Stacks
During a planned network upgrade, and with a 3 month window after the last hard fork is released, we’ve lowered the payouts for all classes of bug reports. This is a temporary measure as we work out any undiscovered bugs in our testing during this network transition. We still welcome reports during this transition, but be aware there will likely be a reduced payout until the network upgrade is finalized.
PoC required
KYC required
Rewards
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for each category, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. If there is any discrepancy with the classification in the Impacts in Scope section, the classification in the Impacts in Scope section will hold true.
Please note that Critical finding bounties are capped at 10% of the damage resulting from the finding. This mostly takes into account technical and financial damage but also includes the “human” impact, including reputational risk. We will guarantee a minimum payout of $25,000 USD for all valid Critical findings.
We agree to:
- Respond meaningfully to all reported issues in a timely manner.
- Not pursue legal action against or “counter-hack” any researchers acting in good faith and abiding by this program’s rules.
- Consider theoretical attacks and findings without proof-of-concept code as long as technically meaningful, evidence-based arguments are provided.
You must:
- Undergo full KYC. We are based in the United States and abide by all relevant law, including OFAC controls and sanctions.
- Not be based or test from an OFAC-sanctioned country or region or (be a sanctioned individual or organization) as defined here: https://ofac.treasury.gov/sanctions-programs-and-country-information
- Report all bugs using this template. All fields are required unless otherwise marked. Fields with a star (*) must be encrypted with the [email protected] GPG key, fingerprint 8A8B 3C3B 803A 0603 8FB5 3F69 357C 80AB 0885 87A0.
- Executive summary of issue:
- Finding details:
- Repository, file, and line of code where finding is found:
- Steps to replicate*:
- Proof-of-concept exploitation code*:
- Screenshots or video of finding being exploited using the PoC you have provided*:
- Impact of finding (short term):
- Impact of finding (long term):
- Mitigation suggestions (short term):
- Mitigation suggestions (long term):
- (Optional) Suggested patch:
- (Optional) Any useful links or resources:
- (Optional) Do you want a shout-out on our Security Wall of Fame?
- (Optional, if approved) Do you want a cybersecurity-themed NFT sent to your Stacks wallet?
- Use a private testnet. Testing on mainnet or public testnets is forbidden.
Payouts are handled by the Stacks Foundation team directly and are denominated in USD. However, payments will be made in the USD equivalent in the Stacks token (STX).
Program Overview
During a planned network upgrade, and with a 3 month window after the last hard fork is released, we’ve lowered the payouts for all classes of bug reports. This is a temporary measure as we work out any undiscovered bugs in our testing during this network transition. We still welcome reports during this transition, but be aware there will likely be a reduced payout until the network upgrade is finalized.
Stacks is a Bitcoin layer for smart contracts; it enables smart contracts and decentralized applications to use Bitcoin as an asset and settle transactions on the Bitcoin blockchain. In the upcoming Nakamoto release of Stacks, Stacks will be secured by the entire hash power of Bitcoin, giving it Bitcoin finality.
For more information about Stacks, please visit https://stacks.org/ and https://www.stacks.co/.
We at the Stacks Foundation maintain essential components of the Stacks blockchain infrastructure. Our security team prioritizes the following attack vectors:
- Theft of funds
- Permanent freezing of funds
- Total network shutdown or denial-of-service vectors
- Chain split or deep fork vectors
- Invalid transactions processing successfully or confirming
- Consensus failures
- Remotely exploitable weaknesses (as triggered through standard Stacks - RPC and P2P ports only)
- (In smart contracts) Vote manipulation
- (In smart contracts) Block stuffing attacks
- (In smart contracts) Theft or loss of unclaimed rewards
KYC required
The submission of KYC information is a requirement for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.