Filecoin

We encourage good-faith security research. Reporters are required to follow this Policy in order to be eligible for an award. However, the Filecoin Foundation may, in its sole discretion, award a bounty when the researcher makes a good faith attempt to comply.

This is a discretionary award program. The Filecoin Foundation reserves the right to modify, restrict, suspend, or otherwise change any aspect of this Program at any time, and the decision as to whether or not to pay an award is at the sole discretion of the Filecoin Foundation. Any updated rules will be effective as of the time of posting, or upon such a later date as specified by the Filecoin Foundation.

If the Filecoin Foundation determines at any time in its sole discretion that a reporter or potential award recipient is ineligible, in violation of these rules or applicable laws, or engaging in behavior that it deems to violate our Code of Conduct, or that is obnoxious, deceptive, inappropriate, threatening, illegal or that is intended to annoy, abuse, or harass any other person, Filecoin Foundation reserves the right to disqualify that reporter or potential award recipient. Any such disqualified reporter or potential award recipient will then be ineligible for the award.

Public disclosure of the vulnerability must conform with the Coordinated Disclosure Policy. The CDP is subject to change at any time.

These impacts are out of scope for this bug bounty program.

All Categories:

• Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
• Impacts caused by attacks requiring access to leaked keys/credentials
• Impacts caused by attacks requiring access to privileged addresses (governance, strategist) except in such cases where the contracts are intended to have no privileged access to functions that make the attack possible
• Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
• Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
• Best practice recommendations
• Feature requests
• Impacts on test files and configuration files unless stated otherwise in the bug bounty program

Blockchain/DLT & Smart Contract Specific:

• Incorrect data supplied by third party oracles
  • Not to exclude oracle manipulation/flash loan attacks
• Impacts requiring basic economic and governance attacks (e.g. 51% attack)
• Lack of liquidity impacts
• Impacts from Sybil attacks
• Impacts involving centralization risks

Prohibited Activities:

The following activities are prohibited by this Program. Violation of these rules can result in a temporary suspension or permanent ban from the Immunefi platform at the sole discretion of the Immunefi team, which may also result in:

1. the forfeiture and loss of access to all bug submissions, and/or
2. zero payout.

Please note that Immunefi has no tolerance for spam/low-quality/incomplete bug reports, “beg bounty” behavior, and misrepresentation of assets and severity. Immunefi exists to protect the global crypto community, not facilitate grift.

Prohibited:

• Any testing with mainnet or public testnet deployed code; all testing should be done on private testnets
• Attempting phishing or other social engineering attacks against Filecoin Foundation, storage providers, Filecoin project contributors, ecosystem collaborators, or community members.
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Active exploits against the Filecoin network or Filecoin miners and nodes
• Physical or electronic attempts to access offices where project contributors work or data centers where Filecoin nodes are located
• Violating the privacy of Filecoin users and community members, compromising or disrupting their systems, destroying data, stealing funds and/or harming the user experience. If a vulnerability provides unintended access to data, you must limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately

Play by the rules. This includes following the law, this Policy, and any other relevant agreements and policies, including abiding by the Filecoin Community Code of Conduct in all communications, discussions, and/or posts related to this Program or your discovered vulnerability. Testing must not violate any law or compromise any data that is not your