Autonomous Agent (similar to Ethereum Smart Contract)

Smart Contracts and Autonomous Agents for Counterstake cross-chain bridge

Obyte is a distributed ledger based on directed acyclic graph **(DAG)** and is without middlemen. Unlike centralized ledgers and blockchains, access to the Obyte ledger is decentralized, disintermediated, free (as in freedom), equal, and open.

Network not being able to confirm new transactions (Total network shutdown)

Unintended permanent chain split requiring hard fork (Network partition requiring hard fork)

Direct loss of funds

Permanent freezing of funds (fix requires hardfork)

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Protocol Insolvency

Execute arbitrary system commands

Retrieve sensitive data/files from a running server, such as:         - database passwords usable from the open internet ,        - wallet private keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking state-modifying authenticated actions that lead to loss of funds on behalf of other users without any interaction by that user.

Direct theft of user funds

Temporary freezing of network transactions by delaying adequate processing for at least 1 day

Temporary freezing of funds for at least 1 year

Injecting/modifying the static content on the target application without JavaScript (persistent), such as:         - HTML injection without JavaScript         - Replacing existing text with arbitrary text         - Arbitrary file uploads, etc.

Improperly disclosing confidential user information, such as:         - Email address         - Phone number         - Physical address, etc.

Temporary freezing of network transactions by delaying adequate processing for at least 1 hour

A bug in the respective layer 1 network code that results in unintended smart contract behavior with no concrete funds at direct risk

Temporary freezing of funds

Smart contract unable to operate due to lack of token funds

Griefing (e.g. no profit motive for an attacker, but significant damage to the users or the protocol)

Taking down the application/website without user interaction

Redirecting users to malicious websites (Open Redirect)

Injecting/modifying the static content on the target application without JavaScript (reflected), such as:         - Reflected HTML injection         - Loading external site data

All Smart Contract impacts are only related to the Autonomous Agent assets.

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.

__Repeatable Attack Limitations__

Given that the reward for High is flat, there is no distinction between a one-time attack and an attack that is repeated and the reward stays the same. 

__Restrictions on Security Researcher Eligibility__

Security researchers who fall under any of the following are ineligible for a reward:

- Compensated team members of the Obyte Foundation
- Employees and team members of third-party suppliers to an Obyte Foundation affiliate that operate in a technical capacity and have assets covered in this bug bounty program

__Reward Calculation for Critical Level Reports__

For Blockchain/DLT bug reports, in order to qualify for the reward of USD 50 000, the bug reported must be able to cause unrecoverable total network shutdown of the entire Obyte network or allow the unpermitted execution of transactions from accounts of other users without their private keys. All other critical bug reports are capped at a flat rate of USD 2 500.

__Other Restrictions__

For all impacts directly involving funds being lost, the minimum impact is USD 1 000. Anything below is considered out-of-scope. 

The web/app  impacts of “Stealing User Cookies” and “Bypassing Authentication” are only accepted if they result in a loss of at least USD 1 000. The web/app impact of “Ability to execute system commands” is only accepted if the actions are done as root.


__Poc Requirements__
All web and app bug reports must come with a PoC. All bug reports submitted without PoC will be rejected with instructions to provide PoC.

Payouts are handled by the Obyte Foundation directly and are denominated in USD. The payout can be completed in GBYTE, BTC, or USDT.