Threshold Network
Threshold is the first ever on-chain merge between two existing networks and communities, Keep and NuCypher. The Threshold Network provides a suite of threshold cryptography products that power user sovereignty on the public blockchain. Threshold cryptography distributes sensitive operations across multiple independent entities, like nodes in a network. A successful operation requires a threshold or a minimum number of entities to cooperate.
PoC required
Rewards
Rewards by Threat Level
Mainnet assets:
Reward amount is % of the funds directly affected up to a maximum of:
$500,000Minimum reward to discourage security researchers from withholding a bug report:
$10,000Please review how rewards are distributed based on the Immunefi Vulnerability Severity Classification System V2.3 This is a simplified 4-level scale system with separate scales for Smart Contracts and Websites/Apps.
Rewards for critical smart contract bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 10 000 and a max program cap of USD 500 000
Rewards for high smart contract bug reports will be further capped at 100% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 5 000 and a max cap of USD 50 000
Rewards for medium smart contract vulnerabilities with direct monetary impact are further capped at 100% of the funds at risk. However, there is a minimum reward of USD 1 000 and a max cap of USD 5 000
Rewards for critical web/app bug reports will be further capped at 10% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 5 000.
Rewards for high web/app bug reports will be further capped at 100% of direct funds at risk if the bug discovered is exploited. However, there is a minimum reward of USD 1 000.
Payouts and Payout Requirements
Payouts are handled by the Threshold DAO team directly and are denominated in USD. However, payouts are made in T. (https://www.coingecko.com/en/coins/threshold-network-token#markets).
The calculation of the net amount rewarded is based on the average price between high and low for the day of the report submission as published on CoinMarketCap.com Historical Data (https://coinmarketcap.com/currencies/threshold/historical-data/) for the T token. No adjustments are made based on liquidity availability. For avoidance of doubt, if the reward amount is USD 5 000 and the average price at the time of the bug report submission is USD 1.75 per token, then the reward will be 2857.142857 units of that token.
Threshold Network commits to honoring payouts according to the terms set out in this program at the time of report submission, and to treat this program as the agreement and source of truth concerning bug reports and responsible disclosures.
For the purposes of determining report validity, this is a Primacy of Rules program.
Learn more about report validity best practices here: Best Practice - Primacy of Impact vs Primacy of Rules.
Threshold Network would like to notify whitehats that payouts concerning high and critical reports may exceed the SLA established by Immunefi. These larger payouts could be delayed by a few hours or days, depending on the amount, to allow our governance process to fund the required payment, which can take up to 14 days. Threshold Network will inform the whitehat whenever this is the case, within the SLA timeframe, to manage expectations and provide clarity.
KYC Requirements:
Threshold Network does not have a Know Your Customer (KYC) requirement for bug bounty payouts.
Audit Discoveries and Known Issues:
Bug reports covering previously-discovered bugs are not eligible for any reward through the bug bounty program. If a bug report covers a known issue, it may be rejected together with proof of the issue being known before escalation of the bug report via Immunefi.
Previous audits and known issues can be found at:
- https://leastauthority.com/blog/audits/audit-of-keep-network-tbtc-bridge-v2/ - tBTC Bridge
- https://www.certik.com/projects/threshold-network
- https://chainsecurity.com/security-audit/threshold-network/
- https://github.com/Thesis-Defense/Security-Audit-Reports/blob/main/PDFs/240411_Thesis_Defense-Threshold_tBTC_Base_Smart_Contracts_Security_Audit_Report.pdf - Base Smart Contracts
- https://github.com/threshold-network/token-dashboard/issues
- https://github.com/threshold-network/solidity-contracts/issues
- https://github.com/keep-network/tbtc-v2/issues (refers to known issues related to tBTC v2 contracts)
Program Overview
Threshold is the first ever on-chain merge between two existing networks and communities, Keep and NuCypher. The Threshold Network provides a suite of threshold cryptography products that power user sovereignty on the public blockchain. Threshold cryptography distributes sensitive operations across multiple independent entities, like nodes in a network. A successful operation requires a threshold or a minimum number of entities to cooperate. This simple idea increases security and availability and reduces reliance on trusted parties.Threshold is governed by a DAO whose parts hold separate responsibilities that are embedded in the governance structure. The Threshold DAO has two primary bodies: the Tokenholder DAO (based on the Governor Bravo governance model) and the Elected Council. The goal of this two-pronged structure is to enhance representation while ensuring accountability. Each governance body holds the other accountable, similar to the system of checks and balances found in most constitutional governments.
For more information about Threshold Network, please visit https://threshold.network/
For Whitehats: It is highly recommended that you review the details of this program in full. Although many Bug Bounty programs have standard terms and conditions, each also has their own unique details that are critical to your success.
Prior to submitting a report please review the Immunefi Bug Report Template and Best Practices.
KYC not required
No KYC information is required for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 2: Notice Required
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.
632.3k