized privilege, or availability impact will be accepted as informational acknowledgments but are not eligible for a reward tier.