Welcome to our Docs - All information you need about zkSync and ZK Stack
English

Audits and bug bounty program

Audits and bug bounty program

zkSync Era takes security seriously and as such, we have completed multiple audits in all critical parts of the protocol. On top of that, there is an ongoing massive bug bounty program.

Audits

We always ensure that all code deployed to production has been thoroughly tested before release. Our auditing and review processes begin well before any code is deployed. We conduct internal audits, followed by independent external audits from reputable auditors. If applicable, we also hold a public auditing contest and top it off with another independent external audit.

Here is the list of completed audits:

Bug Bounty Program

zkSync Era has a very detailed Bug bounty Program on Immunefiopen in new window. In the listing, you can find all the information related to assets in scope, reporting, and the payout process.

Scope

The bug bounty program for zkSync Era aims to identify and resolve security vulnerabilities in our system before they can be exploited by malicious actors. The program is open to all individuals and teams who are interested in participating and are willing to comply with the program's rules and guidelines. The scope of the program covers all aspects of our blockchain products, including smart contracts, protocols, portals, and any other components that are part of our ecosystem.

Requirements

  1. Eligibility: The bug bounty program is open to anyone who is interested in participating and who complies with the program's rules and guidelines.
  2. Responsible Disclosure: All participants must agree to follow the responsible disclosure policy and report any security vulnerabilities they discover to our security team in a timely and responsible manner.
  3. Rewards: The bug bounty program offers rewards to participants who discover and report security vulnerabilities. The rewards are determined based on the severity of the vulnerability and are paid in USDC.
  4. Reporting Guidelines: Participants must follow the reporting guidelines specified by the program.
  5. No Public Disclosure: Participants must not publicly disclose any vulnerabilities they discover until after they have been resolved by our security team.
  6. No Exploitation: Attacks that the reporter has already exploited themselves, leading to damage are not eligible for a reward.
  7. Legal Compliance: Participants must comply with all applicable laws and regulations, including data privacy and security laws.
  8. Program Changes: We reserve the right to modify or terminate the program at any time and without prior notice. We also reserve the right to disqualify any participant who violates the program's rules and guidelines.

Unscoped Bug

If you think you have found a critical or major bug that is not covered by our existing bug bounty, please report it to us via the Immunefi programopen in new window regardless. We will seriously consider the impact of any issues and may award a bounty even for out of scope assets or impacts.