Please read these Vulnerability Disclosure Policy and Bug Bounty Program Supplemental Terms and Conditions (“VDP Terms”) carefully. These VDP Terms hereby incorporate by reference the Solana Mobile Terms of Use Agreement (“Terms of Use”), available at https://solanamobile.com/tos-homepage-web and the Solana Mobile Vulnerability Disclosure Policy and Bug Bounty Program available at https://solanamobile.com/security (the “Policy,” and together with the Terms of Use and the VDP Terms, the “Terms”). The Terms shall constitute a binding agreement between you and Solana Mobile Inc. (“Solana Mobile,” “we,” “us,” or “our”). Capitalized terms used and not otherwise defined herein shall have the meanings set forth in the Terms of Use or the Policy.
In the event of any conflict among the Policy, these VDP Terms, and the Terms of Use, the order of precedence shall be: (1) the Policy; (2) these VDP Terms; (3) the Terms of Use, but solely to the extent such conflict exists.
BY SUBMITTING A VULNERABILITY DISCLOSURE TO SOLANA MOBILE, YOU REPRESENT THAT (1) YOU HAVE READ, UNDERSTAND, AND AGREE TO BE BOUND BY THE TERMS, (2) YOU ARE OF LEGAL AGE TO FORM A BINDING CONTRACT WITH SOLANA MOBILE, (3) YOU HAVE THE AUTHORITY TO ENTER INTO THE TERMS PERSONALLY OR ON BEHALF OF THE ENTITY YOU ARE ACTING ON BEHALF OF, AND TO BIND THAT ENTITY TO THE TERMS; AND (4) YOU UNDERSTAND AND AGREE THAT YOU ARE SOLELY RESPONSIBLE FOR ENSURING THAT YOUR SUBMISSION OF A VULNERABILITY DISCLOSURE COMPLIES WITH THE LAWS OF YOUR JURISDICTION. IF YOU DO NOT AGREE TO BE BOUND BY THE TERMS, YOU MAY NOT RECEIVE AN AWARD IN CONNECTION WITH SUBMITTING A VULNERABILITY TO SOLANA MOBILE.
We may at our sole discretion modify the Terms on a going-forward basis. We will post notice of the date of the most recent update to the VDP Terms above.
1. Eligibility Conditions
1.1. The vulnerability must be previously unknown to Solana Mobile. Only the first Reporter to submit a given vulnerability is eligible for the full bounty. Duplicate submissions may receive a partial courtesy award at Solana Mobile’s sole discretion.
1.2. The submission must meet the documentation requirements in the Policy.
1.3. The Reporter must not have introduced the vulnerability intentionally.
1.4. The Reporter must not be a current or former (within the preceding 12 months) employee, contractor, director, or officer of Solana Mobile or any of its affiliates
1.5. The Reporter must not have contributed to the applicable code.
1.6. The Reporter must not be a family member or household member of any current employee, contractor, officer, or director of Solana Mobile or its affiliates.
1.7. The Reporter must not be, and must not have been within the preceding 12 months, an employee, officer, partner, contractor, or consultant of any entity that has or had a contractual relationship with Solana Mobile or any of its affiliates involving security auditing, code review, penetration testing, or similar security services, if the Reporter's work under that engagement gave or may have given the Reporter access to the systems, code, or information relevant to the reported vulnerability.
1.8. The Reporter must represent and warrant that they are not located in or a national of any jurisdiction subject to comprehensive U.S. sanctions, consistent with Section 2 below.
1.9. The Reporter must have full legal capacity to enter into a binding agreement and to receive payment under applicable law and must enter into the Award Agreement presented by Solana Mobile.
1.10. The Reporter must not have taken any Prohibited Actions.
2. Additional Payment Terms
2.1. The Reporter represents and warrants that: (i) they are not located in, ordinarily resident in, or a national or government of any country or territory subject to comprehensive U.S. sanctions (currently including Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine); (ii) they are not identified on, and are not owned or controlled by any person or entity identified on, the U.S. Treasury Department's Specially Designated Nationals and Blocked Persons List or any other applicable U.S. or EU sanctions list; and (iii) the wallet address provided for payment is not associated with any sanctioned entity or jurisdiction. Solana Mobile may screen all bounty payments against applicable sanctions lists prior to disbursement, regardless of amount. Solana Mobile reserves the right to withhold or delay payment pending completion of sanctions screening.
