From f86d84595e24cc90808e07f0a94cb0756c0e36ff Mon Sep 17 00:00:00 2001 From: shashial <10578726+shashial@users.noreply.github.com> Date: Mon, 29 Jun 2026 13:01:12 +0100 Subject: [PATCH] Update SECURITY.md --- SECURITY.md | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 69c04082..6d5c10bd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,24 +26,3 @@ client. Once we have received your bug report, we will try to reproduce it and provide a more detailed response. When the reported bug has been successfully reproduced, the team will work on a fix. - -## Bug Bounty Program - -To incentive bug reports, there is a bug bounty program. You can receive a -bounty (up to $25k USD) depending on the bug's severity. Severity is based on -impact and likelihood. If a bug is high impact but low likelihood, it will have -a lower severity than a bug with a high impact and high likelihood. - -| Severity | Maximum | Example | -|----------|------------:|------------------------------------------------------------------------| -| Low | $1,000 USD | A bug that causes mev-boost to skip a bid. | -| Medium | $5,000 USD | From a builder message, can cause mev-boost to go offline. | -| High | $12,500 USD | From a builder message, can cause a connected validator to go offline. | -| Critical | $25,000 USD | From a builder message, can remotely access arbitrary files on host. | - -### Scope - -Bugs that affect the security of the Ethereum protocol in the `mev-boost` -and `mev-boost-relay` repositories are in scope. Bugs in third-party -dependencies are not in scope unless they result in a bug in `mev-boost` with -demonstrable security impact.