Stacks
Stacks is a Bitcoin layer for smart contracts; it enables smart contracts and decentralized applications to use Bitcoin as an asset and settle transactions on the Bitcoin blockchain. Stacks is secured by the entire hash power of Bitcoin, giving it Bitcoin finality.
PoC Required
KYC required
Arbitration enabled
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Only the following impacts are accepted within this bug bounty program. All other impacts are not considered as in-scope, even if they affect something in the assets in scope table.
Please note that all variants of remote denial-of-service attacks will automatically have their impact set to “Low”, regardless of any further downstream impact.
Blockchain
Critical:
- Any network to shut down or otherwise not confirm new valid transactions for multiple blocks
- Any triggering of a deep fork of 10 or more blocks without spending the requisite Bitcoin
- Any direct loss of funds other than through any form of freezing
- Any chain split caused by different nodes processing the same block or transaction and yielding different results
- Any confirmation of an invalid transaction, such as with an incorrect nonce
High:
- Any unintended chain split or network partition
- Any remotely-exploitable memory access, disk access, or persistent code execution
- Attacks are restricted to the Stacks blockchain RPC/P2P ports
Medium:
- Any transient consensus failures
Low:
- Any remotely-exploitable denial of service in a node
- Any network denial of service impacting more than 10% of miners that does not shut down the network
Smart Contracts
Critical:
- Any loss of user funds by permanent freezing or theft
- Any loss of governance funds (limited to
.cost-vote) - Any governance vote manipulation
High:
- Any theft of an unclaimed reward
- Any permanent freezing of an unclaimed reward
Medium:
- Any block stuffing without fund transfers being blocked
- Any block stuffing such that smart contract calls can be blocked but without paying any requisite higher transaction fees
Low:
- Any in-scope smart contract fails to deliver promised returns, but doesn’t lose value
- Any underpricing or overpricing of smart contract operations
Please review open PRs before your submission as all duplicate attacks are considered “Out of Scope” as per below.
sBTC
Critical:
- Direct loss of funds
- Permanent freezing of funds (fix requires hardfork)
High:
- sBTC not being able to confirm new transactions (total sBTC shutdown)
- Unintended permanent chain split requiring hard fork (network partition requiring hard fork)
Medium:
- A bug in the respective layer 1/2 network code that results in unintended smart contract behavior with no concrete funds at direct risk
- Shutdown of greater than or equal to 30% of sBTC signers without brute force actions, but does not shut down the network
- Temporarily freezing sBTC transactions
- API crash preventing correct processing of sBTC deposits/withdrawals
Low:
- Modification of transaction fees outside of design parameters
- Shutdown of greater than 10% or equal to but less than 30% of sBTC signers without brute force actions, but does not shut down the network
Please review open PRs before your submission as all duplicate attacks are considered “Out of Scope” as per below.
Any network to shut down or otherwise not confirm new valid transactions for multiple blocks
Any triggering of a deep fork of 10 or more blocks without spending the requisite Bitcoin
Any causing the direct loss of funds other than through any form of freezing
Any chain split caused by different nodes processing the same block or transaction and yielding different results
Any confirmation of an invalid transaction, such as with an incorrect nonce
Any loss of user funds by permanent freezing or theft
Any loss of governance funds (limited to .cost-vote)
Any governance vote manipulation
Any unintended chain split or network partition
Any remotely-exploitable memory access, disk access, or persistent code execution. Attacks are restricted to the Stacks blockchain RPC/P2P ports
Any theft of an unclaimed reward
Any permanent freezing of an unclaimed reward
Out of scope
- Any attacks on 3rd party services, including but not limited to AWS or Datadog.
-
Any sub-optimal default configuration changes.
-
Any phishing, social engineering, or related attacks against the Stacks ecosystem or any members or customers thereof.
-
Any attempt of phishing or other social engineering attacks against any Stacks ecosystem member.
-
Any reporting of findings that are already public or known to us, including but not limited to: open Github PRs and issues; previous findings reported by other researchers; findings discovered during currently-active third-party security assessments; and duplicated results of concluded assessments as posted here: https://stacks.org/audits. Novel methods of attack leading to an already-documented impact are allowed.
-
Any testing of third-party components.
- If it’s not listed as in-scope, it’s safe to assume you shouldn’t be testing or relying on it.
- If you disagree, feel free to explain why in your submission but DO NOT continue testing with our explicit written approval.
-
(If applicable to funds) Any actual theft or freeze of funds.
-
Any findings requiring access to or the cooperation of a Bitcoin miner.
-
Any theoretical attacks without substantial evidence and supporting documentation.
-
Any failure to provide any information requested in the above reporting template.
-
Any failure to use the given public GPG key to encrypt sensitive information.
-
Any negative or hostile behavior towards the Stacks ecosystem or members thereof, including but not limited to abuse of the ImmuneFi mediation process, initiation of direct contact with any Stacks ecosystem member via any communications method outside of ImmuneFi, and any form of coercion, harassment, threats, intimidation, stalking, or extortion.
- This also includes repeatedly asking for multiple status updates - we promise we have eyes on your report.
-
Any automated scanner findings or fuzz test results without an associated functional proof-of-concept.
-
Any testing on mainnet or public testnet beyond the absolute minimum required to prove that your finding exists on them.
-
Any active exploitation of a reported vulnerability beyond the absolute minimum required to prove the validity of your proof-of-concept code.
- You must not attack any other users under any circumstances. Test on your own addresses or contracts.
-
Any public disclosure of a reported issue, including via CVE number assignment.
-
Any failure to abide by any rules, requirements, or obligations as detailed above.
-
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers