Hedera

The Critical Blockchian/DLT impact “Network not being able to confirm new transactions (total network shutdown)” is only able to be considered at Critical if the fix requires a manual rollback. Otherwise, the severity level may be downgraded by at least one severity level.

Any impact requiring an attack vector that involves a privileged account, defined as one that is of the Hedera team or one that is required to receive approval from the Hedera team, directly or indirectly, may be downgraded by at least one severity level or be considered as out of scope entirely due to certain permissioned aspects of the Hedera network. This includes attack vectors requiring a roster-admitted consensus node peer or an authenticated gossip connection. Additionally, any bug report with no attacker-induced action is considered as out of scope for this bug bounty program.

For the Medium Blockchain/DLT impact “Incorrect or missing records exported to mirror nodes”, this is limited to consensus-critical or financially significant records, including, but not limited to account balances, token balances, or other authoritative ledger state. All others, such as incorrect or missing records that are non-authoritative, derived, informational, or statistical in nature, may be considered as out of scope.

The following list is the max we pay for a specific impact. It can only be less, not more. In addition to the standard Feasibility Limitations applied to this bug bounty program, the following terms also apply:

Network Impact Proof Bug reports with demonstrated impact on only a single node, including nodes in a reconnecting or transitional state, rather than network-wide behavior, are considered as out-of-scope.

Functionality Not Active in Production Severity is assessed against the exploitability of the impact in the current mainnet production environment at the time of submission. Where a bug report demonstrates a valid impact that cannot presently be reached in production, such as where the affected functionality is gated behind a feature flag, is not yet enabled, or depends on a future release, the severity may be downgraded by at least one severity level at the discretion of the Hedera team. Bug reports of this nature remain in scope and are encouraged, as identifying issues in functionality that is not yet active in production is valuable and will be assessed on its merits. Any downgrade under this clause reflects only the current exploitability of the impact in production and not the validity of the bug report itself.

Economic Viability of an Attack Severity is calibrated to the economic viability and financial impact of an attack rather than solely to its technical possibility. Where the investment required to execute an attack, whether in capital, resources, or fees, is disproportionate to the value an attacker could realistically extract or the damage they could realistically inflict, such that the attack yields no meaningful net gain or a net loss to a rational attacker, the severity may be downgraded by at least one severity level or may be considered as out of scope entirely at the discretion of the Hedera team. The same applies where the funds or value realistically at risk, or the financial loss the attack could realistically cause, is negligible in absolute terms, including where the impact is limited to low-value amounts such as transaction fees. This assessment is made against the realistic cost and realizable impact of the attack at the time of submission.

Suggestions for places to start

• Ability to execute system commands
• Signing transactions for other users
• Redirection of user deposits and withdrawals
• Tamper/manipulate Hashgraph history to invalidate transactions
• Tampering with submitted transactions
• Authorizing transactions without approval from the required signers/owners
• Preventing network from reaching consensus on transactions that are submitted
• Preventing gossip of a transaction or multiple transactions
• Bugs that cause the in-scope service to crash (e.g., Non-network-based DoS)
• Remote code execution vulnerabilities
• Attacks that cause a probabilistic consensus failure; or a deterministic consensus failure in reconnected nodes
• Effective non-network-bandwidth-flooding DDoS attacks (e.g., transaction hammering)
• Malicious capabilities of Hedera Token Service functions exposed via System contracts (e.g. transferring assets out of an account without permissions).
• System Smart contract modifiers not respected
• Bugs in the economic system to defraud other participants (e.g. avoid transaction fees to full nodes)
• Prevent node from accessing the network
• Incorrect or missing records exported to mirror nodes
• Correct transaction fees not being applied
• Unauthorized Hedera Token Service (HTS) activity
• Overpayment or underpayment of staking rewards
• Theft of unpaid staking rewards
• Sensitive information leakage (e.g., private keys, wallets credentials etc). Public keys are excluded from this scope