Filecoin
Filecoin is a decentralized storage network designed to store humanity's most important data. As such, security is of paramount importance to us.
PoC required
KYC required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Total Chain halt
Unintended permanent chain split requiring hard fork (network partition requiring hard fork)
Direct loss of funds
Permanent freezing of funds (fix requires hardfork)
Protocol-level bug that causes a general breakage of all contracts deployed on the chain
Protocol-level bug that enables tricking contracts into sending funds to arbitrary addresses
Unintended chain split (Network partition) with localized impacts (which would require hard fork but doesn’t affect the chain as whole)
Transient consensus failures (Temporary halt in transactions leading to consensus failure)
Protocol-level bug preventing contracts from using their funds
Protocol-level bug causing the inability for developers to deploy new smart contracts
Protocol-level bug rendering a single contract unusable after the exploit (i.e. contract bricked)
Inability to propagate new transactions
Out of scope
We encourage good-faith security research. Reporters are required to follow this Policy in order to be eligible for an award. However, the Filecoin Foundation may, in its sole discretion, award a bounty when the researcher makes a good faith attempt to comply.
This is a discretionary award program. The Filecoin Foundation reserves the right to modify, restrict, suspend, or otherwise change any aspect of this Program at any time, and the decision as to whether or not to pay an award is at the sole discretion of the Filecoin Foundation. Any updated rules will be effective as of the time of posting, or upon such a later date as specified by the Filecoin Foundation.
If the Filecoin Foundation determines at any time in its sole discretion that a reporter or potential award recipient is ineligible, in violation of these rules or applicable laws, or engaging in behavior that it deems to violate our Code of Conduct, or that is obnoxious, deceptive, inappropriate, threatening, illegal or that is intended to annoy, abuse, or harass any other person, Filecoin Foundation reserves the right to disqualify that reporter or potential award recipient. Any such disqualified reporter or potential award recipient will then be ineligible for the award.
Public disclosure of the vulnerability must conform with the Coordinated Disclosure Policy. The CDP is subject to change at any time.
The following activities are prohibited by this Program. Violation of these rules can result in a temporary suspension or permanent ban from the Immunefi platform at the sole discretion of the Immunefi team, which may also result in:
- the forfeiture and loss of access to all bug submissions, and/or
- zero payout.
Please note that Immunefi has no tolerance for spam/low-quality/incomplete bug reports, “beg bounty” behavior, and misrepresentation of assets and severity. Immunefi exists to protect the global crypto community, not facilitate grift.
- Physical or electronic attempts to access offices where project contributors work or data centers where Filecoin nodes are located
- Violating the privacy of Filecoin users and community members, compromising or disrupting their systems, destroying data, stealing funds and/or harming the user experience. If a vulnerability provides unintended access to data, you must limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately
Play by the rules. This includes following the law, this Policy, and any other relevant agreements and policies, including abiding by the Filecoin Community Code of Conduct in all communications, discussions, and/or posts related to this Program or your discovered vulnerability. Testing must not violate any law or compromise any data that is not your
Blockchain/DLT specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers
236.4k