All programs
Tidal Bridge
Liveby Tidal Foundation
Trust-minimized cross-chain messaging and token bridge.
BridgeSolidityEthereumOptimismBaseArbitrum
Max bounty
$2,500,000
Partially funded$800,000 reserve
Critical
Up to $2.5M
10% of funds at risk · min $250K
High
$100,000
Fixed reward
Medium
$20,000
Fixed reward
Low
$5,000
Fixed reward
Impacts in scope
Once an impact is demonstrated, the severity follows mechanically. It can't be negotiated after the fact.
Critical
- IMP-C1Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yieldMust demonstrate: Attacker-controlled address ends with assets previously owned by a user or the protocol, without their authorization.
- IMP-C2Permanent freezing of fundsMust demonstrate: User or protocol funds become irrecoverable by any party, including via upgrade or governance.
- IMP-C3Protocol insolvencyMust demonstrate: Liabilities exceed assets such that not all users can withdraw.
High
- IMP-H1Theft of unclaimed yieldMust demonstrate: Attacker obtains yield/rewards accrued to other users that had not yet been claimed.
- IMP-H2Temporary freezing of funds for at least 24 hoursMust demonstrate: Users cannot withdraw for ≥ 24h, recoverable without loss of principal.
Medium
- IMP-M1Smart contract unable to operate due to lack of token fundsMust demonstrate: A core function reverts for all users because the contract lacks required balance.
- IMP-M2Griefing (no profit motive for attacker, but damage to users or protocol)Must demonstrate: Demonstrated measurable loss to users/protocol with no attacker profit.
Low
- IMP-L1Contract fails to deliver promised returns, but doesn't lose valueMust demonstrate: Returns deviate from documented behavior; principal unaffected.