OpenSea Managed Bug Bounty Program

Description

OpenSea is building the most trusted and inclusive NFT marketplace with the best selection. Trust, safety and security are core areas of focus, which means that finding and eliminating vulnerabilities is a top priority. We value our partnership with the vulnerability hunting community, and as such we ensure all reports are reviewed by security experts and acted upon appropriately. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of OpenSea not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Access: Accounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Program Rules: Please carefully review these rules, as they will govern any report you submit. If there are any conflicts between these rules and ​​Bugcrowd’s standard disclosure terms referenced below, these rules will take precedence. Reports: Please provide detailed reports with reproducible steps. . If the report is not detailed enough to reproduce the issue, the report will not be eligible for a reward. Please consider (1) attack scenario / exploitability, and (2) security impact of the vulnerability. Researchers may only submit one vulnerability per report, unless there is a need to chain vulnerabilities to provide impact. When multiple researchers identify and report the same underlying issue, OpenSea will award any applicable bounty to the first eligible report that was received. Vulnerabilities that OpenSea is aware of already will not be rewarded. Reports that identify multiple vulnerabilities caused by one underlying issue will be awarded at most one bounty. Issues identified by a reporter will be paid at most only once, even if the same issue can be exploited on multiple in-scope assets or on contracts deployed across multiple chains. Searching for Potential Vulnerabilities: Researchers may not impact production systems in a negative way for any testing. All smart contract testing should be done with a forked local copy of mainnet. Social engineering (e.g. phishing, vishing, smishing) is prohibited. Avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. Failure to adhere to any of the terms in this section will make you ineligible for a bug bounty reward. Out of scope vulnerabilities The following issues are considered out of scope: Gas Optimizations in Smart Contracts Attacks requiring MITM or physical access or control over a user's device. This specifically means that client-side manipulation of Javascript is excluded without a demonstration of how to manipulate the Javascript remotely. Previously known vulnerable libraries without a working Proof of Concept. Rate limiting or bruteforce issues on non-authentication endpoints. Denial of service attacks (DDOS/DOS). Software version disclosure / banner identification issues / descriptive error messages or headers (e.g. stack traces, application or server errors). Clickjacking on pages with no sensitive actions. Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions. Missing HttpOnly or Secure flags on cookies. Vulnerabilities only affecting users of outdated or unpatched browsers (less than 2 stable versions behind the latest released stable version). Public zero-day vulnerabilities that have had an official patch for less than 1 month. While outside the scope of the official bug bounty program, OpenSea may still review these vulnerabilities, and may provide monetary awards at OpenSea’s sole discretion. Vulnerabilities that were publicly disclosed in any manner, prior to OpenSea receiving the report, and vulnerabilities of which OpenSea was otherwise already aware. Open redirect - may be eligible if it is part of a chain of issues, but not as a standalone issue. Clickjacking within an NFT displayed on OpenSea. Javascript execution on openseauserdata.com and raw.seadn.io are expected. To be considered in scope, you will need to demonstrate how it harms users on in scope assets. Wallet vulnerabilities - these should be reported to the respective wallet companies themselves. Copycat/copymint detection bypass - we are happy to have these reported but we are not providing rewards for them. All user wallet content such as NFTs owned, historical transactions, wallet balances, etc., are not considered confidential. Features of the website that allow accessing this content for another user is expected. Vulnerabilities reported by the same researcher to other entities either before or after their report to OpenSea. Vulnerabilities in code that is not fully deployed and in use in a mainnet or mainnet equivalent production code path. Vulnerabilities that require the victim to be using a wallet that is not one of: MetaMask Coinbase Wallet Ledger Phantom Bitkeep Kaikas Ledger Glow Solflare Venly OperaTouch Trust WalletConnect Proof of Concept Requirement Reports must include a clear proof of concept (PoC) demonstrating the reported vulnerability. The PoC should provide sufficient detail to reliably reproduce the issue, including any required prerequisites, reproduction steps, affected endpoints or assets, and evidence of the reported impact. Bounty Amount Discretion Vulnerability reports that are (i) in-scope, (ii) comply with OpenSea's bug bounty policy, (iii) comply with the Bugcrowd terms and conditions, and (iv) meet a baseline level of utility to OpenSea because the vulnerability is exploitable and impacts security will be rewarded a minimum of the "Low" reward amount in the corresponding asset category. Rewards for P1-P4 severity scores are at OpenSea's sole discretion and OpenSea is not obligated to pay any of these amounts. Dispute Resolution If you have any dispute about application of OpenSea’s bug bounty program, you must first attempt to resolve the dispute in good faith through Bugcrowd’s mediation process. If after completion of Bugcrowd’s mediation process, a dispute still exists, you agree to engage in good-faith efforts to resolve such dispute prior to initiating formal legal action. You must initiate this dispute resolution process by sending a letter describing the nature of your claim and desired resolution to: OpenSea, Attn: Legal Department, 228 Park Avenue South, #22014, New York, NY 10003. You agree to meet and confer personally, by telephone, or by videoconference (hereinafter “Conference”) to discuss the dispute and attempt in good faith to reach a mutually beneficial outcome that avoids the expenses of further legal process. If you are represented by counsel, your counsel may participate in the Conference as well, but you agree to fully participate in the Conference. Likewise, if OpenSea is represented by counsel, its counsel may participate in the Conference as well, but OpenSea agrees to have a company representative fully participate in the Conference. The statute of limitations and any filing fee deadlines shall be tolled while the parties engage in the informal dispute resolution process and Conference required by this paragraph. If the parties do not reach agreement to resolve the dispute within thirty (30) days after initiation of this dispute resolution process, either party may commence formal legal action. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding. Thank you for helping keep OpenSea and the NFT community safe!

