All smart contracts of Stacks can be found at [https://github.com/stacks-network/stacks-blockchain/blob/master/src/chainstate/stacks/boot](https://github.com/stacks-network/stacks-blockchain/blob/master/src/chainstate/stacks/boot).  However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

Though the Node implementation asset has “testnet” in the folder name, it is not a testnet node and is within the scope of the bug bounty program.

Stacks is a Bitcoin layer for smart contracts; it enables smart contracts and decentralized applications to use Bitcoin as an asset and settle transactions on the Bitcoin blockchain. Stacks is secured by the entire hash power of Bitcoin, giving it Bitcoin finality.

Any remotely-exploitable denial of service in a node

Any network denial of service impacting more than 10% of miners that does not shut down the network

Any in-scope smart contract fails to deliver promised returns, but doesn’t lose value

Any underpricing or overpricing of smart contract operations

Any unintended chain split or network partition

Any remotely-exploitable memory access, disk access, or persistent code execution. Attacks are restricted to the Stacks blockchain RPC/P2P ports

Any theft of an unclaimed reward

Any permanent freezing of an unclaimed reward

Any transient consensus failures

Any block stuffing without fund transfers being blocked

Any network to shut down or otherwise not confirm new valid transactions for multiple blocks

Any triggering of a deep fork of 10 or more blocks without spending the requisite Bitcoin

Any causing the direct loss of funds other than through any form of freezing

Any chain split caused by different nodes processing the same block or transaction and yielding different results

Any confirmation of an invalid transaction, such as with an incorrect nonce

Any loss of user funds by permanent freezing or theft

Any loss of governance funds (limited to `.cost-vote`)

Any governance vote manipulation

Attacks are restricted to the Stacks blockchain RPC/P2P ports

Any block stuffing such that smart contract calls can be blocked, but without paying any requisite higher transaction fees

Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.

__Please note that all variants of remote denial-of-service attacks will automatically have their impact set to “Low”, regardless of any further downstream impact.__

__Blockchain__

**Critical:**
- Any network to shut down or otherwise not confirm new valid transactions for multiple blocks
- Any triggering of a deep fork of 10 or more blocks without spending the requisite Bitcoin
- Any direct loss of funds other than through any form of freezing
- Any chain split caused by different nodes processing the same block or transaction and yielding different results
- Any confirmation of an invalid transaction, such as with an incorrect nonce

**High:**
- Any unintended chain split or network partition
- Any remotely-exploitable memory access, disk access, or persistent code execution
- Attacks are restricted to the Stacks blockchain RPC/P2P ports

**Medium:**
- Any transient consensus failures

**Low:**
- Any remotely-exploitable denial of service in a node
- Any network denial of service impacting more than 10% of miners that does not shut down the network 

__Smart Contracts__

**Critical:**
- Any loss of user funds by permanent freezing or theft
- Any loss of governance funds (limited to `.cost-vote`)
- Any governance vote manipulation

**High:**
- Any theft of an unclaimed reward
- Any permanent freezing of an unclaimed reward

**Medium:**
- Any block stuffing without fund transfers being blocked
- Any block stuffing such that smart contract calls can be blocked but without paying any requisite higher transaction fees

**Low:**
- Any in-scope smart contract fails to deliver promised returns, but doesn’t lose value
- Any underpricing or overpricing of smart contract operations

Please review open PRs before your submission as all duplicate attacks are considered “Out of Scope” as per below.

__sBTC__

**Critical:**
- Direct loss of funds
- Permanent freezing of funds (fix requires hardfork)

**High:**
- sBTC not being able to confirm new transactions (total sBTC shutdown)
- Unintended permanent chain split requiring hard fork (network partition requiring hard fork)

**Medium:**
- A bug in the respective layer 1/2 network code that results in unintended smart contract behavior with no concrete funds at direct risk
- Shutdown of greater than or equal to 30% of sBTC signers without brute force actions, but does not shut down the network
- Temporarily freezing sBTC transactions
- API crash preventing correct processing of sBTC deposits/withdrawals

**Low:**
- Modification of transaction fees outside of design parameters
- Shutdown of greater than 10% or equal to but less than 30% of sBTC signers without brute force actions, but does not shut down the network

Please review open PRs before your submission as all duplicate attacks are considered “Out of Scope” as per below.

