Interactive previewDemo data only. Sign in as any example account and try anything. Resets nightly.Launching soon
BESCBESC ecosystem
Join
BountiesCompetitionsResearchersPricingResources
Sign inLaunch a program
All programs

Nimbus Wallet

Live
by Nimbus Wallet Inc.

Self-custodial smart wallet with passkey recovery.

WalletTypeScriptBESC HyperchainEthereumPolygon
Max bounty
$100,000
Unfunded
Submit report
OverviewScope3Impacts & severity5Rules & policiesTrack recordVersions1
Critical
$100,000
Fixed reward
High
$25,000
Fixed reward
Medium
$5,000
Fixed reward
Low
$500
Fixed reward

Impacts in scope

Once an impact is demonstrated, the severity follows mechanically. It can't be negotiated after the fact.

Critical
  • IMP-C1
    Extraction of private keys or signing a transaction without the owner's approval
    Must demonstrate: Demonstrated signing or key extraction from a default-configured wallet.
  • IMP-C2
    Direct theft of user funds
    Must demonstrate: Assets leave a user's smart account without the user's authorization.
High
  • IMP-H1
    Bypass of passkey recovery guardians
    Must demonstrate: Recovery completes without the configured guardian threshold.
Medium
  • IMP-M1
    Displaying incorrect transaction details to the signer
    Must demonstrate: The confirmation screen misrepresents recipient, amount or calldata for a signed transaction.
Low
  • IMP-L1
    Leak of non-sensitive user metadata
    Must demonstrate: Exposure of data that does not enable account compromise.