Monad.xyz UI

Monad Foundation is an organization dedicated to supporting the development, decentralization, security, and adoption of the Monad protocol by providing a wide range of services including community engagement, business development, developer and user education, and marketing services.

Testing Guidelines and Prohibited Actions

• Authorized environments: Use a listed test environment when one is available. Otherwise, targeted, non-disruptive testing against an in-scope live site is permitted. Test only the assets listed in scope and read the out-of-scope section carefully. Affecting real funds is never allowed. Even if that is meant to protect those funds from being stolen by another attacker.
• Accounts and test data: Test through your own account, a dedicated test account, or an account whose owner has given explicit written consent. Use synthetic data. Use dedicated email addresses containing cantina-bounty, and include that marker in form submissions. Remove your test accounts and data whenever possible.
• Testing limits: Keep request volume low. Do not run off-the-shelf automated scanners, load tests, (distributed) denial-of-service tests, or other high-volume tests against production. Do not disrupt service or exploit a finding beyond the minimum evidence needed to demonstrate it.
• Other users and stop conditions: Do not access, modify, or delete another user’s account or data. If testing unexpectedly provides write access to a backend, database, CMS, deployment system, or another privileged component, stop and report it. Do not alter records to demonstrate impact.
• Third-party systems: Do not test infrastructure or services that Monad Foundation does not operate. Refer to the Out-of-Scope Targets section for the applicable exclusions.
• No Public Disclosure Without Consent: Do not publicly disclose details of any vulnerability before it has been addressed and you have received written permission to disclose.
• No Conflict of Interest: Individuals currently or formerly employed by the Monad Foundation, or who contributed to the development of the affected code, are ineligible to participate. Former auditors ARE permitted to participate so long as 3 months have passed since their most recent audit engagement in respect of the affected code.
• Social Engineering: Do not perform social engineering on other users or admins. Technical findings that rely on social engineering, such as reflected XSS requiring a crafted link, remain eligible if tested without targeting a real person.
• Physical security: Testing of physical security is out of scope and not permitted for testing.

Disclosure Requirements

Please report findings directly to the program on the Cantina bug bounty platform. Include:

• The affected asset, deployment, and version, where known.
• The required access, configuration, victim user interaction, and ALL other prerequisites required.
• Clear reproduction steps and the minimum proof of concept needed to demonstrate the finding.
• The observed behavior and supporting evidence, separated from the claimed impact and likelihood.
• A precise description of the impact of exploitation and an explanation, in non-technical terms, of what the actual risk is. Remove secrets and personal data from submitted evidence.
• Deliberately overstating the risk or omitting risk-reducing prerequisites can result in a lower bounty.

Report the finding promptly after confirming that it is reproducible. Stop testing once you have collected the minimum evidence needed to explain the finding. A delay in reporting may affect eligibility if it increases harm, enables disclosure to another party, or interferes with remediation.

Reward Eligibility

To be eligible for a reward, you must:

• Be the first to report a previously unknown, non-public vulnerability within scope.
• Meet the Disclosure Requirements above.
• Provide all KYC and other documents as requested.
• Not have exploited the vulnerability in a malicious manner.
• Not have disclosed the vulnerability to third parties prior to receiving permission.
• Comply with all Program rules and applicable laws.

You must also be of legal age in your jurisdiction and not reside in a country under sanctions or restrictions, as required by applicable laws.

Severity and Rewards

Findings are classified by Impact and Likelihood. The combination determines the severity and guides the reward amount.

Risk Classification Matrix: A finding’s severity is determined by its impact and likelihood. Findings with higher impact and likelihood result in higher severity. The table below determines the upper bound for the severity. Carefully review the following definitions to select the appropriate impact and likelihood. Deliberately overstating the risk can result in a lower bounty. The Monad Foundation security team will assess the severity fairly and may raise or lower the suggested severity.