Stacks Codebase

Rewards are distributed according to the impact of the vulnerability based on the [Immunefi Vulnerability Severity Classification System V2.2](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2). This is a simplified 5-level scale, with separate scales for each category, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. If there is any discrepancy with the classification in the Impacts in Scope section, the classification in the Impacts in Scope section will hold true.

__Blockchain__

- Critical: Up to USD 250 000
- High: USD 25 000
- Medium	: USD 5 000
- Low: USD  1000
- Informational: Only in exceptional circumstances and solely at our discretion

__Smart Contracts__

- Critical: Up to USD  250 000
- High: USD 25 000
- Medium	: USD 5 000
- Low: USD  1000
- Informational: Only in exceptional circumstances and solely at our discretion

Please note that Critical finding bounties are capped at 10% of the damage resulting from the finding. This mostly takes into account technical and financial damage but also includes the “human” impact, including reputational risk. We will guarantee a minimum payout of $25,000 USD for all valid Critical findings.

__sBTC__

- Critical: Up to USD  250 000
- High: USD 25 000
- Medium: USD 5 000
- Low: USD  1000
- Informational: Only in exceptional circumstances and solely at our discretion

Please note that:

1. Critical finding bounties are capped at 10% of the damage resulting from the finding. This takes into account technical and financial damage but also includes the “human” impact, including reputational risk. We will guarantee a minimum payout of $25,000 USD for all valid Critical findings.
2. Non-Criticals which can be objectively determined to only be able to affect <1% of users may be downgraded by 1 severity.
3. Non-Critical impacts that are dependent on execution to have a malicious signer involved, may be downgraded by 1 severity level.
4. Non-Critical impacts on availability (e.g., denial of services) that are dependent on execution to have a malicious signer involved, may be downgraded by 1 or more severity levels.
5. Vulnerabilities related to WSTS will only be considered in scope if they can be exploited in sBTC.


Please note that Critical finding bounties are capped at 10% of the damage resulting from the finding. This mostly takes into account technical and financial damage but also includes the “human” impact, including reputational risk. We will guarantee a minimum payout of $25,000 USD for all valid Critical findings.

__We agree to:__

  - Respond meaningfully to all reported issues in a timely manner.
  - Not pursue legal action against or “counter-hack” any researchers acting in good faith and abiding by this program’s rules.
  - Consider theoretical attacks and findings without proof-of-concept code as long as technically meaningful, evidence-based arguments are provided.

__You must:__

  - Undergo full KYC. We are based in the United States and abide by all relevant law, including OFAC controls and sanctions.
  - Not be based or test from an OFAC-sanctioned country or region or (be a sanctioned individual or organization) as defined here: [https://ofac.treasury.gov/sanctions-programs-and-country-information](https://ofac.treasury.gov/sanctions-programs-and-country-information)
  - Report all bugs using this template. __All fields are required unless otherwise marked__. Fields with a star (*) must be encrypted with the security@stacks.org GPG key, fingerprint ABA3 7FA3 6DBB A591 B0E5  5949 0E94 D065 B32E C7E6.
    - Executive summary of issue: 
    - Finding details: 
    - Repository, file, and line of code where finding is found:  
    - Steps to replicate*: 
    - Proof-of-concept exploitation code*: 
    - Screenshots or video of finding being exploited using the PoC you have provided*:  
    - Impact of finding (short term): 
    - Impact of finding (long term): 
    - Mitigation suggestions (short term):
    - Mitigation suggestions (long term): 
    - (Optional) Suggested patch:
    - (Optional) Any useful links or resources:
    - (Optional) Do you want a shout-out on our Security Wall of Fame? 
    - (Optional, if approved) Do you want a cybersecurity-themed NFT sent to your Stacks wallet?
  - Use a private testnet. Testing on mainnet or public testnets is forbidden.

Payouts are handled by the __Stacks Foundation team__ directly and are denominated in __USD__. However, payments will be made in the __USD__ equivalent in the __Stacks__ token (STX).