Filecoin-logo

Filecoin

Filecoin is a decentralized storage network designed to store humanity's most important data. As such, security is of paramount importance to us.

Filecoin
Blockchain
L1
Go
Rust
Maximum Bounty
$150,000
Live Since
14 April 2023
Last Updated
24 October 2024
  • PoC required

  • KYC required

Select the category you'd like to explore

Assets in Scope

Target
Type
Blockchain/DLT - Some basic utilities to generate fast path cbor codecs for your types.
Added on
26 April 2024
Target
Type
Blockchain/DLT - An implementation of a cbor encoded merkledag object.
Added on
26 April 2024
Target
Type
Blockchain/DLT - This package is a reference implementation of the IPLD HAMT used in the Filecoin blockchain
Added on
26 April 2024
Target
Type
Blockchain/DLT - A general-purpose key-value store for CBOR-encodable data
Added on
26 April 2024
Target
Type
Blockchain/DLT - A generic state machine
Added on
26 April 2024
Target
Type
Blockchain/DLT - An abstraction used to manage a storage miner's sectors
Added on
26 April 2024
Target
Type
Blockchain/DLT - Tools for mapping between bit-padded and not-bit-padded byte streams
Added on
26 April 2024
Target
Type
Blockchain/DLT - Conversion Utilities Between CID and Piece/Data/Replica Commitments
Added on
26 April 2024
Target
Type
Blockchain/DLT - A go module to perform data transfers over ipfs/go-graphsync
Added on
26 April 2024
Target
Type
Blockchain/DLT - Crypto utility functions used in Filecoin
Added on
26 April 2024
Target
Type
Blockchain/DLT - CBOR utilities for reading and writing objects to CBOR representation, optimizing for fast path serialization/deserialization generated by cbor-gen
Added on
26 April 2024
Target
Type
Blockchain/DLT - Features iterator based primitives that scale with number of runs instead of number of bits.
Added on
26 April 2024

Impacts in Scope

Severity
Critical
Title

Total Chain halt

Severity
Critical
Title

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Severity
Critical
Title

Direct loss of funds

Severity
Critical
Title

Permanent freezing of funds (fix requires hardfork)

Severity
Critical
Title

Protocol-level bug that causes a general breakage of all contracts deployed on the chain

Severity
Critical
Title

Protocol-level bug that enables tricking contracts into sending funds to arbitrary addresses

Severity
High
Title

Unintended chain split (Network partition) with localized impacts (which would require hard fork but doesn’t affect the chain as whole)

Severity
High
Title

Transient consensus failures (Temporary halt in transactions leading to consensus failure)

Severity
High
Title

Protocol-level bug preventing contracts from using their funds

Severity
High
Title

Protocol-level bug causing the inability for developers to deploy new smart contracts

Severity
High
Title

Protocol-level bug rendering a single contract unusable after the exploit (i.e. contract bricked)

Severity
High
Title

Inability to propagate new transactions

Out of scope

Program's Out of Scope information

We encourage good-faith security research. Reporters are required to follow this Policy in order to be eligible for an award. However, the Filecoin Foundation may, in its sole discretion, award a bounty when the researcher makes a good faith attempt to comply.

This is a discretionary award program. The Filecoin Foundation reserves the right to modify, restrict, suspend, or otherwise change any aspect of this Program at any time, and the decision as to whether or not to pay an award is at the sole discretion of the Filecoin Foundation. Any updated rules will be effective as of the time of posting, or upon such a later date as specified by the Filecoin Foundation.

If the Filecoin Foundation determines at any time in its sole discretion that a reporter or potential award recipient is ineligible, in violation of these rules or applicable laws, or engaging in behavior that it deems to violate our Code of Conduct, or that is obnoxious, deceptive, inappropriate, threatening, illegal or that is intended to annoy, abuse, or harass any other person, Filecoin Foundation reserves the right to disqualify that reporter or potential award recipient. Any such disqualified reporter or potential award recipient will then be ineligible for the award.

Public disclosure of the vulnerability must conform with the Coordinated Disclosure Policy. The CDP is subject to change at any time.

The following activities are prohibited by this Program. Violation of these rules can result in a temporary suspension or permanent ban from the Immunefi platform at the sole discretion of the Immunefi team, which may also result in:

  1. the forfeiture and loss of access to all bug submissions, and/or
  2. zero payout.

Please note that Immunefi has no tolerance for spam/low-quality/incomplete bug reports, “beg bounty” behavior, and misrepresentation of assets and severity. Immunefi exists to protect the global crypto community, not facilitate grift.

  • Physical or electronic attempts to access offices where project contributors work or data centers where Filecoin nodes are located
  • Violating the privacy of Filecoin users and community members, compromising or disrupting their systems, destroying data, stealing funds and/or harming the user experience. If a vulnerability provides unintended access to data, you must limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately

Play by the rules. This includes following the law, this Policy, and any other relevant agreements and policies, including abiding by the Filecoin Community Code of Conduct in all communications, discussions, and/or posts related to this Program or your discovered vulnerability. Testing must not violate any law or compromise any data that is not your

Default Out of Scope and rules

Blockchain/DLT specific

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Impacts requiring basic economic and governance attacks (e.g. 51% attack)
  • Lack of liquidity impacts
  • Impacts from Sybil attacks
  • Impacts involving centralization risks

All categories

  • Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
  • Impacts caused by attacks requiring access to leaked keys/credentials
  • Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
  • Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
  • Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
  • Best practice recommendations
  • Feature requests
  • Impacts on test files and configuration files unless stated otherwise in the bug bounty program
  • Impacts requiring phishing or other social engineering attacks against project's employees and/or customers
Severity
Min. - Max.
Critical
$100k -$150k
High
$25k -$100k
Medium
$10k -$25k
Low
$1k -$10k
Total Assets in Scope
28
Total Impacts in Scope
20
Total paid

236.4k