Filecoin-logo

Filecoin

Filecoin is a decentralized storage network designed to store humanity's most important data. As such, security is of paramount importance to us.

Filecoin
Blockchain
L1
Go
Rust
Maximum Bounty
$150,000
Live Since
14 April 2023
Last Updated
19 May 2025
  • PoC Required

  • KYC required

Select the category you'd like to explore

Assets in Scope

Target
Type
Blockchain/DLT - zk-SNARK library
Added on
26 April 2024
Target
Type
Blockchain/DLT - Boost is a tool for Filecoin storage providers to manage data storage and retrievals on Filecoin.
Added on
26 April 2024
Target
Type
Blockchain/DLT - Built-in Filecoin actors - written in Rust, Wasm-compiled built-in actors (smart contracts, in Filecoin lingo) that are used by all Filecoin clients
Added on
26 April 2024
Target
Type
Blockchain/DLT - The Filecoin address type, used for identifying actors on the Filecoin network, in various formats.
Added on
26 April 2024
Target
Type
Blockchain/DLT - Implementation of an array mapped trie using go and ipld
Added on
26 April 2024
Target
Type
Blockchain/DLT - Features iterator based primitives that scale with number of runs instead of number of bits.
Added on
26 April 2024
Target
Type
Blockchain/DLT - CBOR utilities for reading and writing objects to CBOR representation, optimizing for fast path serialization/deserialization generated by cbor-gen
Added on
26 April 2024
Target
Type
Blockchain/DLT - Crypto utility functions used in Filecoin
Added on
26 April 2024
Target
Type
Blockchain/DLT - A go module to perform data transfers over ipfs/go-graphsync
Added on
26 April 2024
Target
Type
Blockchain/DLT - Golang implementation of Fast Finality for Filecoin (F3)
Added on
13 May 2025
Target
Type
Blockchain/DLT - Conversion Utilities Between CID and Piece/Data/Replica Commitments
Added on
26 April 2024
Target
Type
Blockchain/DLT - Tools for mapping between bit-padded and not-bit-padded byte streams
Added on
26 April 2024

Impacts in Scope

Severity
Critical
Title

Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

Severity
Critical
Title

Direct loss of funds

Severity
Critical
Title

Permanent freezing of funds (fix requires hardfork)

Severity
Critical
Title

Total Chain halt

Severity
Critical
Title

Protocol-level bug that causes a general breakage of all contracts deployed on the chain

Severity
Critical
Title

Protocol-level bug that enables tricking contracts into sending funds to arbitrary addresses

Severity
High
Title

Unintended chain split (Network partition) with localized impacts (which would require hard fork but doesn’t affect the chain as whole)

Severity
High
Title

Transient consensus failures (Temporary halt in transactions leading to consensus failure)

Severity
High
Title

Protocol-level bug preventing contracts from using their funds

Severity
High
Title

Protocol-level bug causing the inability for developers to deploy new smart contracts

Severity
High
Title

Protocol-level bug rendering a single contract unusable after the exploit (i.e. contract bricked)

Severity
High
Title

Inability to propagate new transactions (limited to fraction of the network)

Out of scope

Default Out of Scope and rules

Blockchain/DLT specific

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Impacts requiring basic economic and governance attacks (e.g. 51% attack)
  • Lack of liquidity impacts
  • Impacts from Sybil attacks
  • Impacts involving centralization risks

All categories

  • Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
  • Impacts caused by attacks requiring access to leaked keys/credentials
  • Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
  • Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
  • Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
  • Best practice recommendations
  • Feature requests
  • Impacts on test files and configuration files unless stated otherwise in the bug bounty program
  • Impacts requiring phishing or other social engineering attacks against project's employees and/or customers