CLVM

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (asset capped at the $10,000 row; the $50,000 tier is not bound to this scope) │ $10,000 │ $11,000 High │ $4,000 │ $5,000 Medium │ $2,000 │ $2,500 Low │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Denial of service 35 % Memory safety 25 % Parsing/validation 25 % Code execution 10 % Latest advisories Loading the feed Overview CLVM is the deterministic execution layer of the Chia blockchain: every transaction is a CLVM program and every full node evaluates it, so the VM's behaviour is not an implementation detail but the consensus rule itself. Its footprint is modest in absolute terms and worth stating as such, but it is one of very few small, self-contained, formally specified virtual machines with a cash bounty attached and no clause anywhere in the program text that discourages a third party from carrying the report, which makes it the cleanest legal fit for sorona.xyz's model of any language runtime we track. Chia Network Inc. scopes clvm_rs and chia_rs as their own bounty-eligible rows on HackerOne and pays $500 for a low, $2,000 medium, $4,000 high and $10,000 critical. sorona.xyz adds 1.25× on top of whatever Chia awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 2 business days First response 2 business days Triage 14 business days Bounty In scope clvm_rs and chia_rs each hold a bounty-eligible SOURCE_CODE row of their own on the Chia Network program, both tagged "Chia RUST implementations" and both at maximum severity critical. They are separate rows from the node and the desktop app, so the VM is covered in its own right and anything in either library is accepted The CLVM interpreter in clvm_rs : operator dispatch, cost accounting, and how atoms and cons cells are allocated, compared and released Serialization and deserialization of CLVM programs and of the tree structures they evaluate over The cost model and every operator it prices, which is a consensus rule rather than local tuning chia_rs in full: the consensus types, block and spend-bundle validation, condition checking, BLS signature verification, and the coin and puzzle paths the node calls into The packaging surface of both libraries: the Python wheels they ship, the generated bindings, and the FFI boundary between the Rust core and the nodes, wallets and pools that embed them Out of scope chia-blockchain and chia-blockchain-gui , which are the node and the desktop application rather than the VM and are scoped separately chiapos , the proof-of-space implementation, and chiavdf , the verifiable delay function, both of which have their own scope rows The Chia Cloud wallet at vault.chiatest.net , its API, and the iOS signer application Any testing pointed at mainnet instead of testnet10 or testnet11 Reports without a working proof of concept or enough detail to reproduce the evaluation Duplicates where someone else filed the same VM issue first Most-valued findings A determinism failure that makes two nodes evaluate the same program differently. That is a chain split, and the clearest route to the top of this ladder A mispriced or unbounded operator in the cost model that lets a cheap spend consume disproportionate node time. Denial of service is the largest published class here at 35% Memory-safety defects in the Rust interpreter reachable from serialized CLVM, whether an out-of-bounds read on an atom or unsoundness in the allocator Deserialization flaws in the program-tree parser: depth handling, malformed cons structures, and integer handling on the way in Bugs at the FFI and Python-binding boundary that let a hostile program reach code execution inside a wallet that embeds the VM Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. You must be the first reporter; a duplicate of an existing report is not paid A working proof of concept is required in most cases, for a VM finding, that means the program text or serialized input that triggers it Any testing that touches a live network must be pointed at testnet10 or testnet11, never mainnet Scope for this asset is clvm_rs and chia_rs specifically; chia-blockchain , the desktop app, chiapos and chiavdf are separate rows and are priced under their own entries The second bounty-table row carrying a $50,000 critical is not attached to any scope asset, so $10,000 is the figure to plan against here Follow HackerOne's disclosure guidelines; the program does not disclose reports it marks Informative Program stats 45 Reports resolved $301k Bounties paid 100% Response efficiency Disclosure Coordinated through HackerOne under Chia Network's policy, which defers to HackerOne's disclosure guidelines and says only that Informative reports are not disclosed. There is no confidentiality or third-party term to work around, so sorona.xyz files with you and holds the details until a fixed clvm_rs release is out and nodes have had a window to upgrade. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability