Our rewards are based on the severity of a vulnerability. Giveth uses CVSS 3.0 (Common Vulnerability Scoring Standard) to calculate severity. Please note, however, that reward decisions are up to the discretion of Giveth.

Issues may receive a lower severity due to the presence of compensating controls and context. The amounts shown in the table should be considered the maximum amounts for each severity level, though bonuses may be given at Giveth’s discretion.

Severity Reward (DAI equivalent in GIV)
Compromise of all GIV reserves (Ludicrous) 20,000
Critical 500-2000
High 100-500
Medium 25-100
Low 10-25
Business accepted risk
or Informational 0

Giveth Vulnerability Research Program (VRP) - Program Policy

Introduction

At Giveth, we take security and privacy very seriously. If you believe that you have found a security vulnerability that affects any Giveth product, service, or site, please report it to us. You may report a vulnerability using the “Submit Report” link on this page. Reports that fall within scope of Giveth’s Vulnerability Research Program (VRP) are also eligible for a reward. We appreciate your efforts in helping protect customer trust and make Giveth more secure.

For vulnerabilities related to Token Engineering Commons (TEC), please visit the TEC Vulnerability Reporting Page.

What is VRP?

Giveth’s Vulnerability Research Program (VRP) is an initiative driven and managed by Giveth’s Information Security team.

Who Can Participate in the Program?

Giveth users and security researchers who discover a potential security finding within Giveth products or services can report it to the VRP program. Giveth employees and contractors, as well as their immediate family members are strictly prohibited from participating in the public bounty program, or sharing information with an external security researcher to bypass this prohibition (in which case all parties are ineligible under this program).

How VRP Program Works