Impact Definitions:

• Critical: A compromise that would cause severe harm to site visitors or Monad Foundation, such as severe loss of funds or takeover of an in-scope site or attacker-controlled content or scripts served to a broad audience from a Monad Foundation controlled surface. Examples include:
  • Unauthorized write access to backend (direct server / db access)
  • Serving of malicious rich content payload to the majority of site visitors
• High: Exploitation causes notable financial loss of user funds, discloses sensitive data, or harms trust, and the damage stays bounded to individual accounts, a subset of users, or a single asset. It breaks the confidentiality or integrity of an in-scope asset, and stops short of a full system compromise. Examples include:
  • Large data dumps of sensitive end-user data that can facilitate widespread phishing against Monad users.
  • Account takeover of a single user through an authentication or session-management flaw in the application, without relying on the victim disclosing credentials or taking an attacker-directed action, on a portal that holds personal data.
  • Stored XSS or content injection limited to a single low-traffic page or requiring a single user click.
  • Takeover of a dangling monad.xyz subdomain.
  • Server-side request forgery that allows access to sensitive data.
  • CSRF against a state-changing endpoint, such as forced form submission, which allows a password reset on a high-value account.
• Medium: Exploitation has a limited, contained effect, usually on a single user or a non-critical function, or it discloses information deemed sensitive by the Monad Foundation team that helps a later attack. Any effect on funds or sensitive data is minor and does not on its own harm user trust at scale. Examples include:
  • Reflected or DOM-based cross-site scripting that affects only the single user who triggers it.
  • Exposure of one user's form submission, or low-sensitivity metadata about another account.
• Low/Informational: The finding has little or no direct security impact; it can be a deviation from best practice, a hardening gap, or a defense-in-depth note. It creates no immediate risk to user funds and sensitive data of an in-scope asset, or it helps an attacker only when chained with a separate vulnerability.
  • Missing or weak security headers, or a cookie without the Secure or HttpOnly flag, with no demonstrated impact.
  • Clickjacking on a page with no sensitive action, or a verbose error that reveals no exploitable data.
  • A finding that matters only when chained with another bug, such as a self-XSS or a login CSRF with no state change.
  • A dangling subdomain without a mechanism to change it.

Likelihood Definitions:

Likelihood reflects how probable it is that an attacker who knows about the finding can successfully exploit it. The following factors are taken into account: attack cost, access to a privileged account, leaked credentials, another vulnerability compounding with this one, required user interaction, reliability of exploitation, attacker incentive, dependence on rare events or timing, and detectability of the attack.

• High: Exploitation has effectively no cost, no prerequisites, and no meaningful user interaction. It is reliable and repeatable, and the finding is easy to reach. For example:
  • An unauthenticated endpoint that anyone can call directly to obtain sensitive data.
  • A stored payload that runs in the victim’s browser when they open a commonly viewed page on the web app in scope.
• Medium: Exploitation depends on conditions that are plausible but not guaranteed, such as limited privileges, some user interaction, or a narrow time window. It takes moderate effort and does not succeed on every attempt. For example:
  • An attack that needs a semi-privileged, non-admin, signed-in account, such as one team member acting against another beyond the intended behavior.
  • A payload that runs only after the victim opens a crafted link which the attacker sends.
  • A flaw that works only inside a short window, such as a short-lived token's lifetime. For example, using a compromised short-lived OAuth token to access a user's data.
  • An attacker needs to spend hundreds of dollars on CAPTCHA solvers to complete form submissions before the attack generates an impact.
• Low: Exploitation requires rare preconditions, or unusual user interaction that an attacker rarely controls. The cost is high and the success rate is low.
  • A race with a tight timing window that an attacker rarely wins.
  • Needing to guess a pseudo-random value. If the likelihood is extremely low, such as guessing a securely randomly generated UUID, this can be downgraded to out of scope.
  • A clickjacking attack requiring a user to type or paste text.
  • Moderately weak password policy with a password-guessing technique that has a built-in rate limit.
  • An attacker would need to observe network traffic of the victim in order to exploit the vulnerability.

Risk Classification Matrix

Severity Level	Impact: Critical	Impact: High	Impact: Medium	Impact: Low
Likelihood: High	Critical	High	Medium	Low
Likelihood: Medium	High	High / Medium	Medium	Low
Likelihood: Low	Medium	Medium / Low	Low	Informational

Note: Actual reward amounts are determined at Monad Foundation’s sole discretion. Factors influencing payout include report quality, completeness, and severity/exploitability.

Payouts are handled by the Monad Foundation team directly and are denominated in USD. Payouts are done in USDC or MON at the Monad Foundation teams' discretion. MON payouts will be determined using the 14 day TWAP calculated as of the payment date. The Monad Foundation requires an invoice to be received via email for each payout. An invoice template can be provided by the Monad Foundation.

Other Terms

By submitting a report, you grant Monad Foundation the rights necessary to investigate, mitigate, and disclose the vulnerability. Reward decisions and eligibility are at the sole discretion of Monad Foundation. The terms, conditions, and scope of this Program may be revised at any time. Participants are responsible for reviewing the latest version before submitting a report.