Nimbus Wallet rulebook v1
CurrentInitial program.
Assets in scope
3 assets
| ID | Asset | Type | Target |
|---|---|---|---|
| NMB-1 | Web wallet | Website / app | https://wallet.nimbus.example |
| NMB-2 | iOS / Android app Latest store release only. | Mobile | com.nimbus.wallet |
| NMB-3 | SmartAccount factory | Smart contractPolygon | 0x99990000…00000abc |
Impacts & severity
Severity follows mechanically from the demonstrated impact.
- IMP-C1Extraction of private keys or signing a transaction without the owner's approvalMust demonstrate: Demonstrated signing or key extraction from a default-configured wallet.
- IMP-C2Direct theft of user fundsMust demonstrate: Assets leave a user's smart account without the user's authorization.
- IMP-H1Bypass of passkey recovery guardiansMust demonstrate: Recovery completes without the configured guardian threshold.
- IMP-M1Displaying incorrect transaction details to the signerMust demonstrate: The confirmation screen misrepresents recipient, amount or calldata for a signed transaction.
- IMP-L1Leak of non-sensitive user metadataMust demonstrate: Exposure of data that does not enable account compromise.
Proof-of-Concept requirements
- POC-1Reports must include a screen recording or scripted reproduction on the latest public release.
- POC-2Key-extraction claims must demonstrate extraction from a device the attacker does not physically control.
Testing restrictions
Allowed: Local mainnet fork (Foundry/Anvil, Hardhat) · Project-provided staging deployment
- TEST-1Testing on mainnet or public testnet deployed code is prohibited; use local forks.
- TEST-2Testing against pricing oracles or third-party smart contracts is prohibited.
- TEST-3Phishing, social engineering and physical attacks are prohibited.
- TEST-4Denial-of-service attacks against project infrastructure are prohibited.
Out-of-scope & exclusions
A closure as out of scope must cite one of these ids.
- EXCL-1Attacks requiring physical access to an unlocked device.
- EXCL-2Attacks requiring a rooted or jailbroken device.
- EXCL-3Clickjacking on pages with no sensitive actions.
- EXCL-4Missing security headers without demonstrated impact.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates, even when they describe a different attack path, unless they demonstrate a materially higher impact.
Issues listed in published audits or recorded as known-issue commitments before the submission timestamp are ineligible. Commitments may be revealed during a dispute.
Public disclosure requires approval from both parties after the fix is deployed and verified. Default embargo: 30 days after fix.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision. The mediator publishes a reasoned decision to both parties.
Rewards are paid in USDC on Polygon within 30 days of retest. KYC is required for payouts above $10,000.