Algorand Blockchain

Algorand is the world’s most powerful and sustainable blockchain. Our institutional grade blockchain infrastructure is the first and only to achieve decentralization, scalability, and security without compromises and while being environmentally sustainable.

For more information about the Algorand Blockchain, please visit https://www.algorand.com/. For more information about the Algorand Foundation Bug Matching Bounty Program, please visit https://immunefi.com/algorand-matching/

Rewards are distributed according to the “Impacts in Scope” section below. This is a simplified 4-level scale focusing on the impact of the vulnerability reported. This program only covers the Algorand Blockchain itself - any third-party software or smart contracts built on the Algorand Blockchain are considered out of scope.

All Critical and High Blockchain/Digital Ledger Technology vulnerability reports require a Proof of Concept (‘PoC’) to be eligible for a reward. Explanations and statements are not accepted as PoC and code is required.

Critical Blockchain/DLT vulnerabilities are capped at 10% of economic damage, primarily taking into consideration funds at risk, but also PR and branding aspects, at the final decision of Immunefi, after consulting with the Algorand Inc. and the Algorand Foundation teams. However, there is a minimum reward of USD 100 000. The following vulnerabilities are not eligible for a reward:

• Any issue on the issue tracker: https://github.com/algorand/go-algorand/issues
• Any issue found on open pull requests: https://github.com/algorand/go-algorand/pulls

Please refer to the documentations here on creating a dev environment so that PoCs can be created properly.

• https://developer.algorand.org/docs/
• https://developer.algorand.org/docs/run-a-node/setup/install/

KYC shall be done for bug bounty hunters submitting a vulnerability report and requesting a reward for Critical and High Blockchain/DLT vulnerabilities. The basic information needed is full name, residential address, and passport details (DOB, issuing country and passport number). Based on the basic information submitted, the Algorand Foundation team may request further information at its sole discretion for compliance with applicable laws.

Additionally, all levels of bug bounty hunters submitting a vulnerability report and requesting a reward need to submit certification that (i) they are not acting, directly or indirectly, for or on behalf of any person, group entity, or nation named by any Executive Order or the United States Treasury Department as a terrorist, “Specially Designated National and Blocked Person,” or other banned or blocked person, entity, nation, or transaction pursuant to any law, order, rule or regulation that is enforced or administered by the Office of Foreign Assets Control; and (ii) they are not engaging in, instigating or facilitating this transaction, directly or indirectly, on behalf of any such person, group, entity, or nation. They also need to submit an attestation that all information provided is true, correct, up-to-date and not misleading.

The collection of this information will be done by the Algorand Foundation team.

Bug bounty reward payouts are handled by the Algorand Foundation team directly and are denominated in USDCa.

Blockchain/DLT

All blockchain code of Algorand can be found at https://github.com/algorand/go-algorand. However, only those in the Assets in Scope table’s located in the main branch are considered as in-scope of the bug bounty program.

Note: any file which includes _test and/or mocks is out of scope. In particular, the following assets are out of scope

1. kmd
2. Ledger app
3. Indexer
4. SDKs
5. Any third-party software or smart contracts
6. Websites (algorand.com, algorand.foundation, etc.)

If an impact can be caused to any other asset relating to the Algorand Blockchain that isn’t on this table but for which the impact is in the Impacts in Scope section below, the bug bounty hunters are encouraged to submit it for the consideration by the Algorand Inc. team who shall consult the Algorand Foundation team before making final determination. This only applies to Critical and High Blockchain/DLT vulnerabilities.

Notes:

1. Any bugs that can only be exploited on BetaNet will be rewarded at 33% of the MainNet bounty amount.
2. Only MainNet, TestNet, and BetaNet are in scope. Any other publicly provided or private networks are out of scope
3. All current and former employees, consultants, advisors, or affiliates of the Algorand Foundation team or the Algorand Inc. team or their affiliates shall be prohibited from receiving any payment or reward of any kind under the Program.

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)

Blockchain

• Best practice critiques
• Centralization risks
• Attacks requiring >20% of online stake held by accounts or nodes (those that hold more online stake than Algorand’s consensus assumptions) to exhibit “bad behavior” (e.g. expiring participation keys)
• 3rd party risks (e.g applications built on top of the Algorand blockchain, light clients, bridges, liquidity imported to / exported from Algorand, use of 3rd party provider, etc.)
• Any bugs that cannot be exploited on MainNet, TestNet, or BetaNet (e.g. limited to other publicly provided or private networks)
• Attacks requiring quantum computers or impractical memory/computation capabilities
• Standard asset freeze / clawback actions from privileged addresses (e.g. manager / reserve / freeze / clawback address actions)
• Any minor violation of semantics of transfer/creation/… of ASAs or of smart contracts that does not have any impact on significant dApps (e.g., because the semantics are just unclear or never actually used in real use cases)
• Attacks requiring physical access to the nodes
• Attacks requiring a network partition of the Internet itself or significant control over the Internet infrastructure (BGP attack, control of major Internet routers/backbone, control of a cloud provider, generation of TLS certificates for malicious websites, etc.)
• Attacks related to misconfigured nodes or nodes not using the proper configuration (algod running as a privileged user, disabling of DNSSec, use of a too small/too slow disk, etc.)
• Attacks related to nodes not running the latest stable version of algod
• Attacks using maliciously generated fast catchup hash values
• Supply-chain attacks
• Side-channel attacks
• Denial of Service (DoS) or crash testing against any node you don’t own (e.g. public relay nodes)
• Bandwidth flooding DDoS attacks (saturating the network)
• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks that rely on social engineering
• Attacks requiring access to leaked keys / credentials
• Theoretical attacks that cannot be applied in practice
• Attacks against white papers
• Any bug that has been previously disclosed / submitted
• Any bug that has already been exploited
• Bugs from misconfigured / inappropriately secured smart contracts
• Any third-party software or smart contracts built on Algorand

The following activities are prohibited by (and shall be deemed as a breach of) this bug bounty program:

• Bug testing on any public network; all testing should be done on private testnets
• Any denial of service attacks or crash testing against any node you don’t own (e.g. public relay nodes)
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty
• Algorand Inc. considers Social Engineering attacks against Algorand Inc. employees a violation of Program Terms and Conditions. Researchers engaging in Social Engineering attacks against Algorand Inc. employees will be banned from the Algorand Blockchain Bug Bounty program. Algorand Inc. defines Social Engineering as acts that influence people to perform security-impacting actions or divulge confidential information.
• Algorand Foundation considers Social Engineering attacks against Algorand Foundation employees a violation of Program Terms and Conditions. Researchers engaging in Social Engineering attacks against Algorand Foundation employees will be banned from the Algorand Blockchain Bug Bounty program. The Algorand Foundation defines Social Engineering as acts that influence people to perform security-impacting actions or divulge confidential information.