Zano is the development of a scalable and secure coin, designed for use in e-commerce. The technology behind our blockchain provides reliability, security, and flexibility—a perfect option for P2P transactions.
For more information about Zano, please visit https://zano.org/.
Zano rewards are denominated in USD and distributed in USDC on Ethereum
Live
PoC required
KYC required
Select the category you'd like to explore
Assets in Scope
This is an invite-only audit competition. Therefore, in-scope assets are not publicly available.
Impacts in Scope
Where do you suspect there may be bugs and/or what attack vectors are you most concerned about?
We are concerned the most about implementation of cryptography and core rules (Bulletproofs, CLSAG etc).
Most concerning attack vectors are:
- Emission bugs (printing coins out of air)
- Consensus bugs (double spend attack vectors, PoS grinding attacks)
What external dependencies are there?
Boost and OpenSSL
What are the most valuable educational resources already available? (Ie. Documentation, Explainer videos or articles, etc
This repository contains papers that describe math behind the project: https://github.com/hyle-team/docs/tree/master/zano
Network not being able to confirm new transactions (total network shutdown)
Execute arbitrary system commands
Retrieve sensitive data/files from a running server, such as:
- /etc/shadow
- database passwords
- blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)
Taking down the application/website
Taking down the NFT URI
Taking and/modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:
- Changing registration information
- Commenting
- Voting
- Making trades
- Withdrawals, etc.
Changing NFT metadata
Direct theft of user funds
Malicious interactions with an already-connected wallet, such as:
- Modifying transaction arguments or parameters
- Substituting contract addresses
- Submitting malicious transactions
Direct theft of user NFTs
Injection of malicious HTML or XSS through metadata
Direct loss of funds