Opensea.io (in scope)

opensea.io OpenSea is the world's first and largest web3 marketplace for NFTs and crypto collectibles.

Embedded Wallet Experience Powered by Privy (in scope)

All functionalities and features of the OpenSea Wallet, including wallet.opensea.io and embedded wallet features specific to opensea.io Exclusions: Phishing and Similar Attacks: Any form of social engineering, phishing, or related deceptive practices. https://dev-wallets.opensea.io Third-Party Services: Issues impacting the wallet provider, Privy, are out of scope and should be reported to the provider. Reporters are encouraged to follow Privy’s testing guidelines when assessing vulnerabilities related to their services.

io.opensea - Android App (in scope)

Official OpenSea Google Play Store app. The app can be found here Exclusions : Attacks that assume a malicious wallet app Attacks that require a rooted device Apps found anywhere besides the Google Play Store

io.opensea - iOS App (in scope)

Official OpenSea Apple App Store app. The app can be found here Exclusions: Attacks that assume a malicious wallet app Attacks that require a rooted device Apps found anywhere besides the Apple app store

OpenSea MCP (in scope)

The OpenSea MCP server. Exclusions: Manipulation of LLM responses, e.g. via prompt injection. Phishing and Similar Attacks: Any form of social engineering, phishing, or related deceptive practices.

Seaport Deployment (in scope)

Exclusions : Orders and transactions initiated and validated on opensea.io are covered by the opensea.io asset Phishing or any user interaction style of attacks Any attack that requires a user to interact with contract from an attacker controlled website The following are out of scope: Seaport 1.1: 0x00000000006c3852cbEf3e08E8dF289169EdE581 Seaport 1.2 0x00000000000006c7676171937C444f6BDe3D6282 Seaport 1.3 0x0000000000000aD24e80fd803C6ac37206a45f15 Seaport 1.4 0x00000000000001ad428e4906aE43D8F9852d0dD6 Seaport 1.5 0x00000000000000ADc04C56Bf30aC9d3c0aAF14dC SeaportValidator 0x00e5F120f500006757E984F1DED400fc00370000 SeaportNavigator 0x0000f00000627D293Ab4Dfb40082001724dB006F Explicitly : this covers vulnerabilities that are purely executed on chain against the in scope contracts. See the current deployments here . Currently the addresses are: Seaport: 1.6: 0x0000000000000068F116a894984e2DB1123eB395 ConduitController: 0x00000000F9490004C11Cef243f5400493c00Ad63 OpenSea's Conduit: 0x1e0049783f008a0085193e00003d00cd54003c71

Fee Collector Smart Contract (in scope)

Fee Collector Smart Contract Exclusions : Phishing or any user interaction style of attacks Any attack that requires a user to interact with contract from an attacker controlled website Explicitly : this covers vulnerabilities that are purely executed on chain against the in scope contracts.

Seadrop Smart Contract (in scope)

Seadrop Smart Contract Exclusions: Phishing or any user interaction style of attacks Any attack that requires a user to interact with contract from an attacker controlled website Explicitly: this covers vulnerabilities that are purely executed on chain against the in scope contracts.

OpenSea Solana Marketplace Program (in scope)

The marketplace program is OpenSea's fork of the Tensor marketplace program, deployed and maintained by OpenSea. Exclusions : Orders and transactions initiated and validated on opensea.io are covered by the opensea.io asset Phishing or any user interaction style of attacks Any attack that requires a user to interact with contract from an attacker controlled website Explicitly : this covers vulnerabilities that are purely executed on chain against the in scope programs. Currently the addresses are: Marketplace Program: 7Aru291A64wrTkUDaRv6HqxVBre6ivXWL94cUoCtQF9V

OpenSea Agent SDKs (in scope)

This group includes vulnerabilities in the following tools and SDKs: tool-sdk opensea-cli opensea-skill Exclusions: SDK misuse or unsupported usage. Issues requiring control of the client environment or application integrating the SDK. Public information disclosure (e.g. endpoints, public contract addresses). Third-party dependency vulnerabilities. Findings without demonstrable security impact. Phishing and Similar Attacks: Any form of social engineering, phishing, or related deceptive practices.

Broken Links (in scope)

Researchers who submit a valid Broken Link will be rewarded at a P4 level with $50 Broken link reports are in scope only when they meet all of the following conditions: They must be on OpenSea curated content, including but not limited to OpenSea's blog and Learning Center. They must be able to be taken over. A proof of concept is required. Specifically out of scope: Employee personal blogs All user generated content, including but not limited to creator controlled links Username take over of tagged social media accounts Broken links only reproducible on domains used for testing (e.g. testnets.opensea.io)