Stacks

Please review open PRs before your submission as all duplicate attacks are considered “Out of Scope”.

• Any attacks on 3rd party services, including but not limited to AWS or Datadog.
• Any sub-optimal default configuration changes.
• Any phishing, social engineering, or related attacks against the Stacks ecosystem or any members or customers thereof.
• Any attempt of phishing or other social engineering attacks against any Stacks ecosystem member.
• Any reporting of findings that are already public or known to us, including but not limited to: open Github PRs and issues; previous findings reported by other researchers; findings discovered during currently-active third-party security assessments; and duplicated results of concluded assessments as posted here: https://stacks.org/audits. Novel methods of attack leading to an already-documented impact are allowed.
• Any testing of third-party components.
  • If it’s not listed as in-scope, it’s safe to assume you shouldn’t be testing or relying on it.
  • If you disagree, feel free to explain why in your submission but DO NOT continue testing with our explicit written approval.
• (If applicable to funds) Any actual theft or freeze of funds.
• Any findings requiring access to or the cooperation of a Bitcoin miner.
• Any theoretical attacks without substantial evidence and supporting documentation.
• Any failure to provide any information requested in the above reporting template.
• Any failure to use the given public GPG key to encrypt sensitive information.
• Any negative or hostile behavior towards the Stacks ecosystem or members thereof, including but not limited to abuse of the ImmuneFi mediation process, initiation of direct contact with any Stacks ecosystem member via any communications method outside of ImmuneFi, and any form of coercion, harassment, threats, intimidation, stalking, or extortion.
  • This also includes repeatedly asking for multiple status updates - we promise we have eyes on your report.
• Any automated scanner findings or fuzz test results without an associated functional proof-of-concept.
• Any testing on mainnet or public testnet
• Any active exploitation of a reported vulnerability beyond the absolute minimum required to prove the validity of your proof-of-concept code.
  • You must not attack any other users under any circumstances. Test on your own addresses or contracts.
• Any public disclosure of a reported issue, including via CVE number assignment.
• Any failure to abide by any rules, requirements, or obligations as detailed above.
• Any bugs related to secp256r1 high-S signatures (secp256r1-verify will reject high-S signatures)
• Any report involving a node attacking an event observer over a local network is out of scope, to include:
  • Vulnerabilities whose root cause lies solely in a third-party or custom event observer implementation.
  • HTTP requests that may trigger a local denial of service (including event observers like the stacks-signer binary).
• Reports concerning vulnerabilities that are already publicly known at the time of submission are out of scope, including:
  • Issues currently tracked in the stacks-core GitHub issue tracker (open or closed).
  • Vulnerabilities described or referenced in open or closed pull requests in the stacks-core repository.
  • Bugs disclosed in CVEs, security advisories, or other public forums.
  • Note: If your report demonstrates a materially higher severity impact or a novel exploit path for a known issue, please note this explicitly — such reports may be considered on a case-by-case basis. -For Blockchain/DLT reports, please note, attacks are restricted to the Stacks blockchain RPC/P2P ports