Safe Ecosystem Foundation bug bounty programs
safe.global Updated
Safe Ecosystem Foundation runs one public program: a Sorona bug bounty paying up to $1,000,000.
- Top reward
- $1,000,000
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Safe Ecosystem Foundation runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Safe (Safe Smart Account)
Sorona · Bug bounty |
– | $1M | $50k | $10k | $1,000,000 | Partial | – | – | Open |
-
- Critical
- –
- High
- $1M
- Medium
- $50k
- Low
- $10k
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 6 excluded.
-
https://safe.global
Web
-
Batching and helper contracts: MultiSend.sol, MultiSendCallOnly.sol and CreateCall.sol
Products and areas
-
Fallback handlers: TokenCallbackHandler.sol, CompatibilityFallbackHandler.sol and ExtensibleFallbackHandler.sol
Products and areas
-
Proxy and factory contracts, SafeProxy.sol and SafeProxyFactory.sol, across every deployment network listed in the Safe Deployments repository
Products and areas
-
Safe core v1.5.0 and v1.4.1: Safe.sol and SafeL2.sol, where owner management, threshold checking, signature verification, module and guard dispatch and delegate execution all live
Products and areas
-
Safenet Beta Staking.sol v0.1.0
Products and areas
-
The legacy Gnosis Safe releases the table still carries, v1.3.0, v1.2.0 and v1.1.1, which hold a large share of the deployed value
Products and areas
-
The officially supported modules: Allowance Module v1.0.0 (AllowanceModule.sol), 4337 Module v0.3.0 (Safe4337Module.sol), Passkey Module v0.2.1 (SafeWebAuthnSignerFactory.sol, SafeWebAuthnSignerProxy.sol, SafeWebAuthnSignerSingleton.sol, SafeWebAuthnSharedSigner.sol, WebAuthn.sol and P256.sol) and Social Recovery Module v0.1.0
Products and areas
-
The program's scope table, which enumerates the contracts file by file out of the LGPL-3.0 safe-global/safe-smart-account repository and safe-global/safe-modules. Smart contracts only, and only the versions the table names
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything not on the enumerated contract list, including third-party modules and guards written by other teams
-
Chain-specific quirks: issues related to non-standard features or alternative gas schedules on EVM-compatible chains that differ from Ethereum Mainnet
-
Gas optimisations, which are efficiency findings rather than security ones
-
Issues already fixed in a newer contract version than the one you tested
-
Known issues already recorded in the published audits or in the documentation
-
The Safe{Wallet} web app, mobile apps and backend services, which are a separate asset paying only discretionary amounts
Recent changes
Reward and scope changes across every Safe Ecosystem Foundation program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Safe Ecosystem Foundation products, from the NVD.
-
CVE-2023-35801 High
A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing of arbitrary files. Successful exploitation requires an attacker to have access to a user account with write privileges. FME Flow 2023.0 is also a fixed version.
-
CVE-2022-38340 Critical
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.
-
CVE-2022-38339 Critical
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page.
-
CVE-2022-38341 High
Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
-
CVE-2022-38342 High
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks.
-
CVE-2020-22789 Medium
Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs.
-
CVE-2020-22790 Medium
Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs.
-
CVE-2018-20402 High
Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the three accounts are the same as the usernames, which are guest, user, and author. Logging in with these accounts will grant any user the default privilege roles that were also created for each of the accounts.
About this page
This page gathers every public program listed under safe.global: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.