Chainlink node

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ $100,000 │ $101,000 High │ $10,000 │ $11,000 Medium │ $2,000 │ $2,500 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 30 % Denial of service 25 % Info disclosure 25 % Parsing/validation 15 % Latest advisories Loading the feed Overview The Chainlink node is the most widely run non-L1 node daemon in crypto: every Chainlink oracle operator runs it, and Chainlink price feeds are the pricing input for the large majority of on-chain lending and derivatives protocols across every major EVM chain. A node-level defect that lets an attacker influence what an operator reports is economically equivalent to an oracle manipulation attack on everything downstream, which is why the ladder here is steeper than almost anything else in open source. Note the boundary before you start: Chainlink's smart contracts are covered by a separate Immunefi program and are not what this asset pays for, and the node repo itself carves out several test-only sub-paths. SmartContract Chainlink Ltd pays on HackerOne, $100 at Low, $2,000 at Medium, $10,000 at High and $100,000 at Critical, with a stated bonus for reports that reach the node through an on-chain Chainlink request, although the program's average award runs $200 to $250 so the top row is a ceiling rather than an expectation. sorona.xyz adds 1.25× on top of whatever Chainlink awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~12 days First response ~13 days Triage not published Bounty In scope https://github.com/smartcontractkit/chainlink is a bounty-eligible SOURCE_CODE asset at a maximum severity of critical. The program carves out five test-only sub-paths and nothing else, which is what confirms the rest of the repository is in. The node daemon in full: the Go core service, the job pipeline engine and its task runners, the off-chain reporting plugins, and the chain relayers that talk to each network The key management layer and keystore, where an operator's signing keys live Authentication, session handling and authorisation across the node's API and the operator UI The persistence layer the node keeps jobs, runs and keys in, along with its migrations external-adapters-js , the adapter layer that fetches the off-chain data a job reports on, listed as its own SOURCE_CODE asset but capped at High severity, so it tops out at the $10,000 row The staking-v0.1 , chainlink-evm and chainlink-solana contract directories, which the program lists as SMART_CONTRACT assets at up to critical severity Out of scope The core/sgx , tools , integration , core/internal and examples sub-paths, which contain private keys and passwords for deterministic end-to-end testing and are not bounty-eligible The contracts inside the node repository, both the chainlink SMART_CONTRACT row and chainlink/contracts , which the scope table marks not bounty-eligible even though the repository's Go code is The contracts/src/*/dev directories, which the program states are in development and not production-ready chainlinklabs.com , which the scope table marks out of scope for the program entirely The *.smartcontract.com wildcard and most Chainlink web properties, which are submission-only with no bounty Documentation and blog properties, Intercom, and the other third-party SaaS the company runs on Most-valued findings Anything that lets an attacker influence what an oracle node reports on-chain, which is economically an oracle-manipulation attack on every protocol consuming the feed and the only realistic route to the $100,000 Critical row Extraction or misuse of an operator's signing keys out of the key management layer Job pipeline flaws where an attacker-controlled data source or task definition changes the node's execution rather than merely its output Authentication or authorisation bypass on the node's API or operator UI, which hands over the operator's job configuration A remotely reachable crash or resource exhaustion that takes an operator's node offline, since feed liveness is itself the security property here Parsing and validation bugs in adapter or RPC response handling that a malicious upstream can trigger Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Rewards are guidance, not entitlement: all final decisions are at the discretion of SmartContract The core/sgx , tools , integration , core/internal and examples sub-paths are submission-only and pay nothing, because they hold test keys and passwords by design external-adapters-js is listed at a maximum severity of High, so it tops out at the $10,000 row rather than the $100,000 one Reports that affect the node through an on-chain Chainlink request earn a stated bonus on top of the table The separate Immunefi Chainlink program covers smart contracts only and does not cover the node daemon Most Chainlink web properties, including the *.smartcontract.com wildcard, accept submissions but carry no bounty Program stats 137 Reports resolved $310k Bounties paid 20% Response efficiency Disclosure Coordinated under HackerOne's standard disclosure guidelines. The program policy sets no exclusivity, IP-assignment or KYC condition, so routing through sorona.xyz is unobstructed, and sorona.xyz holds your finding until Chainlink has resolved it and agreed to publication. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability