1. Purpose and Scope
Solana Mobile Inc. (Solana Mobile) is committed to the security of the products and on-chain programs it develops and maintains. Solana Mobile maintains a Vulnerability Disclosure Policy (VDP) and operates a bug bounty program (Bug Bounty Program) to incentivize responsible disclosure of security vulnerabilities in covered products listed below.
The policy applies to independent security researchers, professional auditors, and any other party who discovers or wishes to report a potential vulnerability (each a Reporter).
2. Covered Products
The following products and infrastructure components are in scope for this VDP.
2.1 Seed Vault on Seeker
Seed Vault is Solana Mobile's hardware-backed key custody and transaction signing service shipped on the Seeker device. It is implemented by the following components:
Trusted Application running within a TEE enclave
Custom Android system service
UI for managing seeds and authorized wallets.
2.2 SKR Token On-Chain Programs
The SKR token is Solana Mobile's native utility and governance token. The following on-chain programs are covered by this policy:
SKR Inflation Program (SKRiHLtLyB8bbhcJ5HBPYMiLh9GcFLdPaSwozqLteha) - governs the issuance schedule of new SKR tokens and controls the mint authority. Any defect that could cause unscheduled or unbounded minting is a critical Tier 1 vulnerability.
SKR Staking Program (SKRskrmtL83pcL4YqLWt6iPefDqwXQWHSw9S9vz94BZ) - accepts user deposits of SKR tokens and distributes inflation rewards. Vulnerabilities that could drain staked funds or manipulate reward accounting are in scope.
2.3 Seeker Genesis Token
The backend infrastructure supporting Seeker Genesis Token minting and Seeker ID management is covered by this policy, including:
Backend APIs used to mint soul-bound Seeker Genesis Tokens.
Backend APIs used to mint and modify Seeker IDs.
Note: the financial impact of vulnerabilities related to Seeker Genesis Token are more limited in scope compared to products and components found in section 2.1 and 2.2.
2.4 Out of Scope
The following products and components are explicitly excluded from this VDP and maintain separate security processes:
dApp Store - the Solana Mobile application marketplace and its review processes.
Mobile Wallet Adapter (MWA) - the open protocol and reference implementation at https://github.com/solana-mobile/mobile-wallet-adapter.
Third-party dApps - applications distributed through the dApp Store are the responsibility of their respective developers.
Seed Vault Wallet, shipped pre-installed on Seeker.
The Android OS and Trusted Execution Environment SDK - firmware below the Seed Vault boundary, see Google Bug Hunters.
Social-engineering attacks targeting Solana Mobile employees.
Physical attacks requiring uninterrupted physical access to an unlocked device, for at least an hour or longer.
NOTE: Before filing, consider, if a Reporter uses a product or infrastructure component that are in scope for this VDP according to its documented API, can an attacker still exploit a program built with it? If the attack requires the Reporter to call an undocumented, deprecated, or explicitly unsafe function, this is a Reporter misuse issue, not a vulnerability.
3. Prohibited Actions
No Public Disclosure Without Consent: Any external disclosure without Solana Mobile’s consent invalidates the ability for the Reporter to participate in the Bug Bounty Program.
No Exploitation: Reporters must NEVER execute or attempt to execute the reported exploit on any public Solana cluster or any live production system. Reporters must avoid exploiting the vulnerability beyond what is necessary for demonstration. Exploiting a vulnerability in a way that impacts Solana Mobile customers, users of the Seed Vault, or holders of SKR tokens is strictly prohibited and will result in immediate disqualification from the Bug Bounty Program, as well as potential legal action. Reporters must also refrain from accessing, modifying, or exfiltrating user data. All proof-of-concept testing must be performed exclusively on a local test validator.
4. Safe Harbor. Except in certain rare circumstances, Solana Mobile will not initiate or support any civil or criminal legal action against a Reporter who, in good faith, discovers and discloses a vulnerability under this VDP.
5. Responsible Vulnerability Disclosure
5.1 How to Disclose a Vulnerability
Submit your disclosure securely at https://solanamobile.com/security. Do not disclose vulnerability details publicly, unless coordinated with Solana Mobile.
5.2 Documentation Requirements
Every submission must include sufficient information to independently reproduce and validate the vulnerability. The following sections are required:
Summary - a one-paragraph description of the vulnerability, its location, and the potential impact.
Affected component - the specific product, program, or endpoint affected (e.g., "SKR Staking Program, instruction handler for withdraw_stake").
Reproduction steps - a numbered, step-by-step procedure to trigger the vulnerability in a test environment.
Proof-of-concept (PoC) code - source code, script, or on-chain transaction payload that demonstrates exploitability. The PoC shall be self-contained and runnable on:
Solana localnet, or
Production Seeker device in the Reporter's personal possession, used solely for security research purposes; testing on any device belonging to or in the possession of any other person, or on any Solana Mobile engineering or development hardware, is strictly prohibited.
Submissions without a PoC may be downgraded in tier or declined.
