Skip to content

Update SECURITY.md #905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
metachris merged 1 commit into from
Jun 30, 2026
Merged

Update SECURITY.md #905

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 0 additions & 21 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,24 +26,3 @@ client.
Once we have received your bug report, we will try to reproduce it and provide a
more detailed response. When the reported bug has been successfully reproduced,
the team will work on a fix.

## Bug Bounty Program

To incentive bug reports, there is a bug bounty program. You can receive a
bounty (up to $25k USD) depending on the bug's severity. Severity is based on
impact and likelihood. If a bug is high impact but low likelihood, it will have
a lower severity than a bug with a high impact and high likelihood.

| Severity | Maximum | Example |
|----------|------------:|------------------------------------------------------------------------|
| Low | $1,000 USD | A bug that causes mev-boost to skip a bid. |
| Medium | $5,000 USD | From a builder message, can cause mev-boost to go offline. |
| High | $12,500 USD | From a builder message, can cause a connected validator to go offline. |
| Critical | $25,000 USD | From a builder message, can remotely access arbitrary files on host. |

### Scope

Bugs that affect the security of the Ethereum protocol in the `mev-boost`
and `mev-boost-relay` repositories are in scope. Bugs in third-party
dependencies are not in scope unless they result in a bug in `mev-boost` with
demonstrable security impact.
Loading