31 March 2022
Live since
Yes
KYC required
$1,000,000
Maximum bounty
28 December 2023
Last updated

Program Overview

Stacks is a Bitcoin layer for smart contracts; it enables smart contracts and decentralized applications to use Bitcoin as an asset and settle transactions on the Bitcoin blockchain. In the upcoming Nakamoto release of Stacks, Stacks will be secured by the entire hash power of Bitcoin, giving it Bitcoin finality.

For more information about Stacks, please visit https://stacks.org/ and https://www.stacks.co/.

We at the Stacks Foundation maintain essential components of the Stacks blockchain infrastructure. Our security team prioritizes the following attack vectors:

  • Theft of funds
  • Permanent freezing of funds
  • Total network shutdown or denial-of-service vectors
  • Chain split or deep fork vectors
  • Invalid transactions processing successfully or confirming
  • Consensus failures
  • Remotely exploitable weaknesses (as triggered through standard Stacks - RPC and P2P ports only)
  • (In smart contracts) Vote manipulation
  • (In smart contracts) Block stuffing attacks
  • (In smart contracts) Theft or loss of unclaimed rewards

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for each category, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. If there is any discrepancy with the classification in the Impacts in Scope section, the classification in the Impacts in Scope section will hold true.

Please note that Critical finding bounties are capped at 10% of the damage resulting from the finding. This mostly takes into account technical and financial damage but also includes the “human” impact, including reputational risk. We will guarantee a minimum payout of $50,000 USD for all valid Critical findings.

We agree to:

  • Respond meaningfully to all reported issues in a timely manner.
  • Not pursue legal action against or “counter-hack” any researchers acting in good faith and abiding by this program’s rules.
  • Consider theoretical attacks and findings without proof-of-concept code as long as technically meaningful, evidence-based arguments are provided.

You must:

  • Undergo full KYC. We are based in the United States and abide by all relevant law, including OFAC controls and sanctions.
  • Not be based or test from an OFAC-sanctioned country or region or (be a sanctioned individual or organization) as defined here: https://ofac.treasury.gov/sanctions-programs-and-country-information
  • Report all bugs using this template. All fields are required unless otherwise marked. Fields with a star (*) must be encrypted with the [email protected] GPG key, fingerprint 8A8B 3C3B 803A 0603 8FB5 3F69 357C 80AB 0885 87A0.
    • Executive summary of issue:
    • Finding details:
    • Repository, file, and line of code where finding is found:
    • Steps to replicate*:
    • Proof-of-concept exploitation code*:
    • Screenshots or video of finding being exploited using the PoC you have provided*:
    • Impact of finding (short term):
    • Impact of finding (long term):
    • Mitigation suggestions (short term):
    • Mitigation suggestions (long term):
    • (Optional) Suggested patch:
    • (Optional) Any useful links or resources:
    • (Optional) Do you want a shout-out on our Security Wall of Fame?
    • (Optional, if approved) Do you want a cybersecurity-themed NFT sent to your Stacks wallet?
  • Use a private testnet. Testing on mainnet or public testnets is forbidden.

Payouts are handled by the Stacks Foundation team directly and are denominated in USD. However, payments will be made in the USD equivalent in the Stacks token (STX).

Blockchain/DLT

Critical
Level
Up to USD $1,000,000
Payout
PoC Required
High
Level
USD $50,000
Payout
PoC Required
Medium
Level
USD $10,000
Payout
PoC Required
Low
Level
USD $1,000
Payout
PoC Required

Smart Contract

Critical
Level
Up to USD $1,000,000
Payout
PoC Required
High
Level
USD $50,000
Payout
PoC Required
Medium
Level
USD $10,000
Payout
PoC Required
Low
Level
USD $1,000
Payout
PoC Required

Assets in scope

All smart contracts of Stacks can be found at https://github.com/stacks-network/stacks-blockchain/blob/master/src/chainstate/stacks/boot. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Though the Node implementation asset has “testnet” in the folder name, it is not a testnet node and is within the scope of the bug bounty program.

