Attackathon | Stacks

Learn more on the Stacks' Academy.

Project Technical Info

What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported? Which are not?

• SIP10 is the only token standard supported https://github.com/stacksgov/sips/blob/main/sips/sip-010/sip-010-fungible-token-standard.md

What emergency actions may you want to use as a reason to invalidate or downgrade an otherwise valid bug report?

• Deposit processing can be paused by shutting down the Emily API server. In the case of vulnerabilities in deposit handling, this can be used to reduce the impact of an ongoing attack.

What addresses would you consider any bug report requiring their involvement to be out of scope, as long as they operate within the privileges attributed to them?

• Signers are permissioned and whitelisted operators. Any attack that requires a majority of signers to be malicious should be out of scope. Attacks that require a minority of signers to be malicious would still be in scope but with reduced severity.

Which chains and/or networks will the code in scope be deployed to?

• Stacks L2

Security Researcher Education

Is this an upgrade of an existing system? If so, which? And what are the main differences?

• sBTC is a new 1:1 Bitcoin-backed asset on the Stacks Bitcoin L2. The in-scope codebase is completely new.

Where do you suspect there may be bugs?

• The end-to-end flow of processing new Bitcoin deposits and minting sBTC on Stacks is relatively complex and error prone. Issues here could allow DoS of valid deposits or incorrect minting of unbacked sBTC.

Vulnerabilities in the sBTC smart contracts hosted on Stacks could break the core assumptions of the system. Any attack that leads to a mismatch between the BTC collateral and the sBTC would be highly interesting to us.

• Any attacks against the threshold signature scheme used on Bitcoin

Where might Security Researchers confuse out-of-scope code to be in-scope?

• Vulnerabilities in the Stacks L2 blockchain itself should be reported directly to the Stacks Immunefi bug bounty.

• The initial launch of sBTC does not enable withdrawals back to Bitcoin. While partial code to support withdrawals can be found in the codebase, issues that can’t be exploited in “deposit-only” mode will be downgraded.

Are there any unusual points about your protocol that may confuse Security Researchers?

• sBTC launches without support for withdrawals. Users can go from BTC -> sBTC, but the support for sBTC -> BTC is not fully implemented. This functionality will be part of a follow-up contest.