Nimbus Wallet
LiveSelf-custodial smart wallet with passkey recovery.
Rewards by severity
When you submit, the report is permanently bound to this version (fingerprint d00fa909bd…2c9b). Scope, impacts, rewards, SLAs and policies can't be changed for your report later, even if Nimbus Wallet Inc. publishes a new version.
Assets in scope
3 assets
| ID | Asset | Type | Target |
|---|---|---|---|
| NMB-1 | Web wallet | Website / app | https://wallet.nimbus.example |
| NMB-2 | iOS / Android app Latest store release only. | Mobile | com.nimbus.wallet |
| NMB-3 | SmartAccount factory | Smart contractPolygon | 0x99990000…00000abc |
Track record
Computed from case events. Projects can't edit these numbers.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates, even when they describe a different attack path, unless they demonstrate a materially higher impact.
Issues listed in published audits or recorded as known-issue commitments before the submission timestamp are ineligible. Commitments may be revealed during a dispute.
Public disclosure requires approval from both parties after the fix is deployed and verified. Default embargo: 30 days after fix.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision. The mediator publishes a reasoned decision to both parties.
Rewards are paid in USDC on Polygon within 30 days of retest. KYC is required for payouts above $10,000.