Impacts in scope

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Blockchain/DLT

  • Any network to shut down or otherwise not confirm new valid transactions for multiple blocks
    Critical
    Impact
  • Any triggering of a deep fork of 10 or more blocks without spending the requisite Bitcoin
    Critical
    Impact
  • Any causing the direct loss of funds other than through any form of freezing
    Critical
    Impact
  • Any chain split caused by different nodes processing the same block or transaction and yielding different results
    Critical
    Impact
  • Any confirmation of an invalid transaction, such as with an incorrect nonce
    Critical
    Impact
  • Any unintended chain split or network partition
    High
    Impact
  • Any remotely-exploitable memory access, disk access, or persistent code execution. Attacks are restricted to the Stacks blockchain RPC/P2P ports
    High
    Impact
  • Any transient consensus failures
    Medium
    Impact
  • Any remotely-exploitable denial of service in a node
    Low
    Impact
  • Any network denial of service impacting more than 10% of miners that does not shut down the network
    Low
    Impact

Smart Contract

  • Any loss of user funds by permanent freezing or theft
    Critical
    Impact
  • Any loss of governance funds (limited to `.cost-vote`)
    Critical
    Impact
  • Any governance vote manipulation
    Critical
    Impact
  • Any theft of an unclaimed reward
    High
    Impact
  • Any permanent freezing of an unclaimed reward
    High
    Impact
  • Any block stuffing without fund transfers being blocked
    Medium
    Impact
  • Anylock stuffing such that smart contract calls can be blocked, but without paying any requisite higher transaction fees
    Medium
    Impact
  • Any in-scope smart contract fails to deliver promised returns, but doesn’t lose value
    Low
    Impact
  • Any underpricing or overpricing of smart contract operations
    Low
    Impact

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

Please note that all variants of remote denial-of-service attacks will automatically have their impact set to “Low”, regardless of any further downstream impact.

Please review open PRs before your submission as all duplicate attacks are considered “Out of Scope” as per below.

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

  • Any attacks that the reporter has already exploited themselves, leading to real-world damage.
  • Any attacks requiring access to leaked keys or credentials.
  • Any attacks requiring access to a privileged address, including but not limited to any governance or strategist addresses.
  • Any attacks on 3rd party services, including but not limited to AWS or Datadog.
  • Any sub-optimal default configuration changes.

The following activities and findings are explicitly out of scope of this bug bounty program:

  • Any phishing, social engineering, or related attacks against the Stacks ecosystem or any members or customers thereof.
  • Any reporting of findings that are already public or known to us, including but not limited to: open Github PRs and issues; previous findings reported by other researchers; findings discovered during currently-active third-party security assessments; and duplicated results of concluded assessments as posted here: https://stacks.org/audits. Novel methods of attack leading to an already-documented impact are allowed.
  • Any testing of third-party components.
    • If it’s not listed as in-scope, it’s safe to assume you shouldn’t be testing or relying on it.
    • If you disagree, feel free to explain why in your submission but DO NOT continue testing with our explicit written approval.
  • (If applicable to funds) Any actual theft or freeze of funds.
  • Any findings requiring access to or the cooperation of a Bitcoin miner.
  • Any theoretical attacks without substantial evidence and supporting documentation.

The following activities will make you immediately ineligible for a reward, regardless of your report’s validity:

  • Any failure to provide any information requested in the above reporting template.
  • Any failure to use the given public GPG key to encrypt sensitive information.
  • Any negative or hostile behavior towards the Stacks ecosystem or members thereof, including but not limited to abuse of the ImmuneFi mediation process, initiation of direct contact with any Stacks ecosystem member via any communications method outside of ImmuneFi, and any form of coercion, harassment, threats, intimidation, stalking, or extortion.
    • This also includes repeatedly asking for multiple status updates - we promise we have eyes on your report.
  • Any automated scanner findings or fuzz test results without an associated functional proof-of-concept.
  • Any testing on mainnet or public testnet beyond the absolute minimum required to prove that your finding exists on them.
  • Any active exploitation of a reported vulnerability beyond the absolute minimum required to prove the validity of your proof-of-concept code.
    • You must not attack any other users under any circumstances. Test on your own addresses or contracts.
  • Any public disclosure of a reported issue, including via CVE number assignment.
  • Any failure to abide by any rules, requirements, or obligations as detailed above.

The following activities are prohibited by this bug bounty program:

  • Any testing with mainnet or public testnet contracts.
    • all testing should be done on private testnets.
  • Any testing with pricing oracles or third party smart contracts.
  • Any attempting of phishing or other social engineering attacks against any Stacks ecosystem member.
  • Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks).
  • Any denial-of-service attacks.
  • Any automated testing of services on mainnet that generates significant amounts of traffic.
  • Any public disclosure of an unpatched vulnerability in an embargoed bounty.