Built-in Filecoin actors - written in Rust, Wasm-compiled built-in actors (smart contracts, in Filecoin lingo) that are used by all Filecoin clients

Lotus is the reference node implementation for the Filecoin network

Boost is a tool for Filecoin storage providers to manage data storage and retrievals on Filecoin.

An implementation of the graphsync protocol in go!

merkle is a lightweight Rust implementation of a Merkle tree.

Futhark implementation of neptune-compatible Poseidon.

Crate for using pairing-friendly elliptic curves.

The Filecoin address type, used for identifying actors on the Filecoin network, in various formats.

Implementation of an array mapped trie using go and ipld

Features iterator based primitives that scale with number of runs instead of number of bits.

CBOR utilities for reading and writing objects to CBOR representation, optimizing for fast path serialization/deserialization generated by cbor-gen

Crypto utility functions used in Filecoin

A go module to perform data transfers over ipfs/go-graphsync

Conversion Utilities Between CID and Piece/Data/Replica Commitments

Tools for mapping between bit-padded and not-bit-padded byte streams

An abstraction used to manage a storage miner's sectors

A general-purpose key-value store for CBOR-encodable data

This package is a reference implementation of the IPLD HAMT used in the Filecoin blockchain

An implementation of a cbor encoded merkledag object.

Some basic utilities to generate fast path cbor codecs for your types.

Only those listed in the Assets in Scope table are considered to be in scope of the Bug Bounty Program.

Filecoin is a decentralized storage network designed to store humanity's most important data. As such, security is of paramount importance to us.

DoS of greater than 10% but less than 30% of validator or miner nodes and does not shut down the network

Underpricing transaction fees relative to computation time

Contract on the platform fails to deliver promised returns, but doesn’t lose values

EVM instruction fails to execute when provided with concrete parameters

Unintended chain split (Network partition) with localized impacts (which would require hard fork but doesn’t affect the chain as whole)

Transient consensus failures (Temporary halt in transactions leading to consensus failure)

Protocol-level bug preventing contracts from using their funds

Protocol-level bug causing the inability for developers to deploy new smart contracts

Protocol-level bug rendering a single contract unusable after the exploit (i.e. contract bricked)

Inability to propagate new transactions

High compute consumption by validator/mining nodes

DoS of greater than 30% of validator or miner nodes and does not shut down the network

EVM instruction fails to execute, in a general way

Inability to deploy a contract under a specific circumstances

Total Chain halt

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hardfork)

Protocol-level bug that causes a general breakage of all contracts deployed on the chain

Protocol-level bug that enables tricking contracts into sending funds to arbitrary addresses

Rewards are distributed according to the impact of the vulnerability based on the[ Immunefi Vulnerability Severity Classification System V2.3. ](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/)

__Reward Calculation for Critical Level Reports__

For critical Blockchain/DLT bugs, the reward amount is 10% of the funds directly affected, capped at the maximum critical reward $150,000 . However, a minimum reward of USD $100,000 is to be rewarded in order to incentivize security researchers against withholding on a bug report.

All rewards for this Program are scaled based on a set of criteria, taking into account factors like: ease of exploitation of the bug, impact of the bug, likelihood of the vulnerability (particularly for bug reports where the vulnerability would require multiple conditions to be met), and report quality.

Reported security vulnerabilities will be eligible for a bounty amount based on severity, calculated based on its impact and likelihood using the OWASP Risk Rating model (https://owasp.org/www-community/OWASP_Risk_Rating_Methodology).