Introducing the Solana Mobile Vulnerability Disclosure Policy, Bug Bounty Program, and Security Grants
Today we're launching two separate initiatives to double down on security in the Solana Mobile ecosystem: the Solana Mobile Vulnerability Disclosure Policy, which includes our Bug Bounty Program, and Solana Mobile Security Grants, whose first recipients we're proud to announce below.
The Vulnerability Disclosure Policy and Bug Bounty Program
The Vulnerability Disclosure Policy is the rulebook for responsible security research and disclosures for Solana Mobile products. It defines what's in scope, how to report a vulnerability, how we respond, and how researchers are protected and rewarded.
The following are in scope for Bug Bounties:
Seed Vault on Seeker: the hardware-backed key custody and signing service, including the Trusted Application in the TEE, the Android system service, and the seed and wallet management UI.
SKR onchain programs: the Inflation Program that controls issuance and mint authority, and the Staking Program that holds deposits and accounts for rewards.
Seeker Genesis Token backend: the APIs behind soul-bound Genesis Token minting and Seeker ID management.
The policy has the full list of what’s in and out of scope here.
Every valid report is classified by real-world worst-case impact, and tiers define bounty ceilings:
Tier | Severity | Max reward |
1 | Critical - funds at risk with no user action | Up to $75,000 |
2 | High - funds at risk requiring user action | Up to $37,500 |
3 | Medium - denial of service | Up to $15,000 |
4 | Low - cosmetic UI or invalid copy | Up to $750 |
Reporting is simple and should stay private until coordinated disclosure with the Solana Mobile team. Research in good faith and you're covered by our safe harbor. Here’s how to responsibly disclose:
Follow documentation requirements, and include everything we need to reproduce the reported vulnerability. A summary, the affected component, numbered reproduction steps, working proof-of-concept code, and your own impact assessment. Submissions without a PoC may be downgraded in tier or declined.
Keep testing contained. Every proof-of-concept must run on a local test validator, or on a production Seeker in your own possession. Never on mainnet or any other public cluster, never on someone else's device, and never on Solana Mobile engineering hardware. Don't access, modify, or exfiltrate user data, and don't exploit beyond what a demonstration requires.
Submit securely here. Never open a public GitHub issue; that's a premature disclosure that voids eligibility and can put users at risk.
Bug Bounty rewards are paid in SKR under an Award Agreement, which the Reporter must sign to receive the award. Once we formally validate the resolution, the SKR reward quantity is set using the token's 7-day VWAP as of that date. The earliest vesting date is 30 days after the vulnerability is resolved, and a 12-month use restriction applies from vesting, after which the tokens are delivered to the Reporter's Solana wallet.
Get Started with the Bug Bounty Program
Full details on how to responsibly disclose and participate in the bug bounty program can be found in the full Vulnerability Disclosure Policy here.
Apply for a Bug Bounty here.
Solana Mobile Security Grants
As part of our commitment to security in the Solana Mobile ecosystem, we’re also introducing Security Grants for researchers. These grants, provided in SKR, will be awarded for work that improves the security of the Solana Mobile ecosystem, and is separate from the bug bounty program.
EthelSec is the first team to earn a Solana Mobile Security Grant for their security research.. Thank you for setting the standard.
You can apply for a Solana Mobile Security Grant here and learn more about our grants programs here.
