Chia

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, special tier (blockchain health severely impacted, or funds moved without permission) │ $25,000 - $50,000 │ $26,000 - $51,000 Critical (base tier, 90-day average $5,000) │ $5,000 - $10,000 │ $6,000 - $11,000 High │ $4,000 │ $5,000 Medium │ $2,000 │ $2,500 Low │ $500 │ $625 Submit a vulnerability CVE history 3 Last 12 months 4 Lifetime Denial of service 35 % Parsing/validation 25 % Access control 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Chia is the largest proof-of-space-and-time network by a wide margin, with netspace historically measured in exabytes contributed by tens of thousands of independent farmers running the reference client on consumer hardware. That gives it an unusual profile: the node software sits on far more physically distinct machines than most layer-one clients, because farming is a consumer activity, and the Rust libraries underneath it, chia_rs and clvm_rs , are consumed by third-party wallets and pools well beyond the reference client. Chia Network Inc. pays for six bounty-eligible repositories on HackerOne, with a base ladder of $500 low, $2,000 medium, $4,000 high and $5,000 to $10,000 critical, plus a conditional $25,000 to $50,000 tier reserved for findings that severely impact blockchain health or move user funds without permission. sorona.xyz adds 1.25× on top of whatever Chia awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 2 business days First response 2 business days Triage 14 business days Bounty In scope The program's structured scope carries six bounty-eligible SOURCE_CODE assets under github.com/Chia-Network , every one of them at maximum severity critical: chia-blockchain , chia-blockchain-gui , chia_rs , clvm_rs , chiapos and chiavdf . A security issue anywhere in any of them is accepted, and the hosted vault and the iOS signer sit alongside them as separate critical assets chia-blockchain in full: the full node and its peer protocol, mempool and block validation, the farmer, harvester and timelord services, the wallet daemon, plotting, and the RPC and daemon interfaces each of those exposes chia_rs , the Rust consensus and type library the node links against and that third-party wallets and pools embed directly, covering block and spend-bundle validation, condition checking, BLS handling and the Python bindings it ships clvm_rs , the ChiaLisp VM that evaluates every spend, including its serialization, cost accounting and FFI surface chiapos , the proof-of-space implementation: plotting, the plot file format and proof verification chiavdf , the verifiable-delay-function implementation timelords run, covering proof generation and verification chia-blockchain-gui , the desktop wallet application, which carries a bounty-eligible source-code row of its own The hosted Chia vault, listed as two URL assets at critical severity: vault.chiatest.net and api.vault.chiatest.net The Chia Signer iOS application, which the scope table lists across both its App Store entry and its TestFlight build Out of scope Anything tested against mainnet rather than testnet10 or testnet11, which the program rules out regardless of what you find Reports without a working proof of concept or without sufficient reproduction detail Duplicate reports where you are not the first person to have filed the issue Findings with no demonstrated security impact, including configuration observations and scanner output Social-engineering attacks aimed at the special payout tier: the program states plainly that it "must require no interaction of the user, social engineering attacks are excluded" Most-valued findings A consensus-level break that severely impacts blockchain health or moves user funds without permission. It is the only class that reaches the $25,000 to $50,000 tier, and it has to work with no user interaction Remote resource exhaustion against the full node that a cheap peer can trigger. Denial of service is the largest published class here at 35% and the one farmers feel first Malformed input to chia_rs or clvm_rs that makes two nodes disagree about the same block, which is a chain split rather than a crash A forged or cheapened proof in chiapos , or a shortcut through the delay in chiavdf , letting a farmer or timelord claim work it never did Access-control failures in the wallet daemon or its RPC surface that expose key material or let a remote caller authorise a spend Key handling in the hosted vault or the iOS signer, the two non-repository assets the program still prices at critical Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. You must be the first reporter; a finding already filed by someone else is closed as a duplicate and pays nothing A working proof of concept is required in most cases, and reports without one or without enough reproduction detail are not eligible All testing must target testnet10 or testnet11, never mainnet The $25,000 to $50,000 tier only applies where the Chia blockchain's health is severely impacted or user funds can be moved without permission, and the program requires no user interaction for it: social-engineering chains are excluded from that tier by name Follow HackerOne's disclosure guidelines; the program does not disclose reports it marks Informative Program stats 45 Reports resolved $301k Bounties paid 100% Response efficiency Disclosure Coordinated through HackerOne under Chia Network's own policy, which simply defers to HackerOne's disclosure guidelines and notes that reports marked Informative are not disclosed. Nothing there bars a third party from carrying the report, so sorona.xyz files alongside you and holds the details until Chia has shipped a fix and farmers have had a window to upgrade. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability