Safe (Safe Smart Account)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz High severity (direct theft of funds or tokens, permanent fund lockups, bugs requiring an urgent redeploy) │ $1,000,000 │ $1,001,000 Medium severity │ $50,000 │ $51,000 Low severity │ $10,000 │ $11,000 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 40 % Auth bypass 25 % Parsing/validation 20 % Code execution 10 % Latest advisories Loading the feed Overview Safe is the de facto standard smart-contract account on Ethereum and essentially every EVM L2. Its proxy and factory contracts are deployed at deterministic addresses across a very large number of networks, and it is the custody substrate for DAO treasuries, protocol multisigs, exchange operational wallets and a large share of institutional on-chain holdings. What justifies a seven-figure top rung on a few thousand lines of Solidity is composition: the Safe contracts are not merely used directly, they are the base layer other products build on, so Safe.sol semantics are inherited by module ecosystems, ERC-4337 account abstraction stacks and ERC-7579 modular account implementations. A signature-verification or module-authorisation bug in Safe.sol is simultaneously a bug in every downstream product that composes it. The Safe Ecosystem Foundation runs the program itself rather than on a platform, takes submissions by email, welcomes anonymous ones, and pays in USDC on Ethereum Mainnet: $10,000 at Low, $50,000 at Medium, and up to $1,000,000 at High for direct theft of funds, permanent fund lockups or a bug requiring an urgent redeploy. sorona.xyz adds 1.25× on top of whatever Safe awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program's scope table, which enumerates the contracts file by file out of the LGPL-3.0 safe-global/safe-smart-account repository and safe-global/safe-modules . Smart contracts only, and only the versions the table names Safe core v1.5.0 and v1.4.1: Safe.sol and SafeL2.sol , where owner management, threshold checking, signature verification, module and guard dispatch and delegate execution all live The legacy Gnosis Safe releases the table still carries, v1.3.0, v1.2.0 and v1.1.1, which hold a large share of the deployed value Proxy and factory contracts, SafeProxy.sol and SafeProxyFactory.sol , across every deployment network listed in the Safe Deployments repository Batching and helper contracts: MultiSend.sol , MultiSendCallOnly.sol and CreateCall.sol Fallback handlers: TokenCallbackHandler.sol , CompatibilityFallbackHandler.sol and ExtensibleFallbackHandler.sol The officially supported modules: Allowance Module v1.0.0 ( AllowanceModule.sol ), 4337 Module v0.3.0 ( Safe4337Module.sol ), Passkey Module v0.2.1 ( SafeWebAuthnSignerFactory.sol , SafeWebAuthnSignerProxy.sol , SafeWebAuthnSignerSingleton.sol , SafeWebAuthnSharedSigner.sol , WebAuthn.sol and P256.sol ) and Social Recovery Module v0.1.0 Safenet Beta Staking.sol v0.1.0 Out of scope Anything not on the enumerated contract list, including third-party modules and guards written by other teams Gas optimisations, which are efficiency findings rather than security ones Known issues already recorded in the published audits or in the documentation Issues already fixed in a newer contract version than the one you tested Chain-specific quirks: issues related to non-standard features or alternative gas schedules on EVM-compatible chains that differ from Ethereum Mainnet The Safe{Wallet} web app, mobile apps and backend services, which are a separate asset paying only discretionary amounts Most-valued findings A signature-verification flaw in Safe.sol that lets a transaction execute without the required threshold of valid owner signatures. Direct theft of funds is the named High class and the only realistic route to the $1,000,000 rung Module or guard authorisation bypass that lets an address the owners never approved execute through a Safe, which access control at 40% of the distribution says is the likeliest shape a real finding takes here Proxy or factory defects such as address collision, initialisation front-running or an implementation left uninitialised, since SafeProxyFactory deploys to deterministic addresses on every supported network at once Anything that permanently locks funds or bricks an existing Safe, which the program grades alongside direct theft at the top rung even though nobody profits Passkey module flaws in WebAuthn.sol or P256.sol where a signature that should not verify does, since that turns a recovery convenience into an entry point Fallback handler confusion in ExtensibleFallbackHandler.sol or CompatibilityFallbackHandler.sol that lets a call reach account state it should never touch Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Smart contracts only: the Safe{Wallet} web app, mobile apps and backend services are out of scope and attract only discretionary amounts Only the enumerated contract versions count: Safe Smart Account v1.5.0 and v1.4.1, the legacy Gnosis Safe v1.3.0, v1.2.0 and v1.1.1 releases, and the named module versions Awards are paid in USDC on Ethereum Mainnet The review panel has sole discretion on severity, and anything already recorded in a published audit or already fixed in a newer contract version does not qualify Allow reasonable time for investigation and remediation before public disclosure Anonymous submissions are welcome, so you do not have to identify yourself to report Disclosure Coordinated directly with the Safe Ecosystem Foundation, which asks only that you allow reasonable time for investigation and remediation before publishing. Submission is by email rather than through a platform, so there is no SLA clock to hold them to; sorona.xyz holds your finding until Safe has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability