Stacks

Any sub-optimal default configuration changes.

Any phishing, social engineering, or related attacks against the Stacks ecosystem or any members or customers thereof.

Any reporting of findings that are already public or known to us, including but not limited to: open Github PRs and issues; previous findings reported by other researchers; findings discovered during currently-active third-party security assessments; and duplicated results of concluded assessments as posted here: https://stacks.org/audits. Novel methods of attack leading to an already-documented impact are allowed.

Any testing of third-party components.

• If it’s not listed as in-scope, it’s safe to assume you shouldn’t be testing or relying on it.
• If you disagree, feel free to explain why in your submission but DO NOT continue testing with our explicit written approval.

(If applicable to funds) Any actual theft or freeze of funds.

Any findings requiring access to or the cooperation of a Bitcoin miner.

Any theoretical attacks without substantial evidence and supporting documentation.

Any failure to provide any information requested in the above reporting template.

Any failure to use the given public GPG key to encrypt sensitive information.

Any negative or hostile behavior towards the Stacks ecosystem or members thereof, including but not limited to abuse of the ImmuneFi mediation process, initiation of direct contact with any Stacks ecosystem member via any communications method outside of ImmuneFi, and any form of coercion, harassment, threats, intimidation, stalking, or extortion.

• This also includes repeatedly asking for multiple status updates - we promise we have eyes on your report.

Any automated scanner findings or fuzz test results without an associated functional proof-of-concept.

Any testing on mainnet or public testnet beyond the absolute minimum required to prove that your finding exists on them.

Any active exploitation of a reported vulnerability beyond the absolute minimum required to prove the validity of your proof-of-concept code.

• You must not attack any other users under any circumstances. Test on your own addresses or contracts.

Any public disclosure of a reported issue, including via CVE number assignment.

Any failure to abide by any rules, requirements, or obligations as detailed above.