Stacks is a Bitcoin layer for smart contracts; it enables smart contracts and decentralized applications to use Bitcoin as an asset and settle transactions on the Bitcoin blockchain. Stacks is secured by the entire hash power of Bitcoin, giving it Bitcoin finality.
Triaged by Immunefi
PoC Required
KYC required
Arbitration enabled
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Any causing the direct loss of funds
Any causing the direct loss of funds
Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results
Permanent freezing of funds
Any remotely-exploitable memory access, disk access, or persistent code execution. Attacks are restricted to the Stacks blockchain RPC/P2P
Unintended chain split (network partition)
Any DoS vector that prevents the network from confirming new valid transactions and for which confirmations are not restored after a new miner wins a Bitcoin-anchored tenure, and that either requires a consensus change to restore confirmations or has no demonstrated effective recovery (B3/R4 DoS vector or B3 DoS vector with no effective recovery demonstrated).
Theft of unclaimed yield
Permanent freezing of unclaimed yield
A bug in the respective layer 0/1/2 network code that results in unintended smart contract behavior with no concrete funds at direct risk
Any DoS vector that prevents some valid transactions or honest proposals from reaching the canonical chain while other transactions confirm and for which the inclusion of the affected transactions or proposals is not restored after a new miner wins a Bitcoin-anchored tenure, where recovery requires a new non-consensus-changing artifact, a consensus change, or is not demonstrated (B2/R3, B2/R4, or B2 with no effective recovery demonstrated).
Any DoS vector that prevents the network from confirming new valid transactions and for which confirmations are not restored after a new miner wins a Bitcoin-anchored tenure, but are restored through operator action using existing software or a new non-consensus-changing artifact (B3/R2 or B3/R3 DoS vector).
Out of scope
Out of Scope
- Please review our GitHub PRs and Issues before your submission, as all duplicate attacks are out of scope
- Any report which does not include a functional proof-of-concept
- Any attacks that rely on controlling >= 30% of the signer set in order to reject valid transactions
- Any attacks that rely on controlling >= 70% of the signer set in order to allow invalid transactions
- Any Stacks re-org directly caused by a Bitcoin re-org
- Any or attacks or testing on 3rd party services, including but not limited to AWS or Datadog
- Any sub-optimal default configuration changes
- Any phishing, social engineering, or related attacks against the Stacks ecosystem or any members or customers thereof
- Any reporting of findings that are already public or known to us, including but not limited to:
- Open or closed GitHub PRs
- Open or closed GitHub Issues
- Previous findings reported by other researchers
- Bugs previously disclosed in CVEs, security advisories, or other public forums
- Findings discovered during currently-active third-party security assessments
- Issues previously discovered and recorded by our internal security programs
- If your report is a duplicate of an internal security report, we will provide you the details of that internal report when closing your report
- Duplicated results of concluded assessments as posted here: https://stacks.org/audits
- Any bugs related to secp256r1 high-S signatures (secp256r1-verify will reject high-S signatures)
- Note: If your report demonstrates a materially higher severity impact or a novel exploit path for a known issue, we may consider such reports on a case-by-case basis (these typically pay MEDIUM severity awards)
- Any findings requiring access to or the cooperation of a Bitcoin miner.
- Any testing on mainnet or public testnet
- Any actual network damage, or theft or freezing of funds (do not run your proof-of-concept against mainnet).
- Any attacks without a proof-of-concept that can reliably and consistently reproduce the attack.
- Any negative or hostile behavior towards the Stacks ecosystem or members thereof, including but not limited to abuse of the ImmuneFi mediation process, initiation of direct contact with any Stacks ecosystem member via any communications method outside of ImmuneFi, and any form of coercion, harassment, threats, intimidation, stalking, or extortion.
- Any active exploitation of a vulnerability beyond the absolute minimum required to prove the validity of your proof-of-concept code.
- Any attacks against other users under any circumstances. Test on your own addresses or contracts.
- Any public disclosure of a reported issue without our written approval, including via CVE number assignment.
- Any failure to abide by any rules, requirements, or obligations as detailed in this bug bounty program.
- Any report involving a node attacking an event observer over a local network is out of scope, to include:
- Vulnerabilities whose root cause lies solely in a third-party or custom event observer implementation.
- HTTP requests that may trigger a local denial of service (including event observers like the stacks-signer binary).
- For Blockchain/DLT reports, please note: attacks are restricted to the Stacks blockchain RPC/P2P ports
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers