Stacks sBTC Academy is a learning page with everything you need to know to find bugs on Stacks. With guides to help you learn Stacks fast and use Immunefi successfully.

Stacks sBTC Academy 2

Learn why the Stacks ecosystem was built, its connection to Bitcoin, and what separates Stacks from other L2 blockchain protocols.

What is Stacks?

Explore how Stacks is intrinsically connected to Bitcoin, using the Bitcoin blockchain as a base layer. Learn how this connection ensures a secure and immutable foundation for Stacks-based smart contracts and decentralized applications.

Stacks connection to Bitcoin

Familiarize yourself with the fundamental terminology and concepts within the Stacks network.

Network Basic Definitions

Dive into the Proof of Transfer (PoX) consensus mechanism, which uniquely ties Stacks to Bitcoin. Learn how PoX secures Stacks, incentivizes participation, and bridges the two blockchain networks.

Proof of Transfer (PoX)

Discover how accounts are managed within the Stacks ecosystem, including account addresses, private keys, and the mechanisms that ensure secure and efficient transaction management.

Account Model

Understand the process of block production in the Stacks network, including the role of miners and the rules governing the creation of new blocks and their integration into the blockchain.

Block Production

Explore the mechanics of mining in the Stacks ecosystem, including how miners compete to win rewards by committing Bitcoin and the factors that influence successful mining.

How Mining Works

Learn how signing ensures the integrity of blocks and transactions within the Stacks blockchain. Understand the role of cryptographic signatures in validating and securing the network.

How Signing Relates to Block Production

Discover the Stacking mechanism, where participants lock their STX tokens to support network consensus and earn Bitcoin rewards. Understand the role of Stackers in the Stacks ecosystem and how Stacking contributes to network security.

How Stacking Works

Gain insights into how transactions are structured and processed within the Stacks network, from signing and broadcasting to inclusion in blocks and finalization on Bitcoin.

How Transactions Work

Stacks 101

Explore Clarity, the purpose-built smart contract language for the Stacks blockchain. Learn how Clarity is designed for predictability, security, and auditability, with a focus on preventing bugs and exploits commonly seen in other blockchain smart contract languages.

What is Clarity?

Dive into "The Clarity Book," a comprehensive guide to getting started with Clarity. This resource provides step-by-step instructions, examples, and best practices for understanding secure and efficient smart contracts on the Stacks blockchain.

The Clarity Book

Clarity

Learn about sBTC, a Bitcoin-pegged asset on the Stacks blockchain. Understand its purpose, how it bridges Bitcoin and Stacks ecosystems, and its role in unlocking Bitcoin's programmability while retaining its native value.

What is sBTC?

Understand the process of minting sBTC by depositing Bitcoin into the bridge. Gain insights into the mechanisms that ensure Bitcoin is securely locked and the equivalent sBTC is issued on Stacks.

Minting sBTC

Learn how to withdraw Bitcoin by redeeming sBTC through the sBTC Bridge. This includes understanding the operational flow and security measures in place to ensure a reliable withdrawal process.

Withdrawing BTC

Explore the Emily API, a crucial component for managing the sBTC Bridge. Learn how it facilitates seamless communication between sBTC users and signers, ensuring secure and efficient sBTC operations.

Emily API

Dive into the lifecycle of an sBTC transaction, from initiation to completion. This module covers the detailed steps and interactions between Bitcoin, Stacks, and Clarity smart contracts.

sBTC Transaction Walkthrough

Understand the concept of Peg Wallet UTXO and its role in managing Bitcoin transactions within the sBTC Bridge. Learn about the underlying UTXO model and its integration into the sBTC system.

Peg Wallet UTXO

Explore the Clarity smart contracts that power the sBTC Bridge. This includes an in-depth look at their state variables and interfaces, focusing on their role in enabling secure and efficient sBTC operations.

Clarity Contracts

sBTC

Learn how to set up the sBTC development environment by installing required tools and dependencies. Follow step-by-step instructions to prepare your system for sBTC development and testing.

Setup and Installing Dependencies

Understand how to build the sBTC project and execute unit tests to verify the correctness of individual components. This module covers the basics of testing methodology and troubleshooting.

Building and Running Unit Tests

Learn how to set up a local test environment to run integration tests for the sBTC system. This includes simulating real-world interactions to identify and debug issues effectively.

Running a Test Environment for Integration Tests

Running a Proof of Concept (PoC)

Understand the financial incentives driving participation in the Stacks network and the challenges related to security and budget allocation.

Financial Incentives and Known Issues

Audits & Known Issues

Explore the foundational Stacks whitepaper to gain insights into the technical architecture and design principles of the Stacks network.

Stacks Whitepaper

Study the sBTC whitepaper to understand the technical design, architecture, and mechanisms behind Bitcoin-pegged assets on Stacks. Gain insights into the sBTC bridge, minting and redemption processes, and the system's security model.

sBTC Whitepaper

Review a high-level summary of the technical specifications governing the Stacks blockchain and its key features.

Overview of Technical Specifications

Understand Stacks Improvement Proposals (SIPs), which define changes and upgrades to the Stacks network. Discover how SIPs are developed and implemented collaboratively to maintain and enhance the network's capabilities.

What is a Stacks Improvement Proposal (SIP)?

Learn about SIP-007, which defines the Proof-of-Transfer (PoX) consensus mechanism and its role in securing the Stacks network.

SIP007: Proof of Transfer

Discover the enhancements introduced in SIP-015, including upgrades to the PoX mechanism and the Clarity programming language.

SIP015: Upgrade to PoX and Clarity

Explore SIP-021, which details the integration of Nakamoto Consensus principles into the Stacks network.

SIP021: Nakamoto Consensus

Access the complete repository of Stacks Improvement Proposals (SIPs) to review and understand all network upgrades and features.

Repository of SIPs

Understand the OP_RETURN opcode in Bitcoin transactions and its relevance to Stacks, particularly for embedding metadata in Bitcoin blocks.

The OP_RETURN opcode

Dive into Weighted Schnorr Threshold Signatures (WSTS) and their role in enhancing multisignature schemes for secure key management in Stacks.

Weighted Schnorr Threshold Signatures

Explore the FROST protocol, a round-optimized Schnorr threshold signature scheme that balances efficiency and security for multi-party cryptographic operations.

Schnorr Signatures through FROST

Technical FAQ

Attackathons are education-based bug hunting competitions where security researchers compete over a reward pool by submitting impactful bugs in the project's code. Here’s how they work:

**Before the Attackathon**<br/> Immunefi works with the project to host a security-focused education period, providing top tier education and support to security researchers.

**During the Attackathon**<br/> Security researchers experience the optimal hunting conditions, with direct project support, responsiveness, and duplicate rewards.

**After the Attackathon**<br/> Immunefi spotlights the security accomplishments, with a custom leaderboard, Attackathon Findings Report, Bug Fix Reviews, and NFT awards.

Ultimately, Attackathons serve to secure projects, develop their security ecosystem, and create new opportunities for security researchers.

What's an Attackathon?

WSTS GitHub repository. Refer to `rev` as specified in the WSTS entry of the Cargo.toml file in the sBTC repository. Vulnerabilities related to WSTS will only be considered in scope if they can be exploited in sBTC.

Build commands, test commands, and how to run them can be found [here on the Stacks Academy](https://immunefi.com/academy/stacks-attackathon-2/?utm_source=explore_results#400).
### Project Technical Info

**What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported? Which are not?**

SIP10 is the only token standard supported https://github.com/stacksgov/sips/blob/main/sips/sip-010/sip-010-fungible-token-standard.md 

**What emergency actions may you want to use as a reason to invalidate or downgrade an otherwise valid bug report?**

Deposit processing can be paused by shutting down the Emily API server. In the case of vulnerabilities in deposit handling, this can be used to reduce the impact of an ongoing attack.

**What addresses would you consider any bug report requiring their involvement to be out of scope, as long as they operate within the privileges attributed to them?**

Signers are permissioned and whitelisted operators. Any attack that requires a majority of signers to be malicious should be out of scope. Attacks that require a minority of signers to be malicious would still be in scope but with reduced severity. 

**Which chains and/or networks will the code in scope be deployed to?**

Stacks L2

**Is this an upgrade of an existing system? If so, which? And what are the main differences?**

This attackaton focuses on sBTC V1, which adds (wrt previous attackathon for version 0.9) the ability to withdraw sBTC back into Bitcoin (on the L1). 

The main differences include:

- The new code related to withdrawals;
- all existing code (including the previous code related to deposits);
- key rotation, which allows the signer set to agree on a new aggregate key and start using it;
- the WSTS cryptographic library that powers threshold signature on Bitcoin.

Code until https://github.com/stacks-network/sbtc/releases/tag/0.0.9-rc7.1  is related to deposits. Anything more recent is related to withdrawals.

**Where do you suspect there may be bugs?**

The end-to-end flow of processing new Bitcoin deposits and minting sBTC on Stacks is relatively complex and error prone. Issues here could allow DoS of valid deposits or incorrect minting/burning of unbacked sBTC.

Vulnerabilities in the sBTC smart contracts hosted on Stacks could break the core assumptions of the system. Any attack that leads to a mismatch between the BTC collateral and the sBTC would be highly interesting to us.

Any attacks against the threshold signature scheme used on Bitcoin

**Where might Security Researchers confuse out-of-scope code to be in-scope?**

Vulnerabilities in the Stacks L2 blockchain itself should be reported directly to the [Stacks Immunefi bug bounty](https://immunefi.com/bug-bounty/stacks/information/).

Blobism

f4lc0n

vini_btc

leadwiz

christ0s

Pig46940

Cartel

XDZIBECX

https://drive.google.com/file/d/1_tFfdUIH17_3kpKZZfh4H_-W7zDLLEMe/view?usp=sharing

Stacks is a Bitcoin L2 enabling smart contracts & apps with Bitcoin as the secure base layer. This Attackathon focuses on Stacks’ sBTC upgrade.

A bug in the respective layer 0/1/2 network code that results in unintended smart contract behavior with no concrete funds at direct risk

Modification of transaction fees outside of design parameters

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol insolvency

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Contract fails to deliver promised returns, but doesn't lose value

Direct loss of funds

Permanent freezing of funds (fix requires hardfork)

Network not being able to confirm new transactions (total network shutdown)

Shutdown of greater than or equal to 30% of network processing nodes without brute force actions, but does not shut down the network

Shutdown of greater than 10% or equal to but less than 30% of network processing nodes without brute force actions, but does not shut down the network

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Unintended chain split (network partition)

Temporarily Freezing Network Transactions

API crash preventing correct processing of deposits

Temporary freezing of funds for at least 24h

Temporary freezing of funds for at least 1h

**Previous Audits**

Stacks’s completed audit reports can be found at https://stacks.org/audits . As well as the [sBTC audit here,](https://security.bitcoinl2labs.com/audits) which the 3rd audit report from the top of the list.

Unfixed vulnerabilities mentioned in these reports are not eligible for a reward.

**Public Disclosure of Known Issues**

Bug reports for publicly disclosed bugs are not eligible for a reward. 

- https://github.com/stacks-network/sbtc/issues
- https://github.com/stacks-network/sbtc/pulls

The Stacks team will label known issues with the label 'immunefi-scope' ( https://github.com/stacks-network/sbtc/labels/immunefi-scope ) to allow security researchers to easily filter them out.

**Private Known Issues Reward Policy**

Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.

**Stacks’ Feasibility Limitations**

In addition to our [standard feasibility limitations](https://immunefisupport.zendesk.com/hc/en-us/articles/16913132495377-Feasibility-Limitation-Standards), the following also apply:

- Non-Criticals which can be objectively determined to only be able to affect <1% of users may be downgraded by 1 severity.
- Non-Critical impacts that are dependent on execution to have a malicious signer involved, may be downgraded by 1 severity level.
- Vulnerabilities related to WSTS will only be considered in scope if they can be exploited in sBTC.

### Rewards Terms

Rewards are distributed among SRs according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

Rewards are denominated in USD and distributed in STX.

The reward pool is **$250,000 USD**, regardless of bugs found.

**On top of the above rewards**, the yield generated from 1 Million STX over 3 months will be distributed either among exceptional bug reports or equally among all SRs who submit a valid report, at Stacks’ discretion. Estimated to be worth about $50,000 USD as of December 1st, 2024.

NAME	EARNINGS	TOTAL VALID BUGS	HIGH	MEDIUM/LOW	INSIGHTS
1	$64,263	3	1	2	1
2	$54,933	3	1	2	0
3	$44,297	1	1	0	1
4	$43,047	1	1	0	0
5	$16,432	1	0	1	1
6	$14,349	1	0	1	0
7	$5,811	1	0	1	0
8	$4,783	1	0	1	0
9	$2,083	0	0	0	1

Attackathon | Stacks II

Status

Status