2.2. Solana Mobile reserves the right to request KYC documentation (including government-issued identification) for any bounties. A Reporter's failure to provide requested KYC documentation within 30 days will result in forfeiture of the bounty award.
2.3. Reporters are solely responsible for any tax obligations arising from receipt of a bounty. Solana Mobile will comply with applicable tax reporting obligations, including IRS Form 1099 reporting for U.S. persons and applicable withholding for non-U.S. persons. Reporters must provide any tax documentation reasonably requested by Solana Mobile (e.g., IRS Form W-9 or W-8BEN) prior to payment. For SKR token bounties, the U.S. dollar value for tax reporting purposes will be calculated based on the fair market value of SKR at the time of transfer to the Reporter's wallet.
3. Reporter Acknowledgment in connection with the “Hall of Fame.” Reporters may be acknowledged on the “Hall of Fame” by name and affiliation unless they explicitly request anonymity. Reporters may also choose a pseudonym. Affiliation is self-reported and not independently verified by Solana Mobile. Reporter represents and warrants that it has all rights to provide its affiliation with any third party company or other entity. Solana Mobile reserves the right to omit or redact any affiliation information that it determines in good faith to be inaccurate, potentially defamatory, or otherwise inappropriate for publication. Publication of affiliation information does not constitute Solana Mobile's endorsement or verification of any stated affiliation.
4. Intellectual Property Assignment
4.1. By submitting a vulnerability report, the Reporter will assign and does hereby irrevocably assign to Solana Mobile, Inc. all right, title, and interest in and to: (a) the vulnerability report and all findings contained therein; (b) any proof-of-concept code, scripts, exploit tools, transaction payloads, or other materials created in connection with identifying or demonstrating the vulnerability (collectively, "Research Materials"); and (c) all intellectual property rights in the foregoing, including without limitation all copyrights, whether or not registered.
4.2. To the extent any rights in the Research Materials cannot be assigned as a matter of applicable law, the Reporter grants Solana Mobile an irrevocable, perpetual, fully paid, royalty-free, worldwide, sublicensable license to use, reproduce, modify, distribute, and create derivative works of the Research Materials for any purpose.
4.3. The Reporter represents and warrants that: (i) the Research Materials are the Reporter's original work or the Reporter has full rights to make this assignment; (ii) the Research Materials do not infringe any third-party intellectual property rights; and (iii) no third party has any claim to or interest in the Research Materials.
4.4. This assignment does not affect the Reporter's right to be publicly acknowledged in the ‘Hall of Fame,’ unless the Reporter requests anonymity.
5. No Warranty THIS VDP AND THE BUG BOUNTY PROGRAM ARE PROVIDED "AS IS." SOLANA MOBILE MAKES NO WARRANTY THAT PARTICIPATION WILL RESULT IN A BOUNTY AWARD FOR ANY GIVEN SUBMISSION, OR THAT ANY PARTICULAR VULNERABILITY WILL BE CLASSIFIED AT ANY PARTICULAR TIER. ALL ELIGIBILITY DETERMINATIONS, TIER CLASSIFICATIONS, AND BOUNTY AMOUNTS ARE MADE BY SOLANA MOBILE IN ITS SOLE DISCRETION AND ARE FINAL. SUBMISSION OF A VULNERABILITY REPORT DOES NOT CREATE ANY OBLIGATION ON THE PART OF SOLANA MOBILE TO PAY A BOUNTY, ACKNOWLEDGE THE SUBMISSION, RESPOND WITHIN ANY PARTICULAR TIMEFRAME, OR REMEDIATE THE REPORTED VULNERABILITY.
6. Program Modification and Termination. Solana Mobile reserves the right to modify, suspend, or terminate the VDP and/or the Bug Bounty Program at any time and for any reason, with or without notice, in its sole discretion.