Impact assessment - the Reporter's own assessment of the worst-case impact, including:
whether funds could be lost
what data could be exposed
whether user action is required
whether additional software needs to be installed locally (e.g. on Seeker)
whether the user must grant any permissions
whether the device configuration must be manually changed
Suggested fix (optional but encouraged) - a patch, configuration change, or architectural recommendation.
PoC requirements for on-chain vulnerabilities: In addition to the full PoC code, attach a screenshot or log output showing the exploit succeeding. If the PoC involves deploying a malicious program, describe the deployment steps. Reporters are prohibited from deploying any malicious programs into any public environment under this VDP.
6. Bug Bounty Program
Reporters who comply with the VDP may be eligible for a bug bounty under the Bug Bounty Program.
6.1. Vulnerability Classification
All submissions are initially assigned to one of four tiers. The assigned tier determines the maximum bounty award and the resolution priority. Tier assignments and bounty awards are made by Solana Mobile in its sole and reasonable discretion and may be revised following full analysis.
Tier | Severity | Description | Max Bounty |
Tier 1 | Critical | Risk to funds without user action - e.g., attacker can drain wallet, exfiltrate seed phrase, or sign transactions without any user approval. On Seeker, does not require physical access to the device, does not require installation of 3rd party software, or 3rd party software does not require dangerous permissions that would not be allowed by dApp Store or Google Play Store policies. | Up to $75,000 |
Tier 2 | High | Risk to funds requiring user action - e.g., a vulnerability that can be exploited only if the user is tricked into performing an action. On Seeker, does not require destructive physical modifications to device, does not require sustained access to device. May require installation of 3rd party software requiring dangerous permissions that would not be allowed by dApp Store or Google Play Store policies. | Up to $37,500 |
Tier 3 | Medium | Denial of service - e.g., crashing the Seed Vault daemon, locking the user out of the device, or making SKR staking/inflation programs inaccessible. | Up to $15,000 |
Tier 4 | Low | Cosmetic / causing user misunderstanding - e.g., misleading UI labels, incorrect balance displays, non-exploitable information leakage that can confuse but not harm users. On Seeker, requires Seeker configuration to be changed/non-standard (e.g. developer mode). | Up to $750 |
Tier assignments consider the worst realistic impact, not the theoretical maximum. A vulnerability requiring a nation-state-level attacker may be downgraded relative to its theoretical tier.
6.2 Eligibility Conditions
The vulnerability must be previously unknown to Solana Mobile.
The submission must meet the documentation requirements in Section 5.2.
The Reporter must not have introduced the vulnerability intentionally.
The Reporter must not be a current or former (within the preceding 12 months) employee, contractor, director, or officer of Solana Mobile or any of its affiliates
The Reporter must not have taken any Prohibited Actions.
6.3 Award Currency - SKR Tokens
All Bug Bounties provided by Solana Mobile are denominated and paid in SKR tokens on the Solana mainnet.
6.4 Award Details
Award Agreement. Solana Mobile will provide an Award Agreement governing the grant of SKR tokens to the Reporter. Reporter must sign this Agreement in order to receive the award. A Reporter's failure to execute the Award Agreement within 30 days of delivery may result in forfeiture of the bounty award.
Quantity. The actual SKR quantity is calculated using the 7-day volume-weighted average price (VWAP) of SKR on the date Solana Mobile formally validates the resolution.
Vesting and Use Restriction. The following schedule governs the award, vesting, and delivery of SKR token bounties:
Award: The SKR token bounty is formally awarded on the date that the Reporter executes an Award Agreement. For the avoidance of doubt, acknowledgment of receipt of a disclosure does not constitute an award and creates no payment obligation.
Vesting: The earliest vesting date of the awarded SKR token bounty will be 30 days after the reported vulnerability has been resolved. Solana Mobile reserves the right to delay any award of a SKR token bounty for any reason.
Use restriction: A 12-month use restriction applies to the vested SKR token bounty from the date of vesting. At the end of the use restriction period, the SKR tokens are transferred to the Reporter's Solana wallet. Solana Mobile's obligations during the use restriction period are limited to holding and transferring the tokens; Solana Mobile does not act as a fiduciary, custodian, or financial intermediary with respect to the Reporter's bounty.
Sanctions Compliance. Reporter must not be a sanctioned person or reside in a country under sanctions or restrictions, as required by applicable laws.
KYC Documentation. Solana Mobile reserves the right to request KYC documentation (including government-issued identification) for any bounties.
Tax Documentation. Reporters are solely responsible for any tax obligations arising from receipt of a bounty.
7. Public Disclosure
Solana Mobile maintains a public record of certain resolved vulnerability disclosures on a "hall-of-fame" website. If desired by the Reporter, Solana Mobile acknowledges the contribution by showing the Reporter’s name, pseudonym, or company on a timeline. Acknowledgement of a researcher on the “hall-of-fame” is in Solana Mobile’s sole discretion.
8. Agreement/Other Terms
By submitting a disclosure as set forth in Section 5.1, the Reporter agrees to be bound by the terms and conditions of this VDP in their entirety, which incorporate by reference the Solana Mobile Terms of Use Agreement and the VDP Supplemental Terms. To the extent of any conflict between this VDP, the Terms of Use and the VDP Supplemental terms, this VDP shall control.