Stacks
Submit a BugProgram Overview
Stacks is a layer-1 blockchain that shares consensus with Bitcoin, enabling apps and smart contracts on the world's most robust blockchain. Activity on the Stacks network settles to Bitcoin, allowing developers to harness the security, stability, and economic power of Bitcoin while benefiting from an expressive smart contract layer.
For more information about Stacks, please visit https://stacks.org/ and https://www.stacks.co/.
We at the Stacks Foundation maintain essential components of the Stacks blockchain infrastructure. Our security team prioritizes the following attack vectors:
- Theft of funds
- Permanent freezing of funds
- Total network shutdown or denial-of-service vectors
- Chain split or deep fork vectors
- Invalid transactions confirming
- Consensus failures
- Remotely exploitable weaknesses (as triggered through standard Stacks - RPC and P2P ports only)
- (In smart contracts) Vote manipulation
- (In smart contracts) Block stuffing attacks
- (In smart contracts) Theft or loss of unclaimed rewards
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2 v2. This is a simplified 5-level scale, with separate scales for each category, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. If there is any discrepancy with the classification in the Impacts in Scope section, the classification in the Impacts in Scope section will hold true.
Please note that Critical finding bounties are capped at 10% of the damage resulting from the finding. This mostly takes into account technical and financial damage but also includes the “human” impact, including reputational risk. We will guarantee a minimum payout of $50,000 USD for all valid Critical findings.
We agree to:
- Respond meaningfully to all reported issues in a timely manner.
- Not pursue legal action against or “counter-hack” any researchers acting in good faith and abiding by this program’s rules.
- Consider theoretical attacks and findings without proof-of-concept code as long as technically meaningful, evidence-based arguments are provided.
You must:
- Undergo full KYC. We are based in the United States and abide by all relevant law, including OFAC controls and sanctions.
- Not be based or test from an OFAC-sanctioned country or region or (be a sanctioned individual or organization) as defined here: https://ofac.treasury.gov/sanctions-programs-and-country-information
- Report all bugs using this template. All fields are required.
- Executive summary of issue:
- Finding details:
- Repository, file, and line of code where finding is found:
- Evidence of finding:
- Steps to replicate:
- Proof-of-concept exploitation code:
- Screenshots or video of finding being exploited:
- Impact of finding (short term):
- Impact of finding (long term):
- Mitigation suggestions (short term):
- Mitigation suggestions (long term):
- (Optional) Suggested patch:
- (Optional) Do you want a shout-out on our Security Wall of Fame?
- Use a private testnet. Testing on mainnet or public testnets is forbidden.
Payouts are handled by the Stacks Foundation team directly and are denominated in USD. However, payments will be made in the USD equivalent in the Stacks token (STX).
Blockchain/DLT
- Critical
- Level
- Up to USD $1,000,000
- Payout
- High
- Level
- USD $50,000
- Payout
- Medium
- Level
- USD $10,000
- Payout
- Low
- Level
- USD $1,000
- Payout
Smart Contract
- Critical
- Level
- Up to USD $1,000,000
- Payout
- High
- Level
- USD $50,000
- Payout
- Medium
- Level
- USD $10,000
- Payout
- Low
- Level
- USD $1,000
- Payout
Assets in scope
- Blockchain/DLT - Main RepoType
- Blockchain/DLT - Node implementationType
- TargetSmart Contract - BNS contractType
- TargetSmart Contract - POX contractType
- Smart Contract - Lockup contractType
- Smart Contract - Costs contractType
- Smart Contract - Cost voting contractType
All smart contracts of Stacks can be found at https://github.com/stacks-network/stacks-blockchain/blob/master/src/chainstate/stacks/boot. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.
Though the Node implementation asset has “testnet” in the folder name, it is not a testnet node and is within the scope of the bug bounty program.
Impacts in scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Blockchain/DLT
- Network not being able to confirm new transactions (Total network shutdown)CriticalImpact
- Trigger a deep fork without spending the requisite BTCCriticalImpact
- Chain split due to different nodes processing the same block or transaction with different resultsCriticalImpact
- Direct loss of funds other than permanent or temporary freezingCriticalImpact
- Invalid transaction confirmed (such as with an incorrect nonce)CriticalImpact
- Unintended chain split (Network partition)HighImpact
- Transient consensus failuresHighImpact
- Remotely-exploitable memory or disk access, restricted to the Stacks Blockchain RPC/P2P portsHighImpact
- Remotely-exploitable denial of service in a nodeHighImpact
- DoS of greater than 30% of miners and does not shut down the networkMediumImpact
- DoS of greater than 10% but less than 30% of miners and does not shut down the networkLowImpact
- Underpricing transaction fees relative to computation timeLowImpact
Smart Contract
- Loss of user funds by permanent freezing or theftCriticalImpact
- Loss of governance funds (limited to `.cost-vote`)CriticalImpact
- Governance vote manipulationCriticalImpact
- Theft of unclaimed rewardHighImpact
- Permanent freezing of unclaimed rewardHighImpact
- Block stuffing without fund transfers blockedMediumImpact
- Block stuffing the Stacks chain such that smart contract calls can be blocked, but without paying the requisite higher transaction feesMediumImpact
- Smart contract fails to deliver promised returns, but doesn’t lose valueLowImpact
- A smart contract has certain operations underpriced or overpriced in ways that we don’t know about (i.e. that we don’t have open issues for)LowImpact
Out of Scope & Rules
The following vulnerabilities are excluded from the rewards for this bug bounty program:
- Attacks that the reporter has already exploited themselves, leading to damage
- Attacks requiring access to leaked keys/credentials
- Attacks requiring access to privileged addresses (governance, strategist)
- Attacks that depend on a remote bitcoin node over an untrusted network
- Attacks requiring the use of a bitcoin miner
- Attacks that require a bitcoin miner to cooperate with any attack
- Any attack using a vendored dependency is limited to at most a Low impact (Github issue or PR is preferred in this case)
- Any attack using a publicly known github issue or PR (including vendored dependencies - see above)
Smart Contracts and Blockchain
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Basic economic governance attacks (e.g. 51% attack)
- Lack of liquidity
- Best practice/Test case critiques
- Sybil attacks
- Centralization risks
The following activities are prohibited by this bug bounty program:
- Any testing with mainnet or public testnet contracts; all testing should be done on private testnets or mocknet
- Any testing with pricing oracles or third party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks
- Automated testing of services that generates significant amounts of traffic and/or DoS of the HTTP endpoints
- Public disclosure of an unpatched vulnerability in an embargoed bounty