Injective
Maximum reward
$500,000
Severity
Max. Reward
Critical$500,000
High$50,000
Medium$20,000
Low$1,000
Deposit required
$50
Findings submitted
290
Start date
3 Jun 2026
Please sign in as a researcher to join the bounty.
Log inIn scope
Severity
Min and Max Reward
CriticalUp to $500,000
High
Up to $50,000
Medium
Up to $20,000
Low
$1,000
Solidity smart contracts deployed by Injective. Assets are only in scope once deployed on-chain and verifiable in production. Code present only in repositories or development branches is not in scope. Production behavior is the source of truth for vulnerability evaluation.
Related GitHub organizations and repositories:
Name | Description | Asset |
|---|---|---|
| Peggy (Ethereum) | Deployed Peggy bridge contract on Ethereum mainnet. | |
| Swap Contract | Injective swap contract source. | |
| RFQ Contract | RFQ contract — TBD, still in audit. Will be added once audit completes. |
Out of scope
The following are out of scope for this Program. For generic exclusions, see the Cantina Bug Bounty Out-of-Scope Policy.
Scope Rules
- Assets are only in scope once deployed on-chain and verifiable in production.
- Code present only in repositories or development branches is not in scope.
- Production behavior is the source of truth for vulnerability evaluation.
Vendor Systems
Vulnerabilities found in the following vendor systems fall outside this policy and should be reported to the respective vendor following their disclosure policy:
- Cosmos-SDK
- IBC
- CometBFT
- CosmWasm
Production Reachability Requirement
Bugs are only in scope if they can be triggered in the current Injective mainnet environment through an enabled, reachable, and operational production execution path.
Findings that require functionality which is disabled, unreachable, or otherwise unavailable in the current mainnet deployment may be considered out of scope or downgraded in severity at the project’s discretion.
Examples of findings that are generally out of scope under this requirement include, but are not limited to:
- Issues in code paths that are blocked by current mainnet configuration, feature flags, governance parameters, module settings, or other deployment controls.
- Genesis import or export issues that cannot affect the currently running mainnet.
- Issues that exclusively affect sentry nodes and do not impact validator operation, consensus, funds, state integrity, liveness, transaction execution, or other mainnet security properties.
- Chainstreamer, telemetry, indexing, analytics, or other auxiliary service issues that do not affect deployed and operational mainnet protocol behavior.
Features Under Development
The following functionality is currently under active development and is not enabled on the live network:
- Cross Margining (Exchange Module)
While portions of the implementation may be present in the public codebase, this functionality is not currently active and cannot be exercised through any supported user, contract, governance, or network execution path.
Security findings that exclusively affect Cross Margining and do not impact any currently enabled production functionality may be classified as Informational or Low severity, at the project's discretion. Severity assessments and reward determinations will be based on the demonstrated impact to deployed and operational network components.
Releases
Releases with custom tags such as 'beta' are excluded from the bounty program. Only official releases (e.g., 1.15.0) are included.