31 March 2022
Live since
Yes
KYC required
$1,000,000
Maximum bounty
19 October 2022
Last updated

Program Overview

Stacks is a layer-1 blockchain that shares consensus with Bitcoin, enabling apps and smart contracts on the world's most robust blockchain. Activity on the Stacks network settles to Bitcoin, allowing developers to harness the security, stability, and economic power of Bitcoin while benefitting from an expressive smart contract layer

For more information about Stacks, please visit https://stacks.org/ and https://www.stacks.co/.

This bug bounty program is focused on their smart contracts and is focused on preventing:

  • Theft of funds
  • Permanent freezing of funds
  • Total network shutdown

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2 v2. This is a simplified 5-level scale, with separate scales for each category, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. If there is any discrepancy with the classification in the Impacts in Scope section, the classification in the Impacts in Scope section will hold true.

All critical bug reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

All critical bug reports with direct financial impact are further capped at 10% of economic damage, which primarily takes into consideration the funds at risk while also having some PR and branding considerations, though at the discretion of the team. However, there is a minimum reward of USD 50 000.

This bug bounty program is only open to individuals outside the OFAC restricted countries. Bug bounty hunters will be required to provide evidence that they are not a resident or citizen of these countries. If the individual is a US person, tax information will be required, such as a W-9, in order to properly issue a 1099.

Vulnerabilities and their impacts mentioned in the following audit reports are ineligible for a reward:

https://forum.stacks.org/t/stacks-2-0-security-audits/11464

https://paper.dropbox.com/published/Stacks-2.0-Security-Audit-Resolution-0oyUrm2niuXUc9vS0bgT7rS

https://www.dropbox.com/sh/ss01em9ly2r92lx/AACehrRuPhms9ONLLTCkIkXIa/Blockstack_Desktop_Wallet_Pentest_Report_11-12-2020.pdf?dl=0

https://www.dropbox.com/sh/ss01em9ly2r92lx/AAAy4ktVAYN3kOSbLFs9M4O6a/NCC_Group_Stacks_Blockchain_Audit_Report_2020-11-23_v1.0.pdf?dl=0

https://www.dropbox.com/sh/ss01em9ly2r92lx/AAB4wj-g0c7RUbjrYLhRApdza/NCC_Group_Stacks_Wallet_Report_2020-11-17_v1.0.pdf?dl=0

Payouts are handled by the Stacks Foundation team directly and are denominated in USD. However, payments can be made in USD (including USDT and USDC), STX (USD equivalent) or BTC (USD equivalent) at the discretion of Stacks Foundation.

Blockchain/DLT

Critical
Level
Up to USD $1,000,000
Payout
PoC Required
High
Level
USD $50,000
Payout
Medium
Level
USD $10,000
Payout
Low
Level
USD $1,000
Payout

Smart Contract

Critical
Level
Up to USD $1,000,000
Payout
PoC Required
High
Level
USD $50,000
Payout
Medium
Level
USD $10,000
Payout
Low
Level
USD $1,000
Payout

Assets in scope

All smart contracts of Stacks can be found at https://github.com/stacks-network/stacks-blockchain/blob/master/src/chainstate/stacks/boot. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Though the Node implementation asset has “testnet” in the folder name, it is not a testnet node and is within the scope of the bug bounty program.

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Blockchain/DLT

  • Network not being able to confirm new transactions (Total network shutdown)
    Critical
    Impact
  • Trigger a deep fork without spending the requisite BTC
    Critical
    Impact
  • Chain split due to different nodes processing the same block or transaction with different results
    Critical
    Impact
  • Direct loss of funds other than permanent or temporary freezing
    Critical
    Impact
  • Invalid transaction confirmed (such as with an incorrect nonce)
    Critical
    Impact
  • Unintended chain split (Network partition)
    High
    Impact
  • Transient consensus failures
    High
    Impact
  • Remotely-exploitable memory or disk access, restricted to the Stacks Blockchain RPC/P2P ports
    High
    Impact
  • Remotely-exploitable denial of service in a node
    High
    Impact
  • DoS of greater than 30% of miners and does not shut down the network
    Medium
    Impact
  • DoS of greater than 10% but less than 30% of miners and does not shut down the network
    Low
    Impact
  • Underpricing transaction fees relative to computation time
    Low
    Impact

Smart Contract

  • Loss of user funds by permanent freezing or theft
    Critical
    Impact
  • Loss of governance funds (limited to `.cost-vote`)
    Critical
    Impact
  • Governance vote manipulation
    Critical
    Impact
  • Theft of unclaimed reward
    High
    Impact
  • Permanent freezing of unclaimed reward
    High
    Impact
  • Block stuffing without fund transfers blocked
    Medium
    Impact
  • Block stuffing the Stacks chain such that smart contract calls can be blocked, but without paying the requisite higher transaction fees
    Medium
    Impact
  • Smart contract fails to deliver promised returns, but doesn’t lose value
    Low
    Impact
  • A smart contract has certain operations underpriced or overpriced in ways that we don’t know about (i.e. that we don’t have open issues for)
    Low
    Impact

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Attacks that the reporter has already exploited themselves, leading to damage
  • Attacks requiring access to leaked keys/credentials
  • Attacks requiring access to privileged addresses (governance, strategist)
  • Attacks that depend on a remote bitcoin node over an untrusted network
  • Attacks requiring the use of a bitcoin miner
  • Attacks that require a bitcoin miner to cooperate with any attack
  • Any attack using a vendored dependency is limited to at most a Low impact (Github issue or PR is preferred in this case)
  • Any attack using a publicly known github issue or PR (including vendored dependencies - see above)

Smart Contracts and Blockchain

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Basic economic governance attacks (e.g. 51% attack)
  • Lack of liquidity
  • Best practice/Test case critiques
  • Sybil attacks
  • Centralization risks

The following activities are prohibited by this bug bounty program:

  • Any testing with mainnet or public testnet contracts; all testing should be done on private testnets or mocknet
  • Any testing with pricing oracles or third party smart contracts
  • Attempting phishing or other social engineering attacks against our employees and/or customers
  • Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
  • Any denial of service attacks
  • Automated testing of services that generates significant amounts of traffic and/or DoS of the HTTP endpoints
  • Public disclosure of an unpatched vulnerability in an embargoed bounty