Babylon Labs’ codebase can be found at [https://github.com/babylonlabs-io](https://github.com/babylonlabs-io). Documentation and further resources can be found on [https://docs.babylonlabs.io](https://docs.babylonlabs.io).

__High-level articles on how Bitcoin Staking works:__

- https://babylonlabs.io/blog/what-is-bitcoin-staking 
- https://babylonlabs.io/blog/technical-preliminaries-of-bitcoin-staking 
- https://babylonlabs.io/blog/babylon-s-bitcoin-staking-contract 

Below are general purpose technical documentations around the Bitcoin Staking Protocol and the lock-only system operated by the current testnet. Documentation on individual components of the system can be found in the component repositories.

__Bitcoin Staking Protocol and Litepaper:__ 
- https://docs.babylonlabs.io/docs/introduction/btc-staking 

__Introductory reading:__ 

Bitcoin staking 101 Series:

- https://babylonlabs.io/blog/what-is-bitcoin-staking
- https://babylonlabs.io/blog/technical-preliminaries-of-bitcoin-staking
- https://babylonlabs.io/blog/babylon-s-bitcoin-staking-contract

__Bitcoin Staking Scripts:__ 
- https://github.com/babylonlabs-io/babylon/blob/v0.9.x/docs/staking-script.md 

__Creating Bitcoin Staking Transactions:__ 
- https://github.com/babylonlabs-io/babylon/blob/v0.9.x/docs/transaction-impl-spec.md

Direct loss of funds

Permanent freezing of funds

Retrieve the private key of a covenant committee member

Leakage of EOTS private keys without the holder double-signing

Execute arbitrary system commands

Retrieve sensitive data/files from a running server, such as:  `/etc/shadow`, database passwords, blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:   Making trades

Subdomain takeover with already-connected wallet interaction

Direct theft of user funds or causing their freezing

Malicious interactions with an already-connected wallet, such as: Modifying transaction arguments or parameters, Submitting malicious transactions

Generation of invalid  EOTS keys

Generation of invalid EOTS key signatures / Invalid verification of EOTS key signatures

Inability for a non-malicious covenant signer to sign valid unbonding requests for more than 24h.

Generation of unbonding and withdrawal transactions that cannot be confirmed by the Bitcoin ledger

Temporary freezing of funds for more than the staking timelock for a staking transaction or more than the unbonding timelock for an unbonding transaction.

Staking backend recognising staking, unbonding, and withdrawal transactions as valid when they are invalid and vice verca.

Causing the staking backend to process staking, unbonding, or withdrawal transactions that do not conform to the set parameters and protocol.

Staking backend incorrectly identifying the status of a stake

Taking down the API/website

API unable to process unbonding requests

Injecting/modifying the static content on the target application without JavaScript (persistent), such as:  HTML injection without JavaScript, Replacing existing text with arbitrary text, Arbitrary file uploads etc

Subdomain takeover without already-connected wallet interaction

Causing a temporary (more than 1 hour) inability to process unbonding requests

Generation of staking transactions that cannot be confirmed by the Bitcoin ledger

Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as their stored pending transactions.

Injecting/modifying the static content on the target application without JavaScript (reflected), such as:  Reflected HTML injection, Loading external site data

Redirecting users to malicious websites (open redirect)

Program crash leading to the inability to process and present information about the current state of the system.

Invalid Calculation of TVL

Incorrectly identifying a staking/unbonding transaction as expired

Changing details of users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction, such as: Iframing leading to modifying the backend/browser state (must demonstrate impact with PoC)

Taking over broken or expired outgoing links, such as:  Social media handles, etc.

Temporarily disabling user to access target site, such as: Locking up the victim from login, Cookie bombing etc.

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

__For the Unbonding Pipeline Process, the following code components and branches are in-scope:__

Everything here [https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/](https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/), except the following test commands:
- createStakingTxCmd https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/cmd/createStakingTxCmd.go 
- createUnbondingTxCmd https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/cmd/createUnbondingTxCmd.go 
- createWithdrawTxCmd https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/cmd/createWithdrawTxCmg.go 

__For the EOTS Manager program, the following code components and branches are in-scope:__

[https://github.com/babylonlabs-io/finality-provider/tree/v0.4.x/eotsmanager](https://github.com/babylonlabs-io/finality-provider/tree/v0.4.x/eotsmanager) – only code associated with the eotsd init, eotsd keys add, eotsd sign-schnorr, and the eotsd verify-schnorr-sig commands is in scope. The EOTS manager daemon functionality is not in scope.

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/). 

__Reward Calculation for Blockchain/DLT Critical Level Reports__

For critical Blockchain/DLT bugs, the reward amount is 10% of the funds directly affected, capped at the maximum critical reward __USD 1 000 000__. However, a minimum reward of __USD 50 000__ is to be rewarded in order to incentivize security researchers against withholding on a bug report.

All other impacts that would be classified as Critical would be rewarded with a minimum of __USD 50 000__. The rest of the severity levels are paid out according to the Impact in Scope table.

__Reward Calculation for Blockchain/DLT High Level Reports__

- In the event of temporary freezing, the reward doubles from the full frozen value for every additional __24h__ that the funds are temporarily frozen, up until a max cap of the high reward. This is because as the duration of the freezing lengthens, the potential for greater damage and subsequent reputational harm intensifies. Thus, by increasing the reward proportionally with the frozen duration, the project ensures stronger incentives for bug disclosure of this nature.

__Reward Calculation for Web/Apps Critical Level Reports__

For critical web/apps bug reports will be rewarded with __USD 100 000__, only if the impact leads to:

- A loss of funds involving an attack that does not require any user action
- Users funds being permanently stuck involving an attack that does not require any user action
- Private key or private key generation leakage leading to unauthorized access to user funds 

All other impacts that would be classified as Critical would be rewarded with a minimum of __USD 10 000__. 

The rest of the severity levels are paid out according to the Impact in Scope table.  

__Reward Payment Terms__

Payouts are handled by the **Babylon Labs** team directly and are denominated in __USD__. However, payments are done in __USDC__ on Ethereum

Babylon Labs

Resources & Documentation