All code of Aleph Zero can be found at [https://github.com/orgs/Cardinal-Cryptography/repositories.](https://github.com/orgs/Cardinal-Cryptography/repositories) Documentation for the assets provided in the table can be found at [https://docs.alephzero.org/aleph-zero/. ](https://docs.alephzero.org/aleph-zero/)

Other helpful links include:
- [https://alephzero.org/developers](https://alephzero.org/developers)
- [https://cardinal-cryptography.github.io/AlephBFT/what_is_aleph_bft.html](https://cardinal-cryptography.github.io/AlephBFT/what_is_aleph_bft.html)
- [https://github.com/Cardinal-Cryptography/aleph-node#local-network](https://github.com/Cardinal-Cryptography/aleph-node#local-network)
- [https://github.com/Cardinal-Cryptography/aleph-node/blob/main/BUILD.md](https://github.com/Cardinal-Cryptography/aleph-node/blob/main/BUILD.md)

Aleph Zero is an enterprise-ready, high-performance blockchain platform with a novel, Directed Acyclic Graph (DAG)-based consensus protocol that has been peer-reviewed and presented at an ACM conference. To date, Aleph Zero raised $15m for continued development, integrated with the Parity’s Substrate stack, and expanded the team to ~50 people.

Network not being able to confirm new transactions (Total network shutdown)

Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

Arbitrary signature forging

Permanent finalization stall

Prolonged chain splits and/or long, finalization stalls

RPC API crash affecting projects with greater than or equal to 25% of the market capitalization on top of the respective layer

High compute consumption by validator nodes

Underpricing transaction fees relative to computation time

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below. 

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack will be counted, regardless of whether the smart contract is upgradable, pausable, or killable.

__Public Disclosure of Known Issues__

Bug reports covering previously-discovered bugs acknowledged below are not eligible for any reward through the bug bounty program. 
- Any outdated or vulnerable dependencies, unless directly exploitable against Assets in Scope with the severity “Low” or higher.

__Previous Audits__

Aleph Zero has provided these completed audit review reports for reference. Any unfixed vulnerability mentioned in these reports are not eligible for a reward.
-[ https://assets.alephzero.org/docs/trail-of-bits-consensus-audit.pdf](https://assets.alephzero.org/docs/trail-of-bits-consensus-audit.pdf)

__Proof of Concept (PoC) Requirements__

A PoC is required for the following severity levels:
- Blockchain/DLT - Critical
- Blockchain/DLT - High
- Blockchain/DLT - Medium
- Blockchain/DLT - Low

All PoCs submitted must comply with the Immunefi-wide [PoC Guidelines and Rules.](https://immunefisupport.zendesk.com/hc/en-us/articles/9946217628561-Proof-of-Concept-PoC-Guidelines-and-Rules) Bug report submissions without a PoC when a PoC is required will not be provided with a reward.

__Reward Payment Terms__

Payouts are handled by the Aleph Zero team directly and are denominated in USD. However, payments are done in AZERO, USDT and USDC.  Medium and Low reward will be paid in AZERO.  High and Critical reward will be paid 50% in AZERO and 50% in USDT and USDC.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price is USD 1.75 per token, then the reward will be 2857.142857 units of that token.

Aleph Zero

Resources & Documentation